7.5High
CVE-2026-100115CAI Content Credentials | Improper Access Control (CWE-284)
Description
CAI Content Credentials is affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.
Weakness (CWE):
CWE-284
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| adobe | c2pa | < 0.91.1 | |
| Adobe | C2PA Tool | ≤ c2patool-v0.27.15, fixed v0.28.1 | |
| adobe | c2pa-web | < 0.15.3 | |
| adobe | c2patool | < 0.28.1 | |
| Adobe | Content Credentials JS SDK | ≤ @contentauth/c2pa-web@0.13.4, fixed @contentauth/c2pa-web@0.15.3 | |
| Adobe | Content Credentials Rust SDK | ≤ c2pa-v0.90.15, fixed c2pa-v0.91.1 |
References and patches
- https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-163.html vendor-advisoryVendor Advisory
CPE matches (NVD) (3)
cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*< 0.91.1cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*< 0.15.3cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*< 0.28.1