Auth bypass in Erlang Otp

CVE-2026-28808

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside Documen…

Vulnerability class: Broken Access Control

EPSS: 0.000 (11.1th percentile) — read the EPSS interpretation.

Affected products

Erlang Otp — versions 5.10, 17.0, 07b8f441ca711f9812fad9e9115bab3c3aa92f79

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

github.com/erlang/otp/security/advisories/GHSA-3vhp-h532-mc3f (vendor-advisory, related)
cna.erlef.org/cves/CVE-2026-28808.html (related)
osv.dev/vulnerability/EEF-CVE-2026-28808 (related)
www.erlang.org/doc/system/versions.html (x_version-scheme)
github.com/erlang/otp/commit/8fc71ac6af4fbcc54103bec2983ef22e82942688 (patch)
github.com/erlang/otp/commit/9dfa0c51eac97866078e808dec2183cb7871ff7c (patch)