Incorrect Authorization in Telerik Report Server Web Report Designer (CVE-2026-106133)
Description
October 2026 - CVE-2026-106133
- Progress® Telerik® Report Server Web Report Designer, versions
>= 0and< 12.3.26.1110.
What Are the Impacts
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated user with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.
Issue
- CWE-863: Incorrect Authorization
- CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
Solution
The issue is fixed in version 12.3.26.1110. The Progress Telerik team strongly recommends upgrading to this version or later.
| Current Version | Update to |
|---|---|
>= 0 and < 12.3.26.1110 | >= 12.3.26.1110 |
After upgrading, sign in as a System Administrator and enable Deny shared write access to resources for users in non-administrative roles under Configuration > Designer > Web Report Designer. Select Save Changes to apply the restriction. It is disabled by default, so upgrading alone does not enable it. See Designer settings for the complete access rules.
Existing shared assets without a recorded creator remain writable under the existing access rules even when this setting is enabled. Neither upgrading nor enabling the setting assigns creators retroactively, so these steps do not restrict writes to those assets.
Follow the Report Server upgrade instructions for precise instructions. All customers who have a license for Progress® Telerik® Report Server can access their downloads here: Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- Progress would like to thank Noam Frenkel for responsibly reporting this issue.
External References
CVE-2026-106133 (Medium)
CVSS: 6.3
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated user with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.