CVE-2026-34024: Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functions

Synopsis

Missing authorization checks in Wertheim SafeController Software (AssemblyVersion 6.15.8328.28014) allow an authenticated low-privileged user to reach restricted backend endpoints directly over the network. The affected endpoints bypass frontend access controls entirely, giving the attacker access to functions that should require elevated permissions. Successful exploitation lets an attacker read arbitrary files, upload arbitrary files, switch branch contexts, and view sensitive branch details without administrative rights. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SafeController web application over the network; the vulnerable endpoints are exposed via standard HTTP/S.

• AuthenticationRequired

  A valid account is required, but any low-privilege user account is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker calls the restricted endpoints directly.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; the attacker simply sends direct HTTP requests to undocumented but reachable endpoints with no race conditions or special environmental setup required.

Blast Radius

• Reads arbitrary files stored within the application's accessible file paths, including potentially sensitive configuration data and branch records.
• Downloads arbitrary files from the system, enabling exfiltration of documents or data tied to vault room and safe deposit locker operations.
• Uploads arbitrary files to the server, which may overwrite existing content or introduce malicious payloads into the application's file store.
• Switches branch context and views details of arbitrary branches, exposing organizational structure and operational data across all configured branches.