CVE-2026-8800

Executive Summary

CVE-2026-8800 is an Incorrect Authorization vulnerability in Progress MOVEit Transfer, specifically within the Audit User module. This flaw allows a low-privileged authenticated user to access audit logs or perform actions beyond their intended permissions due to improper access control checks. The vulnerability affects MOVEit Transfer versions before 2025.0.7 and from 2025.1.0 before 2025.1.3. With a CVSS score of 2.7 (Low), the risk is minimal but could lead to unauthorized information disclosure of audit data. No public proof-of-concept or exploit code is available, and the EPSS score is 0.0%, indicating very low exploitation likelihood. The vendor has released patches in versions 2025.0.7 and 2025.1.3.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise file transfer application (Progress MOVEit Transfer). No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs valid low-privileged credentials.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited unauthorized access to audit data.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. The vulnerability requires authentication and only exposes audit logs, which may contain sensitive information but does not allow system compromise.

Deep Dive & Mechanics

The vulnerability resides in the Audit User module of MOVEit Transfer. This module is responsible for managing and displaying audit logs for user activities. The flaw is an Incorrect Authorization (CWE-863) issue, meaning the application fails to properly verify that a user has the necessary permissions to access certain audit data.

Root Cause: The access control checks in the Audit User module do not adequately enforce role-based permissions. A low-privileged user (e.g., a standard user with limited audit rights) can bypass these checks and view audit logs that should be restricted to administrators or higher-privileged roles.

Attack Scenario:

1. An attacker obtains valid credentials for a low-privileged MOVEit Transfer account (e.g., via phishing, credential stuffing, or insider threat).
2. The attacker sends crafted HTTP requests to the Audit User module endpoints, manipulating parameters such as user IDs or audit scope.
3. Due to missing authorization checks, the server returns audit log data that the attacker should not have access to.
4. The attacker can then extract sensitive information from the logs, such as user activities, file transfers, or system events.

Impact: Unauthorized disclosure of audit logs can leak operational details, user behavior patterns, or potentially sensitive data (e.g., filenames, timestamps, IP addresses). This could aid further attacks or violate compliance requirements.

Vulnerable vs. Patched Code

Since the exact code is proprietary, the following is a conceptual comparison based on the vulnerability type.

Vulnerable Code (Conceptual):

// Vulnerable: No authorization check before returning audit data
public IActionResult GetAuditLogs(int userId)
{
    var logs = _auditService.GetLogsForUser(userId);
    return Ok(logs);
}

Patched Code (Conceptual):

// Patched: Authorization check added
public IActionResult GetAuditLogs(int userId)
{
    if (!User.IsInRole("Admin") && User.Id != userId)
    {
        return Forbid();
    }
    var logs = _auditService.GetLogsForUser(userId);
    return Ok(logs);
}

The patch ensures that only administrators or the user themselves can view their own audit logs, preventing unauthorized access to other users' data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid low-privileged credentials for MOVEit Transfer.
• Network access to the MOVEit Transfer web interface.

Exploitation Steps:

1. Authenticate to MOVEit Transfer with the low-privileged account.
2. Identify the Audit User module endpoint (e.g., /api/v1/audit/logs).
3. Manipulate request parameters to access other users' logs:

   GET /api/v1/audit/logs?userId=1 HTTP/1.1
   Host: target-moveit.com
   Cookie: session=lowprivsession
   

4. If the server returns logs for user ID 1 (an admin), the vulnerability is confirmed.
5. Extract sensitive information from the response.

No public exploit code is available.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual access patterns to audit endpoints by low-privileged users.
• Alert on requests to /api/v1/audit/logs with varying userId parameters from the same session.
• Correlate with failed authorization attempts (HTTP 403) followed by successful access.

Defense:

• Apply the vendor patch immediately.
• Implement strict role-based access control (RBAC) for audit modules.
• Enable logging of all access to audit endpoints and review regularly.
• Use Web Application Firewall (WAF) rules to block suspicious parameter manipulation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/v1/audit/logs with multiple userId values from a single session.
  • Unusual volume of audit log access by non-admin users.
• Log IOCs:
  • Audit log entries showing access to logs by unauthorized users.
  • Repeated 403 errors followed by 200 responses on audit endpoints.
• File IOCs:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_8800_Audit_User_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2026-8800 in MOVEit Transfer audit logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-8800"
    strings:
        $s1 = "/api/v1/audit/logs" ascii wide nocase
        $s2 = "userId=" ascii wide nocase
        $s3 = "GET" ascii wide nocase
    condition:
        all of ($s*) and #s1 > 5
}

Sigma Rule

title: CVE-2026-8800 MOVEit Transfer Audit User Authorization Bypass
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a7e4c
status: experimental
description: Detects attempts to exploit incorrect authorization in MOVEit Transfer Audit User module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains: "/api/v1/audit/logs"
        cs-method: "GET"
        cs-username|contains: "lowpriv"
    condition: selection
falsepositives:
    - Legitimate admin access to audit logs
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-8800 MOVEit Transfer Audit User Authorization Bypass";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/v1/audit/logs"; http_uri;
    content:"userId="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MOVEit Transfer to version 2025.0.7 or 2025.1.3 (or later).
2. If immediate patching is not possible, restrict access to the Audit User module to only trusted IP addresses or VPN.
3. Review and tighten RBAC policies for all users.

Long-term Measures:

• Implement regular security audits of access control mechanisms.
• Use a Web Application Firewall (WAF) to monitor and block suspicious requests.
• Enable detailed logging and alerting for authorization failures.
• Follow vendor security advisories for future updates.

Workarounds:

• Disable the Audit User module for low-privileged users if possible.
• Use network segmentation to limit exposure of the MOVEit Transfer interface.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert