SZB-3a51993dba
EUVD-2026-114085 reports MFA access control flaw in ManageEngine SharePoint Manager Plus
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- ManageEngine
- Product
- SharePoint Manager Plus
- First seen
Summary
The EUVD advisory states that ManageEngine SharePoint Manager Plus has an improper access control vulnerability in its multi-factor authentication functionality. According to the item, a low-privileged authenticated user can bypass authorization checks to read and modify data; the item is truncated.
If you use ManageEngine
Apply the vendor's security update for SharePoint Manager Plus
Audit accounts with low privileges for unexpected access
Restrict network access to the SharePoint Manager Plus console
What the sources say 1
· Mastodon: “An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP).” Source