CVE-2026-4201: glowxq glowxq-oj Improper Access Control

Vulnerability summary

CVE-2026-4201 is a high (CVSS 7.5) Improper Access Control vulnerability in glowxq glowxq-oj. EPSS estimates a 1.26% chance of exploitation in the next 30 days, higher than 69.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-03-2026
   PublishedVulnerability first disclosed.
2. 16-03-2026
   Last modifiedVulnerability information updated.

Description

A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function Upload of the file business/business-system/src/main/java/com/glowxq/system/admin/controller/SysFileController.java. Executing a manipulation can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.