CVE-2026-28808
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated…
Technology
Erlang/OTP
CVSS Score
9.8 / 10.0
Affected Versions
>=17.0 <26.2.5.19; >=27.0 <27.3.4.10; >=28.0 <28.4.2
Upstream Fix
See upstream advisory
Published
April 7, 2026
OSSeva Coverage
Fixed upstream
Description
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect. This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and li
Is your Erlang/OTP deployment affected?
If you're running >=17.0 <26.2.5.19; >=27.0 <27.3.4.10; >=28.0 <28.4.2, you need this patch. Book a discovery call to get covered.