---
id: CVE-2026-103903
title: >-
  An incorrect authorization vulnerability in the WinBox

  authentication flow of MikroTik RouterOS allows a remote authenticated
  attacker

  with credentials for a low-privilege account permitted to use WinBox to obtain

  the authorization polic…
summary: >-
  An incorrect authorization vulnerability in the WinBox

  authentication flow of MikroTik RouterOS allows a remote authenticated
  attacker

  with credentials for a low-privilege account permitted to use WinBox to obtain

  the authorization polic…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T11:17:09.517'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103903'
references:
  - url: 'https://br2sec.com/lv/resursi/2026-routeros-winbox-auth-bypass/'
    label: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
  - url: 'https://cvd.cert.lv/disclosed/vuln-all-709639748'
    label: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
  - url: 'https://forum.mikrotik.com/t/7-25rc1-testing-is-released/27352'
    label: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
  - url: >-
      https://mikrotik.com/download/changelogs?channelFilter=stable&versionFilter=7.24.5
    label: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.104Z'
---

## Overview

An incorrect authorization vulnerability in the WinBox
authentication flow of MikroTik RouterOS allows a remote authenticated attacker
with credentials for a low-privilege account permitted to use WinBox to obtain
the authorization policy of a different existing account. The stage-one EC-SRP
challenge and proof are verified using the attacker's account, while the
independently supplied stage-two username is used to install the target
account's privileges. By specifying a higher-privilege account such as admin, a
low-privilege user can obtain a full administrative session without knowing the
target account's password and can use that session to increase the privileges
of the attacker's own account.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.