CVE Intelligence
Analysis AI-assisted

CVE-2026-42160: Data Space Portal: Insufficient Authorization on Self-Registered Accounts

CVE-2026-42160 affects the backend of Data Space Portal, an open-source SaaS solution for dataspace management, in versions from 2.1.1 before 7.3.2. Authorization is insufficient for organization and user accounts that were self-registered and remain in a PENDING state. The vendor fixed the issue in version 7.3.2, and the GitHub CNA scored it 10 under CVSS 4.0.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The GitHub Security Advisory GHSA-989g-wpfv-6vxx, published for the sovity dataspace-portal project, describes insufficient authorization in the backend of Data Space Portal. The weakness concerns organization and user accounts that were self-registered and are still in a PENDING state. According to the record, the issue affects versions from 2.1.1 up to but not including 7.3.2, and it was patched in 7.3.2.

Impact

  • The record states that authorization is insufficient for self-registered PENDING accounts, which suggests that such accounts may be able to reach functions that should be limited to approved accounts (inference).
  • The CVSS 4.0 vector supplied with the record lists high confidentiality and integrity impacts on the vulnerable system and low availability impact (confirmed from the record's vector components).
  • The CWE identifier assigned is CWE-602. The record does not provide the CWE name, so its exact classification should be checked at the CWE source.

Affected products and versions

  • Product: Data Space Portal (sovity dataspace-portal), described as an open-source SaaS solution for dataspace management.
  • Affected range stated in the record: from 2.1.1 before 7.3.2.
  • Fixed version stated in the record: 7.3.2, with a release tag referenced in the GitHub project.
  • The structured affected and fixes fields in the record are empty, so the range above comes only from the description and references.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation can be stated from the KEV data. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00421 with a percentile of 0.34697, which indicates a low estimated likelihood of exploitation in the near term according to that model.

Remediation and mitigation

  • Upgrade Data Space Portal to version 7.3.2 or later, which the record identifies as the patched release.
  • Review the release notes and the GitHub advisory for upgrade instructions and any additional steps.
  • Until the upgrade is complete, consider restricting or pausing self-registration and reviewing how PENDING accounts are handled. The record does not describe a formal workaround, so this is a general defensive measure (inference).

Detection guidance

  • Inventory all running Data Space Portal instances and confirm their versions against the 2.1.1 to 7.3.2 range.
  • Review the list of accounts and organizations in PENDING state for entries that were not expected or that appear to have been created without a known business reason.
  • Review backend access logs for activity by PENDING accounts against administrative or non-public functions, focusing on unexpected access patterns at a high level.

Limitations of the available information

  • The record does not list specific vulnerable endpoints, functions, or exploit conditions beyond the general description.
  • The structured affected and fixes fields are empty; version information is taken from the description.
  • The source status is Deferred, and the record does not include a CISA KEV entry or ransomware information.
  • The EPSS date in the record (2026-10-13) should be verified against the current EPSS data before it is relied upon.

Frequently asked questions

Which versions of Data Space Portal are affected by CVE-2026-42160?

According to the record, versions from 2.1.1 up to but not including 7.3.2 are affected. The structured affected field is empty, so this range comes from the description.

What is the recommended fix?

The record identifies version 7.3.2 as the patched release. Upgrading to 7.3.2 or later is the recommended defensive step, and the GitHub advisory should be consulted for details.

Is this CVE known to be actively exploited?

The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.