CVE-2026-94410
Customer&Partner: Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service
Bender Customer&Partner
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 5.17.5Customer&PartnerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.
Text from CVE List
Affected versions 1
- Customer&Partneraffected: 5.0.0 before 5.17.5CVE List