GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0325

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
Title
Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect
Summary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ General information ═══════════════════ Multiple vulnerabilities in Sparx Pro Cloud Server (PCS) versions <= 6.1 and Sparx Enterprise Architect versions <=17.1 allow a remote unauthenticated attacker to execute arbitrary sql queries (both read and write) within any configured database. In case where PCS is installed with WebEA the vulnerabilities allow further for remote unauthenticated code execution (RCE) within the web server context. CVSSv4 chained score: *10.0 Critical* (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) Fix ═══ Currently vendor *did not resolve* any of the CVEs. The PCS authentication bypass and race condition seem to be easy to implement and I hope vendor will release patches soon. As a workaround it is best to isolate the PCS instances from internet and untrusted networks. Create frequent backups and review access logs if possible. You could also setup a proxy to limit the PCS authentication bypass (dropping requests with no or wrong model query parameter. [Vulnerabilitiy #1] Sparx Pro Cloud Server SQL Command Execution ════════════════════════════════════════════════════════════════ CVE ─── CVE-2026-42096 - Broken Access Control in Sparx Pro Cloud Server Affected versions ───────────────── Sparx Pro Cloud Server versions <= 6.1 build 167 CVSSv4 ────── 9.4 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) Impact ────── PCS works as a remote model for a thick client, running on user's computers, called Enterprise Architect (EA). EA connects to PCS and works with the exposed database by directly running SQL queries. Besides user authentication (which is also vulnerable - see vulnerability #2 below) there is no additional access control. Any low privileged user can actually run any sql queries permitted by the configured external database user. Usually the user configured is at least having full access to the model database - thus any low privileged user can actually destroy the whole model, retrieve and change other user's password hashes and more. The problem seems to be with legacy thick client EA architecture which simply works on a database to manage all the model details. Details ─────── The client (EA) is connecting to the PCS HTTP server. The server might require authentication *if it is properly configured* - an admin can check "Enable Security" in EA but still not select "Require a secure and authenticated connection" in PCS configuration what results in *NO SERVER SIDE authentication at all*. Assuming the server side authentication is required the PCS verifies the authentication according to configuration - e.g. login/password, Active Directory or OpenID. Then the EA client sends request to perform SQL queries on the database in an ecrypted form but the whole encryption scheme is built into the client EA binary (actually downloadable from the vendor webside without any authentication - as trial version). The encryption is symmetric using a key contained within the binary itself thus simply this is not any security measure (security by obscurity). An attacker can obtain the key and then *create and send custom SQL queries to be performed by the database*. PoC ─── Exploit: https://github.com/br0xpl/sparx_hack/blob/main/eacrypt.py is a python script which exploits the SQL vulnerability by encrypting any SQL command and sending it to the server. For security, the real key is removed from the exploit code. This script receives all users and their hashes from PCS: ┌──── │ python3 eacrypt.py http://${PCS_HOSTNAME} model "select * from t_secuser, t_xref where t_xref.Type='User Setting' and t_xref.Name ='SHA-256' and t_xref.Client=t_secuser.UserID" └──── Solution ──────── It will be hard to introduce proper authorization for all types of SQL queries - this would require to rewrite the logic to use some higher abstraction API which can be properly authorized. Until a proper authorized API will be provided a quick solution could be at least to verify the SQL queries executed and block the most dangerous like asking about other users' passwords and so on. Maybe a query whitelist with limiting the view of some critical assets like hashes. For sure it should be transparently stated in the PCS and EA documentation web page. Some integrators and admins are aware of this risk (there are some topics on the forum mentioning that the model security is not in fact security) but this *should be well described in both product documentations* as a limitation and risk which needs to be understood by clients and taken into consideration at an early stage while designing a production system. Otherwise it poses a high risk for any company using those products. [Vulnerability #2] Sparx Pro Cloud Server Authentication Bypass ═══════════════════════════════════════════════════════════════ CVE ─── CVE-2026-42097 - Authentication Bypass in Sparx Pro Cloud Server Affected versions ───────────────── Sparx Pro Cloud Server versions <= 6.1 build 167 CVSSv4 ────── 9.2 Critical (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) Impact ────── An attacker can *omit PCS authentication* and e.g. combined with the previous vulnerability be able to remotely execute arbitrary SQL commands (read and write) *without authentication*. Details ─────── It seems that PCS requires authentication based on requested URL. EA clients sending the encrypted SQL query to PCS are using an url which looks as follows: ┌──── │ https://${PCS_SERVER_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME} └──── PCS