CVE-2026-89309

Name of the Vulnerable Software and Affected Versions tbc versions prior to 1

Description The authorization middleware of the WMS MobileServer fails to enforce authentication in two scenarios. First, authentication is only required for GET and HEAD requests, allowing other HTTP methods to be processed without checks. Second, requests using any HTTP method that contain a malformed or non-bearer Authorization header are permitted without a valid token. This allows a remote attacker with network access to invoke API functionality without valid credentials.

Recommendations Update tbc to version 1 or later.