---
id: CVE-2026-107187
title: >-
  Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of
  Sensitive Tables
summary: >-
  A user can access any database details, such as usernames and passwords by
  sending a DWR request with a specified workflow rule. The authentication
  bypass vulnerability can be chained with this vulnerability to perform
  database reads wit…
severity: high
cvss: 8.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: Eptura
product: Archibus
affected:
  - Archibus < 2025.02
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T16:35:01.728Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107187'
references:
  - url: >-
      https://www.rapid7.com/blog/post/ve-authentication-bypass-remote-code-execution-and-database-read-in-eptura-archibus-fixed/
tags:
  - cve.org
ingestedAt: '2026-10-19T17:33:42.475Z'
---

## Overview

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authentication bypass vulnerability can be chained with this vulnerability to perform database reads without authentication. Database write and delete operations may also be possible, but this was untested.

## Affected

- `Archibus < 2025.02`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.