seems to look at the URL and decides how to authenticate the request. Unfortunately the SQL command query sends a POST request with a binary blob where the model name is defined one more time and this is the value that is further used by PCS to execute the query. Thus an attacker can simply omit the model query parameter and send the model name only in the binary blob in both TLS and non-TLS ports and the query will be executed even thought there was no authentication. PoC ─── To quickly verify compare the authenticated response for a request: ┌──── │ curl 'https://${PCS_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}' -X POST -vvv --data 'whatever' -k └──── which responds 401 Access Denied to response of a request without the query param: ┌──── │ curl 'https://${PCS_HOSTNAME}/SparxCloudLink.sseap' -X POST -vvv --data 'whatever' -k └──── which responds 500 Internal Server Error. To proof this properly use the python code which exploits the #1 SQL vulnerability and uses the URL without model query parameter to omit the authentication. Solution ──────── Make a single parameter pointing the model (either in the blob or in query param) and hook authentication and query logic on the same parameter. [Vulnerability #3] Sparx Enterprise Architect Authorization Bypass ══════════════════════════════════════════════════════════════════ CVE ─── CVE-2026-42098 - Authorization Bypass in Sparx Enterprise Architect Affected versions ───────────────── Sparx Enterprise Architect versions <= 17.1 CVSSv4 ────── 7.7 High (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) Impact ────── Sparx Enterprise Architect software has a security feature which can be enabled. When enabled the users can be limited to perform only some actions by roles but this is not a real security measure as it can be easily bypassed. *Any authenticated user can actually perform any action on the model* including deletion, stealing of other users' passwords and many others. This *includes configurations with Pro Cloud Server* where vendor advertises that PCS brings high level of security for the model: Robust security features are designed to protect sensitive model information, *including role-based access control*, encryption, authentication mechanisms and audit trails. source: <https://www.sparxsystems.eu/pro-cloud-server/> Details ─────── This vulnerability, most probably, is a result of the legacy thick client architecture described in the vulnerability #1. The EA documentation states briefly that the security is not a real security: The Security system in Enterprise Architect is designed to facilitate collaboration, *not as a barrier to incursion*. source: <https://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html> but right below it suggests that model assets should be secured: The information contained in the Repository is a valuable organizational asset that needs to be maintained and secured as such. The asset must be protected from both *intentional* and inadvertent compromises of content. The Security system allows update functions to be restricted to a set of users or groups with the appropriate defined permission. Packages, elements and diagrams can be locked by users, preventing others from updating them. source: <https://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html> Unfortunately the current design is not protecting against intentional compromises of content. An attacker can modify the EA client behavior (e.g. using a debugger) to login in as any other user or administrator - then it is possible to do every possible change to the repository. PoC ─── To show how it works it is enough to patch the binary to change the logic and accept all incorrect passwords and reject correct ones. For the file version 17.1.0.1714 of EA.exe (md5sum: 69dfe7b98d1fc156d15d8aeff726cfce) the following would patch the logic: ┌──── │ printf '\x84' | dd of=EA.exe bs=1 seek=$((0x34657B2)) conv=notrunc └──── Then run the patched exe and try to login to local model with different password. It also works obviously for cloud models which do not require server HTTP authentication or when using the "Login as different user option". Solution ──────── The way security works for EA should be properly and transparently presented in the EA documentation and installation notes. The sentence quoted above is not enough and can be easily misinterpreted by many users leading to vulnerabilities. Also it should be explained that even when using PCS after authentication there is no authorization until visibility levels are enabled which are working per whole database manager not user - so in fact there is no user based RBAC but rather database manager RBAC what is much more coarse grained then per user roles access control. In terms of combination of EA and PCS it is possible to secure the design by e.g. following the recommendations proposed in vulnerability #1. [Vulnerability #4] Sparx Pro Cloud Server WebEA Remote Code Execution ═════════════════════════════════════════════════════════════════════ CVE ─── CVE-2026-42099 - Race Condition in Sparx Pro Cloud Server Affected versions ───────────────── Sparx Pro Cloud Server versions <= 6.1 build 167 CVSSv4 ────── 9.0 Critical (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) Impact ────── PCS configured with WebEA PHP application allows for remote command execution using the /data_api/dl_internal_artifact.php endpoint. This URL is used by WebEA to download content of a internal artifact. A remote attacker having access to the PCS repository is able to inject a malicious php file into the
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
unknown unknown Affected: unknown
guessed Create a notification for this product.
