CVE-2026-10863

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists in the 'over-correlation' endpoint where the order query parameter is accepted from user-controlled named request parameters. This allows an authenticated user to override the server-defined ordering of over-correlating values. Depending on the processing by the underlying data access layer, this could lead to manipulation of database query ordering and potentially expose the application to unsafe query construction. The issue is located in the overCorrelations() function within the app/Controller/CorrelationsController.php component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.