{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination"
      },
      {
        "names": [
          "Noah Willams"
        ],
        "organization": "Bulwarkers Websecurity Pvt. Ltd.",
        "summary": "reporting"
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Medium"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "Bender is publishing this advisory to inform customers about a security vulnerability in the Customer&Partner platform. \nThe issue allows any account to view the roles of other users.\nBender has analyzed the weakness and determined that user information and user credentials  are not affected. Bender considers the weakness to be of medium risk which should be patched.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The vulnerability allows a user to view a list of roles, which should be accessible by admin only. The application lacks to implemented an authorization check to view user role requests.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "The service will be fixed in version 5.17.5 or later. \nThe fix is planned in Q4 2026.\nThere is no user activity necessary.",
        "title": "Remidiation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@bender.de",
      "name": "Bender GmbH & Co. KG",
      "namespace": "https://www.bender.de"
    },
    "references": [
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Bender GmbH & Co. KG",
        "url": "https://certvde.com/en/advisories/vendor/bender/"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.bender.de"
      },
      {
        "category": "self",
        "summary": "VDE-2026-109: Bender Customer&Partner Platform Vulnerability - Privilege Escalation - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2026-109/"
      },
      {
        "category": "self",
        "summary": "VDE-2026-109: Bender Customer&Partner Platform Vulnerability - Privilege Escalation - CSAF",
        "url": "https://bender.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-109.json"
      }
    ],
    "title": "Bender Customer&Partner Platform Vulnerability - Privilege Escalation",
    "tracking": {
      "aliases": [
        "VDE-2026-109"
      ],
      "current_release_date": "2026-10-13T14:00:00.000Z",
      "generator": {
        "date": "2026-10-08T10:12:06.471Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.13"
        }
      },
      "id": "VDE-2026-109",
      "initial_release_date": "2026-10-13T14:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-13T14:00:00.000Z",
          "number": "1.0.0",
          "summary": "initial version"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=5.0.0|<5.17.5",
                    "product": {
                      "name": "Customer&Partner 5.0.0<5.17.5",
                      "product_id": "CSAFPID-0002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:bender:customer_platform_software:*:*:*:*:*:*:*:*"
                      }
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "5.17.5",
                    "product": {
                      "name": "Customer&Partner 5.17.5",
                      "product_id": "CSAFPID-0003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:a:bender:customer_platform_software:5.17.5:*:*:*:*:*:*:*"
                      }
                    }
                  }
                ],
                "category": "product_name",
                "name": "Customer&Partner"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Bender"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-94410",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-18T11:40:00.000Z",
      "notes": [
        {
          "category": "description",
          "text": "A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0003"
        ],
        "known_affected": [
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - 5.3 - Medium",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "release_date": "2026-09-22T10:00:00.000Z",
      "remediations": [
        {
          "category": "none_available",
          "details": "Bender service updated to version  5.17.5 or later.\nThe fix is planned in Q4 2026.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalScore": 4.3,
            "environmentalSeverity": "MEDIUM",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 4.3,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service"
    }
  ]
}