CVE-2026-74994: erlang otp Incorrect Authorization
Vulnerability summary
CVE-2026-74994 is a medium (CVSS 6.0) Incorrect Authorization vulnerability in erlang otp. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 01-09-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.27 pp
From 0.36% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-1289Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Affected systems
Debian1 product
- erlangAll versions (No fix recorded) | < 1:29.0.6+dfsg-1
Erlang1 product
- otp≥ 17.0, < 27.3.4.17 | ≥ 28.0, < 28.5.0.6 | ≥ 29.0, < 29.0.6 | ≥ 5.10, < 9.3.2.7 | ≥ 9.4, < 9.6.2.3 | ≥ 9.7, < 9.7.2 | ≥ 84adefa331c4159d432d22840663c38f155cd4c1 (No fix recorded)
Ubuntu1 product
- erlang< 1:16.b.3-dfsg-1ubuntu2.2+esm3 | < 1:18.3-dfsg-1ubuntu3.1+esm4 | < 1:20.2.2+dfsg-1ubuntu2+esm4 | < 1:22.2.7+dfsg-1ubuntu0.5+esm3 | < 1:24.2.1+dfsg-1ubuntu0.8 | < 1:25.3.2.8+dfsg-1ubuntu4.8 | < 1:27.3.4.6+dfsg-1ubuntu0.2
3 vendors · 3 products
