The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all other protected directories on the same server instance. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 3
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Erlang Erlang\/Otp
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
|
— |
27.3.4.17
|
|
Erlang Erlang\/Otp
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
|
28.0
|
28.5.0.6
|
|
Erlang Erlang\/Otp
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
|
29.0
|
29.0.6
|
References 6
https://github.com/erlang/otp/security/advisories/GHSA-c3cq-q8x6-547g
NVD
https://cna.erlef.org/cves/CVE-2026-74994.html
NVD
https://osv.dev/vulnerability/EEF-CVE-2026-74994
NVD
https://github.com/erlang/otp/commit/6982e381137ede21a4e1faf5fa2dd82321691176
NVD
https://github.com/erlang/otp/commit/c5ccec8ed25c70ec6557fd81277e4b2f52285c19
NVD
https://github.com/erlang/otp/commit/6101cb74ff2870718c622ba7af0c100f7f2524e3
NVD