CVE-2026-120224 | Oray Pugongying X5 Pro up to 7.6.1 API Authorization run_apis_by_json/run_async_task improper authorization

A vulnerability was found in Oray Pugongying X5 Pro up to 7.6.1. It has been declared as very critical. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization.

This vulnerability is reported as CVE-2026-120224. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More