Improper Access Control in ManageEngine SharePoint Manager Plus MFA
CVE-2026-119682

7.9HIGH

Key Information:

Vendor

Manageengine
Status
Sharepoint Manager Plus
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119682?

An improper access control vulnerability in the multi-factor authentication (MFA) system of ManageEngine SharePoint Manager Plus allows low-privileged users to bypass critical authorization checks. This can enable unauthorized users to modify MFA configuration settings, disable MFA, view enrolled users, and delete accounts. Exploitation may result in weakened authentication protocols or a denial of service, risking legitimate user access to the application. The issue was resolved in version 4507, following successful reproduction in version 4506.

Affected Version(s)

SharePoint Manager Plus 450 < 4507

References

https://pitstop.manageengine.com/portal/en/community/topi...
release-notes

CVSS V4

Score:
7.9
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Anas LAABAB with IMRIM (https://imrim.lu)
.