CVE-2026-1433

{
  "id": "CVE-2026-1433",
  "sourceIdentifier": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
  "published": "2026-07-06T09:16:34.877",
  "lastModified": "2026-10-25T15:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "uniFLOW Universal Login Manager (ULM) Standalone\ncontains an information disclosure vulnerability that may allow an\nauthenticated administrator to access sensitive configuration information\nthrough the ULM Remote User Interface (RUI). Exploitation requires\nadministrative privileges and may disclose configuration data associated with\nSMTP or LDAP integrations. ULM deployments connected to uniFLOW Server or\nuniFLOW Online are not affected."
    },
    {
      "lang": "es",
      "value": "uniFLOW Universal Login Manager (ULM) Autónomo\ncontiene una vulnerabilidad de revelación de información que puede permitir a un\nadministrador autenticado acceder a información de configuración sensible\na través de la Interfaz de Usuario Remota (RUI) de ULM. La explotación requiere\nprivilegios administrativos y puede revelar datos de configuración asociados con\nintegraciones SMTP o LDAP. Las implementaciones de ULM conectadas a uniFLOW Server o\nuniFLOW Online no se ven afectadas."
    }
  ],
  "affected": [
    {
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
      "affectedData": [
        {
          "vendor": "NT-ware",
          "product": "uniFLOW ULM (Universal Login Manager) Standalone",
          "defaultStatus": "unaffected",
          "platforms": [
            "Web Application"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "5.10",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-06T18:53:50.994716Z",
          "id": "CVE-2026-1433",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://ntware.atlassian.net/wiki/spaces/SA/pages/13659504652/2026+Security+Advisory+ULM+Potential+Information+Disclosure",
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"
    },
    {
      "url": "https://www.canon-europe.com/psirt/advisory-information",
      "source": "4586e0a2-224d-4f8a-9cb4-8882b208c0b3"
    }
  ]
}