Vulnerability · Published Oct 24, 2026 · Assigned by VulDB

CVE-2026-115803Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in Scada-LTS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 87.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."

Affected products (as reported)

Vendor	Product	Versions
n/a	Scada-LTS	2.8.0

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

References

VDB-425987 | Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization vdb-entry, technical-description
VDB-425987 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-115803 | CVE Analysis and Report third-party-advisory
Submit #916011 | Scada-LTS 2.8.0 Improper Authorization third-party-advisory