CVE-2026-105046

Executive Summary

CVE-2026-105046 is a missing object-level authorization flaw (CWE-425, "Direct Request") in Kentico Xperience 13 prior to version 13.0.216, affecting administration API endpoints. The vulnerability allows an authenticated, low-privileged attacker to issue direct requests against administrative API resources without the platform verifying that the caller is authorized to access the targeted object. Impact is limited to confidentiality (CVSS 3.1 base score 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) — no integrity or availability impact is claimed. No public proof-of-concept, Nuclei template, or exploit code is known, and the issue is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org.

Technical Analysis

CWE-425 (Direct Request) describes a condition where an application fails to enforce authorization on a resource that is reachable directly, rather than exclusively through a mediated, protected interface. In this CVE, the affected component class is the administration API endpoints of Kentico Xperience 13. According to the NVD description, versions before 13.0.216 "lack object-level authorization checks" for those endpoints.

Two distinct authorization concepts are relevant and frequently conflated:

1. Function-level authorization — verifying that the caller holds a role/permission that grants access to an administrative function at all.
2. Object-level authorization — verifying that the caller is permitted to act on the specific object (record, entity, resource identifier) referenced by the request.

The NVD description explicitly identifies the missing control as object-level authorization. This means an attacker who can reach the administration API — and who is authenticated at a low privilege level (reflected by the CVSS PR:L metric) — may be able to supply references to objects outside the scope of their granted permissions and have those requests processed without an ownership/entitlement check.

Key characteristics derivable from the provided data:

• Attack vector: Network (AV:N) — the administration API is reachable over HTTP(S).
• Privileges required: Low (PR:L) — a valid, low-privileged authenticated session is required; this is not a pre-authentication flaw.
• User interaction: None (UI:N) — exploitation is fully scriptable; no victim action is needed.
• Scope: Unchanged (S:U) — the vulnerable authorization decision remains within the Kentico Xperience application boundary.
• Confidentiality impact: Low (C:L) — exposure of data that the caller should not be permitted to read.
• Integrity / Availability impact: None (I:N / A:N) per the vector.

No CNA title was supplied, no affected-version array is populated in the OSV package data, and no vendor advisory text is available in the provided intelligence. Consequently, no specific endpoint paths, controller or action names, request parameters, object identifier formats, or authentication mechanisms are named anywhere in the source data. This report therefore describes the vulnerability at the class level and does not invent function names, routes, or parameter names. Any analyst attempting to weaponize or validate this finding in a lab must first enumerate the administration API surface of the specific 13.x deployment under test.

The pre-fix condition can be summarized as: the administration API applies authentication (a session/token is required) but does not consistently apply per-object entitlement evaluation before returning or acting on the referenced object. The practical consequence is horizontal or vertical data exposure through direct requests — the defining pattern of CWE-425.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-105046. The attack chain below is inferred from the vulnerability class (CWE-425, missing object-level authorization on an administration API) and from the provided CVSS metrics. It contains no fabricated endpoint names, parameters, or code symbols.

1) Reconnaissance / target identification. The attacker identifies internet- or intranet-exposed Kentico Xperience 13 installations running a build earlier than 13.0.216. Identification is passive-to-semi-passive: HTTP response headers, page titles, static asset paths, and any publicly reachable administrative or API surface that self-identifies as Kentico Xperience.

2) Obtaining the required low-privilege foothold. The CVSS vector requires PR:L. The attacker must therefore hold some form of authenticated access — for example a low-privileged administrative or delegated content-editing account, a compromised session, or credentials obtained through unrelated means. The attacker then authenticates normally; the vulnerability is not a bypass of authentication itself but of the authorization decision that follows.

3) Triggering the missing object-level authorization. Holding a valid low-privilege session, the attacker issues direct requests to the administration API that reference objects they are not entitled to. Because object-level authorization is not enforced (per the NVD description), the request is processed based on the referenced identifier rather than on the caller's entitlement to that identifier. This is the CWE-425 "Direct Request" pattern: reaching a resource directly without passing through the intended authorization gate.

Two common variants of this class, both consistent with the description:

• Horizontal access: a low-privileged user references objects belonging to another user, site, or tenant.
• Vertical access: a low-privileged user reaches object data intended only for higher-privileged administrative roles.

4) Payload / execution method. At the vulnerability-class level, the "payload" is a syntactically valid, properly authenticated API request whose target identifier falls outside the caller's authorized object set. No memory-corruption, injection, or code-execution primitive is involved; exploitation is limited to unauthorized retrieval/processing of administrative API object data. Enumeration of the API surface and iterative identifier substitution are the typical techniques.

5) Post-exploitation impact. Consistent with C:L and I:N/A:N, the realistic outcome is disclosure of administrative object data exposed through the administration API that the low-privileged user was never intended to read. This may include configuration, content, user, or tenant metadata depending on what those endpoints return. The vector explicitly claims no integrity or availability impact, so this CVE should not be treated as a path to content tampering or denial of service on its own. However, disclosed administrative data can materially assist subsequent, higher-impact attacks (targeted phishing, credential harvesting, privilege escalation via unrelated flaws, or lateral movement within a hosted environment), so its operational value in a multi-stage intrusion should not be underestimated despite the modest base score.

