CVE-2026-86934
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Pu…
Published: 2026-09-23 · CVSS: 9.1 · CVSS 3.1
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7