High · 7.7 CVE-2026-57920 EUVD-2026-39651GHSA-69xh-mqwf-cxv2

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} e…

Published Jun 26, 2026 · Updated Jun 26, 2026 · Assigned by mitre

Description

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

Vendor	Product	Affected	Fixed
Peplink	InControl	< 2026-06-03	2026-06-03