CVE-2026-6499 - Vulnerability Details - OpenCVE

Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto: 1.7.5.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ilm Informatique	Openconcerto

No data.

No data.

References

Link	Providers
https://www.spirityenterprise.com/pentest
https://www.spirityenterprise.com/managed-detection-response
https://www.openconcerto.org/fr/version-1.7.html

History

Mon, 04 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title		Incorrect Permission Assignment Allows Replacement of Critical Binaries in OpenConcerto
First Time appeared		Ilm Informatique Ilm Informatique openconcerto
Vendors & Products		Ilm Informatique Ilm Informatique openconcerto

Mon, 04 May 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 04 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto: 1.7.5.
Weaknesses		CWE-732
References		https://www.openconcerto.org/fr/version-1.7.html
Metrics		cvssV4_0 `{'score': 2.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: TCS-CERT

Published: 2026-05-04T14:08:03.764Z

Updated: 2026-05-04T14:43:54.994Z

Reserved: 2026-04-17T09:33:56.258Z

Link: CVE-2026-6499

Vulnrichment

Updated: 2026-05-04T14:43:51.725Z

NVD

Status : Received

Published: 2026-05-04T14:16:36.133

Modified: 2026-05-04T14:16:36.133

Link: CVE-2026-6499

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6499", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "state": "PUBLISHED", "assignerShortName": "TCS-CERT", "dateReserved": "2026-04-17T09:33:56.258Z", "datePublished": "2026-05-04T14:08:03.764Z", "dateUpdated": "2026-05-04T14:43:54.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-05-04T14:08:03.764Z"}, "datePublic": "2026-05-04T13:58:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-642", "descriptions": [{"lang": "en", "value": "CAPEC-642 Replace Binaries"}]}], "affected": [{"vendor": "ILM Informatique", "product": "OpenConcerto", "versions": [{"status": "affected", "version": "1.7.5"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries.\n\nThis issue affects OpenConcerto: 1.7.5.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries.<p>This issue affects OpenConcerto: 1.7.5.</p>"}]}], "references": [{"url": "https://www.openconcerto.org/fr/version-1.7.html", "tags": ["product"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Dominique Righetto", "type": "finder"}], "source": {"discovery": "USER"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-04T14:43:47.315987Z", "id": "CVE-2026-6499", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T14:43:54.994Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-04T14:43:47.315987Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-04T14:43:51.725Z"}}], "cna": {"source": {"discovery": "USER"}, "credits": [{"lang": "en", "type": "finder", "value": "Dominique Righetto"}], "impacts": [{"capecId": "CAPEC-642", "descriptions": [{"lang": "en", "value": "CAPEC-642 Replace Binaries"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ILM Informatique", "product": "OpenConcerto", "versions": [{"status": "affected", "version": "1.7.5"}], "defaultStatus": "unknown"}], "datePublic": "2026-05-04T13:58:00.000Z", "references": [{"url": "https://www.openconcerto.org/fr/version-1.7.html", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries.\n\nThis issue affects OpenConcerto: 1.7.5.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries.<p>This issue affects OpenConcerto: 1.7.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "shortName": "TCS-CERT", "dateUpdated": "2026-05-04T14:08:03.764Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6499", "state": "PUBLISHED", "dateUpdated": "2026-05-04T14:43:54.994Z", "dateReserved": "2026-04-17T09:33:56.258Z", "assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795", "datePublished": "2026-05-04T14:08:03.764Z", "assignerShortName": "TCS-CERT"}, "dataVersion": "5.2"}