CVE-2026-15541
Full vulnerability record from the local CVENow database.
Description
A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-13 08:16:20.600000
Last modified
2026-10-24 22:10:00.210000
View original CVE JSON
{
"id": "CVE-2026-15541",
"sourceIdentifier": "[email protected]",
"published": "2026-07-13T08:16:20.600",
"lastModified": "2026-10-24T22:10:00.210",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance."
},
{
"lang": "es",
"value": "Se ha encontrado una vulnerabilidad en will-moss Isaiah hasta 1.36.9. El elemento afectado es la función Server.Handle del archivo app/server/server/server.go del componente Gestor Maestro de Websockets. La ejecución de una manipulación del argumento Agent puede llevar a una falta de autorización. Es posible lanzar el ataque de forma remota. La pull request para solucionar este problema espera ser aceptada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "will-moss",
"product": "Isaiah",
"cpes": [
"cpe:2.3:a:will-moss:isaiah:*:*:*:*:*:*:*:*"
],
"modules": [
"Master Websocket Handler"
],
"versions": [
{
"version": "1.36.0",
"status": "affected"
},
{
"version": "1.36.1",
"status": "affected"
},
{
"version": "1.36.2",
"status": "affected"
},
{
"version": "1.36.3",
"status": "affected"
},
{
"version": "1.36.4",
"status": "affected"
},
{
"version": "1.36.5",
"status": "affected"
},
{
"version": "1.36.6",
"status": "affected"
},
{
"version": "1.36.7",
"status": "affected"
},
{
"version": "1.36.8",
"status": "affected"
},
{
"version": "1.36.9",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"baseScore": 7.5,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-13T14:28:18.172388Z",
"id": "CVE-2026-15541",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
},
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"references": [
{
"url": "https://github.com/will-moss/isaiah/",
"source": "[email protected]"
},
{
"url": "https://github.com/will-moss/isaiah/issues/34",
"source": "[email protected]"
},
{
"url": "https://github.com/will-moss/isaiah/pull/35",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-15541",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/855074",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/377891",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/377891/cti",
"source": "[email protected]"
}
]
}