Credits
Adamczyk Blazej
Relationships
analysis GCVE-1988-2026-0325 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adamczyk Blazej"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\nMultiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\nGeneral information\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\n  Multiple vulnerabilities in Sparx Pro Cloud Server (PCS) versions \u003c=\n  6.1 and Sparx Enterprise Architect versions \u003c=17.1 allow a remote\n  unauthenticated attacker to execute arbitrary sql queries (both read\n  and write) within any configured database. In case where PCS is\n  installed with WebEA the vulnerabilities allow further for remote\n  unauthenticated code execution (RCE) within the web server context.\n\n  CVSSv4 chained score: *10.0 Critical*\n  (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nFix\n\u2550\u2550\u2550\n\n  Currently vendor *did not resolve* any of the CVEs. The PCS\n  authentication bypass and race condition seem to be easy to implement\n  and I hope vendor will release patches soon.\n\n  As a workaround it is best to isolate the PCS instances from internet\n  and untrusted networks. Create frequent backups and review access logs\n  if possible. You could also setup a proxy to limit the PCS\n  authentication bypass (dropping requests with no or wrong model query\n  parameter.\n\n\n[Vulnerabilitiy #1] Sparx Pro Cloud Server SQL Command Execution\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42096 - Broken Access Control in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.4 Critical\n  (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  PCS works as a remote model for a thick client, running on user\u0027s\n  computers, called Enterprise Architect (EA). EA connects to PCS and\n  works with the exposed database by directly running SQL queries.\n  Besides user authentication (which is also vulnerable - see\n  vulnerability #2 below) there is no additional access control. Any low\n  privileged user can actually run any sql queries permitted by the\n  configured external database user. Usually the user configured is at\n  least having full access to the model database - thus any low\n  privileged user can actually destroy the whole model, retrieve and\n  change other user\u0027s password hashes and more.\n\n  The problem seems to be with legacy thick client EA architecture which\n  simply works on a database to manage all the model details.\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  The client (EA) is connecting to the PCS HTTP server. The server might\n  require authentication *if it is properly configured* - an admin can\n  check \"Enable Security\" in EA but still not select \"Require a secure\n  and authenticated connection\" in PCS configuration what results in *NO\n  SERVER SIDE authentication at all*.\n\n  Assuming the server side authentication is required the PCS verifies\n  the authentication according to configuration - e.g. login/password,\n  Active Directory or OpenID.\n\n  Then the EA client sends request to perform SQL queries on the\n  database in an ecrypted form but the whole encryption scheme is built\n  into the client EA binary (actually downloadable from the vendor\n  webside without any authentication - as trial version). The encryption\n  is symmetric using a key contained within the binary itself thus\n  simply this is not any security measure (security by obscurity).\n\n  An attacker can obtain the key and then *create and send custom SQL\n  queries to be performed by the database*.\n\n\nPoC\n\u2500\u2500\u2500\n\n  Exploit: https://github.com/br0xpl/sparx_hack/blob/main/eacrypt.py\n  is a python script which exploits the SQL vulnerability by encrypting\n  any SQL command and sending it to the server. For security,\n  the real key is removed from the exploit code.\n\n  This script receives all users and their hashes from PCS:\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 python3 eacrypt.py http://${PCS_HOSTNAME} model \"select * from t_secuser, t_xref where t_xref.Type=\u0027User Setting\u0027 \nand t_xref.Name =\u0027SHA-256\u0027 and t_xref.Client=t_secuser.UserID\"\n  \u2514\u2500\u2500\u2500\u2500\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  It will be hard to introduce proper authorization for all types of SQL\n  queries - this would require to rewrite the logic to use some higher\n  abstraction API which can be properly authorized.\n\n  Until a proper authorized API will be provided a quick solution could\n  be at least to verify the SQL queries executed and block the most\n  dangerous like asking about other users\u0027 passwords and so on. Maybe a\n  query whitelist with limiting the view of some critical assets like\n  hashes.\n\n  For sure it should be transparently stated in the PCS and EA\n  documentation web page. Some integrators and admins are aware of this\n  risk (there are some topics on the forum mentioning that the model\n  security is not in fact security) but this *should be well described\n  in both product documentations* as a limitation and risk which needs\n  to be understood by clients and taken into consideration at an early\n  stage while designing a production system. Otherwise it poses a high\n  risk for any company using those products.