No evidence of exploit-in-the-wild, no public PoC repository, and no CISA KEV listing exist for this CVE at the time of writing.

Impact Assessment

Business impact. The direct impact is a confidentiality breach scoped to administrative API object data. For organizations running Kentico Xperience 13 as a public-facing CMS or digital experience platform, the affected surface is the administration API — a high-value interface by definition. Unauthorized object access can expose data that supports downstream attacks, including account enumeration, tenant/site segmentation failures, and insight into hosted content structures.

Affected systems. All Kentico Xperience 13 deployments at a build earlier than 13.0.216 are presumptively in scope, per the NVD description. No affected-version array or package list was provided in the source data, so no narrower or broader range can be stated with confidence. Deployments hosted on shared infrastructure or multi-tenant configurations face an elevated relative risk, since object-scope failures in such environments can cross organizational boundaries.

Blast radius. Constrained by the PR:L requirement: an attacker must already possess a valid low-privileged authentication context. This substantially limits opportunistic mass exploitation and explains the modest EPSS positioning (currently unscored by FIRST.org). The scope remains Unchanged (S:U), so no "escape" from the application's security authority is claimed.

CVSS subscore interpretation.

• AV:N — administrative API reachable over the network.
• AC:L — no special conditions or race windows needed.
• PR:L — requires an authenticated low-privilege session.
• UI:N — no user interaction; fully automatable.
• S:U — impact confined to the vulnerable component's authority.
• C:L — limited unauthorized data read.
• I:N / A:N — no claimed modification or disruption.
• Base 4.3 — Medium.

Strategic assessment. This is a low-to-moderate severity, authenticated, confidentiality-only flaw. Its most realistic role is as a supporting finding in a broader intrusion: a foothold account plus this authorization gap can convert limited access into meaningful reconnaissance data. Given the absence of a public PoC and KEV listing, it is unlikely to drive broad, untargeted exploitation; it is more relevant to targeted assessments of Kentico Xperience estates.

Detection Guidance

Detection must focus on the administration API request pattern: authenticated low-privilege sessions issuing requests that enumerate or substitute object identifiers across permission boundaries. Because no endpoint paths, parameters, or object identifier formats are specified in the source data, the rules below detect behavior and log/request anomalies at the vulnerability-class level, using generic patterns rather than fabricated endpoint strings. Analysts must adjust the placeholder path fragments (marked in comments) to match their deployment's actual administration API routes after inventorying the application.

Sigma Rule

title: Potential Missing Object-Level Authorization on Kentico Xperience Administration API
id: 9f1c0a7e-3b2d-4c88-9b6f-105046cve001
status: experimental
description: Detects authenticated low-privilege sessions issuing repetitive administration API requests referencing varying object identifiers, consistent with CWE-425 direct-request object enumeration against Kentico Xperience 13 (< 13.0.216).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105046
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_api:
    cs-uri-stem|contains:
      - '/api/'          # adjust to the deployment's actual administration API root
      - '/Admin/'        # adjust after inventorying administration routes
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_enum:
    cs-uri-query|re|contains:
      - 'id=[0-9]{1,6}'
      - 'objectid=[0-9]{1,6}'
      - 'nodeid=[0-9]{1,6}'
  filter_known_automation:
    cs-user-agent|contains:
      - 'HealthCheck'
      - 'MonitoringBot'
  condition: selection_api and selection_method and selection_enum and not filter_known_automation
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrative bulk operations
  - Content synchronization tooling
level: medium

YARA Rule

rule CVE_2026_105046_Kentico_Xperience_ObjectAuth_Probe
{
    meta:
        description = "Detects request artifacts referencing administration API object access patterns potentially associated with CVE-2026-105046 (Kentico Xperience 13 < 13.0.216)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105046"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $api  = "/api/" ascii nocase wide
        $adm  = "/Admin/" ascii nocase wide
        $id1  = "objectid=" ascii nocase wide
        $id2  = "nodeid=" ascii nocase wide
        $xp   = "Kentico" ascii nocase wide
        $ver  = "13.0." ascii nocase wide

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true) and
        (any of ($api, $adm)) and
        (any of ($id1, $id2)) and
        ($xp or $ver)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105046 Kentico Xperience Administration API Object-Level Authorization Probe"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; nocase; http.uri; pcre:"/(objectid|nodeid|id)=\d{1,6}/i"; threshold: type both, track by_src, count 20, seconds 60; sid:2026105046; rev:1; metadata: cve CVE-2026-105046, created_at 2026_01_01; classtype:attempted-recon;)

