Skip to content
OpenAdvisories
Medium VDE-2026-109 1 CVE

Bender Customer&Partner Platform Vulnerability - Privilege Escalation

Published Oct 13, 2026 · Updated Oct 13, 2026

Vendor: Bender Product: Customer&Partner

Summary

Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform.
The issue allows any account to view the roles of other users.
Bender has analyzed the weakness and determined that user information and user credentials are not affected. Bender considers the weakness to be of medium risk which should be patched.

Details

Impact
The vulnerability allows a user to view a list of roles, which should be accessible by admin only. The application lacks to implemented an authorization check to view user role requests.

Remidiation
The service will be fixed in version 5.17.5 or later.
The fix is planned in Q4 2026.
There is no user activity necessary.

Vulnerabilities 1

  • Medium 4.3
    CVE-2026-94410

    Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service

    A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

    Bender Customer&Partner

Revision history

  1. #1.0.0

    initial version

References