Vulnerability Description
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sparxsystems | Pro Cloud Server | <= 6.1.167 |
Related Weaknesses (CWE)
References
- https://cert.pl/en/posts/2026/05/CVE-2026-42096Third Party Advisory
- https://efigo.pl/blog/CVE-2026-42096/Third Party Advisory
- https://sparxsystems.com/products/procloudserver/Product
- https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.htmlExploitThird Party Advisory
FAQ
What is CVE-2026-42096?
CVE-2026-42096 is a vulnerability with a CVSS score of 8.8 (HIGH). Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within dat...
How severe is CVE-2026-42096?
CVE-2026-42096 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42096?
Check the references section above for vendor advisories and patch information. Affected products include: Sparxsystems Pro Cloud Server.