Vulnerability · Published Aug 11, 2026 · Assigned by twcert
CVE-2026-19424Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference
High 7.5
In plain English
A high-severity authorization bypass via user-controlled key in Chiline Cloud from Inventec Appliances. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 56.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Inventec Appliances | Chiline Cloud | 0 – through 4.5.9 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-11096-0f578-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-11097-ee412-2.html third-party-advisory