\n\n\n[Vulnerability #2] Sparx Pro Cloud Server Authentication Bypass\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42097 - Authentication Bypass in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.2 Critical\n  (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  An attacker can *omit PCS authentication* and e.g. combined with the\n  previous vulnerability be able to remotely execute arbitrary SQL\n  commands (read and write) *without authentication*.\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  It seems that PCS requires authentication based on requested URL. EA\n  clients sending the encrypted SQL query to PCS are using an url which\n  looks as follows:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 https://${PCS_SERVER_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\n  \u2514\u2500\u2500\u2500\u2500\n\n  PCS seems to look at the URL and decides how to authenticate the\n  request. Unfortunately the SQL command query sends a POST request with\n  a binary blob where the model name is defined one more time and this\n  is the value that is further used by PCS to execute the query.\n\n  Thus an attacker can simply omit the model query parameter and send\n  the model name only in the binary blob in both TLS and non-TLS ports\n  and the query will be executed even thought there was no\n  authentication.\n\n\nPoC\n\u2500\u2500\u2500\n\n  To quickly verify compare the authenticated response for a request:\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 curl \u0027https://${PCS_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\u0026apos; -X POST  -vvv --data \u0027whatever\u0027 -k\n  \u2514\u2500\u2500\u2500\u2500\n\n  which responds 401 Access Denied to response of a request without the\n  query param:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 curl \u0027https://${PCS_HOSTNAME}/SparxCloudLink.sseap\u0026apos; -X POST  -vvv --data \u0027whatever\u0027 -k\n  \u2514\u2500\u2500\u2500\u2500\n\n  which responds 500 Internal Server Error.\n\n  To proof this properly use the python code which exploits the #1\n  SQL vulnerability and uses the URL without model query parameter to\n  omit the authentication.\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Make a single parameter pointing the model (either in the blob or in\n  query param) and hook authentication and query logic on the same\n  parameter.\n\n\n[Vulnerability #3] Sparx Enterprise Architect Authorization Bypass\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42098 - Authorization Bypass in Sparx Enterprise Architect\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Enterprise Architect versions \u003c= 17.1\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  7.7 High\n  (CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Enterprise Architect software has a security feature which can\n  be enabled. When enabled the users can be limited to perform only some\n  actions by roles but this is not a real security measure as it can be\n  easily bypassed.\n\n  *Any authenticated user can actually perform any action on the model*\n  including deletion, stealing of other users\u0027 passwords and many\n  others. This *includes configurations with Pro Cloud Server* where\n  vendor advertises that PCS brings high level of security for the\n  model:\n\n        Robust security features are designed to protect sensitive\n        model information, *including role-based access control*,\n        encryption, authentication mechanisms and audit trails.\n\n        source: \u003chttps://www.sparxsystems.eu/pro-cloud-server/\u003e\n\n\nDetails\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  This vulnerability, most probably, is a result of the legacy thick\n  client architecture described in the vulnerability #1.\n\n  The EA documentation states briefly that the security is not a real\n  security:\n\n        The Security system in Enterprise Architect is designed to\n        facilitate collaboration, *not as a barrier to incursion*.\n\n        source:\n        \u003chttps://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html\u003e\n\n  but right below it suggests that model assets should be secured:\n\n        The information contained in the Repository is a valuable\n        organizational asset that needs to be maintained and\n        secured as such. The asset must be protected from both\n        *intentional* and inadvertent compromises of content. The\n        Security system allows update functions to be restricted\n        to a set of users or groups with the appropriate defined\n        permission. Packages, elements and diagrams can be locked\n        by users, preventing others from updating them.\n\n        source:\n        \u003chttps://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html\u003e\n\n  Unfortunately the current design is not protecting against intentional\n  compromises of content. An attacker can modify the EA client behavior\n  (e.g. using a debugger) to login in as any other user or administrator\n  - then it is possible to do every possible change to the repository.