CVE-2026-103903

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS (affected versions not specified)

Description An incorrect authorization issue exists in the WinBox authentication flow. A remote authenticated attacker with low-privilege credentials can obtain the authorization policy of another account. This occurs because the stage-one EC-SRP (Elliptic Curve Secure Remote Password) challenge and proof are verified using the attacker's account, but the stage-two username is used to install the target account's privileges. By specifying a high-privilege account like admin, a low-privilege user can establish a full administrative session without the target password and subsequently elevate the privileges of their own account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Review low-privilege accounts to minimize potential risk.