Elastic Detection

sequence by user.name, source.ip with maxspan=60s
  [network where http.request.method in ("GET", "POST") and
     wildcard(http.request.uri.path, "/api/*") and
     wildcard(http.request.uri.query, "*id=*")]
  [network where http.request.method in ("GET", "POST") and
     wildcard(http.request.uri.path, "/api/*") and
     wildcard(http.request.uri.query, "*id=*")]
  [network where http.request.method in ("GET", "POST") and
     wildcard(http.request.uri.path, "/api/*") and
     wildcard(http.request.uri.query, "*id=*")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| eval uri_path = coalesce(uri_path, cs_uri_stem)
| eval uri_query = coalesce(uri_query, cs_uri_query)
| where match(uri_path, "(?i)/(api|Admin)/")
| where match(uri_query, "(?i)(objectid|nodeid|id)=\d{1,6}")
| eval object_ref = mvindex(split(uri_query, "="), 1)
| stats count distinct(object_ref) as distinct_objects values(uri_path) as paths by src_ip, user
| where distinct_objects > 25 AND count > 50
| sort - distinct_objects
| table src_ip, user, count, distinct_objects, paths

Wazuh OSSEC Rule

<group name="web,kentico,cve-2026-105046,">
  <rule id="100546" level="0">
    <decoded_as>web-accesslog</decoded_as>
    <regex type="pcre2">(?i)/(api|Admin)/</regex>
    <description>CVE-2026-105046: Kentico administration API request observed (base event).</description>
  </rule>

  <rule id="100547" level="7" frequency="20" timeframe="60">
    <if_matched_sid>100546</if_matched_sid>
    <same_source_ip />
    <regex type="pcre2">(?i)(objectid|nodeid|id)=\d{1,6}</regex>
    <description>CVE-2026-105046: Possible object-level authorization abuse - repeated administration API object requests from $(srcip).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attempted_recon,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch artifact, vendor advisory, commit reference, or OSV package update evidence was found in any tracked source. The NVD description references version 13.0.216 as the boundary below which the flaw exists, which strongly implies 13.0.216 is the fixed build — but this is not confirmed by a vendor advisory or release note in the provided data, and must be verified directly with Kentico before being relied upon. Do not treat 13.0.216 as a confirmed fix without vendor confirmation.

1) Immediate mitigations (compensating controls).

• Restrict administration API reachability. Place the administration API behind network-layer controls: VPN, zero-trust access proxy, or IP allowlisting. Removing unauthenticated/authenticated internet exposure eliminates the AV:N path.
• Enforce least privilege on accounts. Because the flaw requires only PR:L, aggressively reduce the number and privileges of low-privileged administrative accounts. Audit delegated roles for unnecessary breadth.
• Deploy a reverse-proxy authorization layer. Insert an authorization gateway in front of the administration API that performs object-level entitlement checks the application itself does not enforce, keyed to the authenticated principal and the requested object identifier.
• Add behavioral detection. Operationalize the Sigma/Suricata/Splunk/Wazuh rules above to flag enumeration patterns (high distinct-object counts per session) against administration API routes.
• Monitor logs centrally. Ensure administration API access logs (principal, object identifier, status) are retained and correlated, since post-incident scope assessment depends on them.

2) Patch / upgrade steps.

• Verify the current Kentico Xperience 13 build number of every deployment. Treat any build earlier than 13.0.216 as presumptively affected.
• Obtain an authoritative advisory directly from Kentico. Confirm whether 13.0.216 (or a later build) contains the object-level authorization fix and whether any additional hotfix exists.
• Upgrade affected installations to the confirmed fixed build using vendor-supported upgrade procedures; test in staging first given CMS upgrade complexity.
• If upgrade cannot be performed immediately, keep the compensating controls in step 1 in place until it can.
• Re-run the deployment inventory after upgrade to confirm no residual vulnerable builds remain (including staging, DR, and forgotten instances).

3) Long-term hardening.

• Centralize object-level authorization. Move entitlement checks into a shared authorization layer rather than relying on per-endpoint implementation, which is the root cause class here (CWE-425).
• Add authorization regression testing. For every administration API endpoint, implement automated tests that assert a low-privilege principal cannot access objects outside its entitlement set.
• Adopt deny-by-default API design. New endpoints should fail closed when no explicit object-level authorization rule exists.
• Integrate secure development review around authorization boundaries and mandate periodic third-party assessment of administrative interfaces.
• Track CVE-2026-105046 through NVD and the Kentico security channel for advisory updates, KEV status changes, and any future EPSS scoring.

References

1. NVD — CVE-2026-105046: https://nvd.nist.gov/vuln/detail/CVE-2026-105046
2. MITRE CWE-425 — Direct Request ('Forced Browsing'): https://cwe.mitre.org/data/definitions/425.html
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Kentico Security Advisories and Release Notes: https://www.kentico.com/ (verify advisory for 13.0.216 directly with the vendor)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-105046 is NOT listed; no KEV entry exists.

Threat actor / exploit-in-the-wild status: No known threat actor campaigns, no public proof-of-concept, no Nuclei template, and no exploit code are associated with CVE-2026-105046 in the available intelligence. EPSS has not been scored by FIRST.org. All exploitation reasoning in this report is inferred from the CWE-425 vulnerability class and the supplied CVSS metrics.