\n\n\nPoC\n\u2500\u2500\u2500\n\n  To show how it works it is enough to patch the binary to change the\n  logic and accept all incorrect passwords and reject correct ones. For\n  the file version 17.1.0.1714 of EA.exe (md5sum:\n  69dfe7b98d1fc156d15d8aeff726cfce) the following would patch the logic:\n\n  \u250c\u2500\u2500\u2500\u2500\n  \u2502 printf \u0027\\x84\u0027 | dd of=EA.exe bs=1 seek=$((0x34657B2)) conv=notrunc\n  \u2514\u2500\u2500\u2500\u2500\n\n  Then run the patched exe and try to login to local model with\n  different password. It also works obviously for cloud models which do\n  not require server HTTP authentication or when using the \"Login as\n  different user option\".\n\n\nSolution\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  The way security works for EA should be properly and transparently\n  presented in the EA documentation and installation notes. The sentence\n  quoted above is not enough and can be easily misinterpreted by many\n  users leading to vulnerabilities.\n\n  Also it should be explained that even when using PCS after\n  authentication there is no authorization until visibility levels are\n  enabled which are working per whole database manager not user - so in\n  fact there is no user based RBAC but rather database manager RBAC what\n  is much more coarse grained then per user roles access control.\n\n  In terms of combination of EA and PCS it is possible to secure the\n  design by e.g. following the recommendations proposed in vulnerability\n  #1.\n\n\n[Vulnerability #4] Sparx Pro Cloud Server WebEA Remote Code Execution\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nCVE\n\u2500\u2500\u2500\n\n  CVE-2026-42099 - Race Condition in Sparx Pro Cloud Server\n\n\nAffected versions\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Sparx Pro Cloud Server versions \u003c= 6.1 build 167\n\n\nCVSSv4\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  9.0 Critical\n  (CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\n\nImpact\n\u2500\u2500\u2500\u2500\u2500\u2500\n\n  PCS configured with WebEA PHP application allows for remote command\n  execution using the /data_api/dl_internal_artifact.php endpoint. This\n  URL is used by WebEA to download content of a internal artifact. A\n  remote attacker having access to the PCS repository is able to inject\n  a malicious php file into the "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/17"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/May/17"
        },
        {
          "url": "http://${PCS_HOSTNAME}"
        },
        {
          "url": "https://${PCS_HOSTNAME}"
        },
        {
          "url": "https://${PCS_HOSTNAME}/SparxCloudLink.sseap\u0026apos"
        },
        {
          "url": "https://${PCS_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}\u0026apos"
        },
        {
          "url": "https://${PCS_SERVER_HOSTNAME}/SparxCloudLink.sseap?model=${MODEL_NAME}"
        },
        {
          "url": "https://${WEBEA_HOSTNAME}/data_api/dl_internal_artifact.php?guid=el_%7B8889BA10-6178-4047-9273-37FC75B0FCF6%7D\u0026modelno=1"
        },
        {
          "url": "https://${WEBEA_HOSTNAME}/data_api/poc.php\u0026apos"
        },
        {
          "url": "https://cert.pl/en/posts/2026/05/CVE-2026-42096"
        },
        {
          "url": "https://efigo.pl/"
        },
        {
          "url": "https://efigo.pl/blog/CVE-2026-42096/"
        },
        {
          "url": "https://github.com/br0xpl/sparx_hack/blob/main/eacrypt.py"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://sparxsystems.com/enterprise_architect_user_guide/17.1/guide_books/tools_ba_security.html"
        },
        {
          "url": "https://sparxsystems.com/products/procloudserver/"
        },
        {
          "url": "https://sploit.tech/"
        },
        {
          "url": "https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html"
        },
        {
          "url": "https://www.sparxsystems.eu/pro-cloud-server/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/May/17"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Multiple vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-42096",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42097",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42098",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42099",
              "type": "related"
            },
            {
              "destId": "CVE-2026-42100",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0325",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/May/17",
            "automated": true,
            "contentSha256": "8bd63f8c1c70a7cdfab79e36a3fa66314cc885eb1505bb552387c93421cb47a1",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/May/17",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-05-22T10:47:33Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0325"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:54Z",
    "dateUpdated": "2026-09-11T07:55:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0325"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.