Riskcovery

CVE-2026-8046

Incorrect Authorization in CODESYS Control

State
Published
Severity
7.2 High
Published
May 26, 2026
Updated
May 26, 2026
Reserved
May 6, 2026

Read the record on cve.org

Description

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges.

Scores

CVSSScoreVectorSource
4.07.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:NCERTVDE
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HCERTVDE

Weaknesses

Affected Products

ProductVersions
CODESYS Control RTE (SL)CODESYS
  • 3.0.0.0 to before 3.5.22.20Affected
CODESYS Control RTE (for Beckhoff CX) SLCODESYS
  • 3.0.0.0 to before 3.5.22.20Affected
CODESYS Control Win (SL)CODESYS
  • 3.0.0.0 to before 3.5.22.20Affected
CODESYS HMI (SL)CODESYS
  • 3.0.0.0 to before 3.5.22.20Affected
CODESYS Runtime ToolkitCODESYS
  • 3.0.0.0 to before 3.5.22.20Affected
CODESYS Control for BeagleBone SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for emPC-A/iMX6 SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for IOT2000 SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for Linux ARM SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for Linux SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for PFC100 SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for PFC200 SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for PLCnext SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for Raspberry Pi SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Control for WAGO Touch Panels 600 SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected
CODESYS Virtual Control SLCODESYS
  • 3.0.0.0 to before 4.21.0.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.