{"affected":[{"product":"Aspera Connect","source":"CNA: ibm","vendor":"IBM","versions":[{"lessThanOrEqual":"4.2.19","status":"affected","version":"1.6.1","versionType":"semver"}]}],"cveId":"CVE-2026-120115","cwes":["CWE-862"],"description":"IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1794157948376,"publishedAt":1794157948376,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7295714"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"It is recommended to apply the fix as soon as possible, see links in the table below.\n\nProductFixing VRMPlatformLink to FixIBM Aspera Connect4.2.20\n\nLinux Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nMac OSX Link https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Aspera Connect4.2.20\n\nWindows Link https://www.ibm.com/support/fixcentral/swg/downloadFixes"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7295714"}],"revision":"d87886b2026afffcfd79a91be5cfe550bd9f378eccd79c617c21cb30efff566b","sources":[{"modifiedAt":1794157948376,"name":"CNA: ibm","retrievedAt":1794161317732,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120115"}],"ssvc":null,"status":"published","title":"Multiple vulnerabilities in IBM Aspera Connect","updatedAt":1794161317732}