Vulnerability · Published May 4, 2026 · Assigned by VulnCheck

CVE-2026-42796Arelle < 2.39.10 Unauthenticated RCE via /rest/configure

Critical 9.8

In plain English

A critical-severity missing authentication in Arelle from Arelle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.7%top 13.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.

Affected products (as reported)

Vendor	Product	Versions
Arelle	Arelle	0 – before 2.39.10

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/Arelle/Arelle/releases/tag/2.39.10 release-notes, patch
https://github.com/Arelle/Arelle/pull/2320 issue-tracking
https://www.vulncheck.com/advisories/arelle-unauthenticated-rce-via-rest-configure third-party-advisory