Progress Telerik Report Server: Incorrect authorization in Web Report Designer
Summary
In Telerik Report Server before version 12.3.26.1110, the Web Report Designer does not correctly enforce authorization for shared report resources. An authenticated user with low privileges can perform unauthorized operations on shared reports, affecting their integrity and availability. The attacker needs a valid low-privilege account; the CVE record does not state whether internet access is required.
Affected
- Telerik Report Server versions prior to 12.3.26.1110 (Web Report Designer component)
Fixed in
- Fixed in version 12.3.26.1110 (per vendor advisory)
Workaround
- No vendor workaround for the vulnerability itself; upgrading is the recommended fix.
- After upgrading, a System Administrator can enable 'Deny shared write access to resources for users in non-administrative roles' under Configuration > Designer > Web Report Designer. It is disabled by default.
- The setting does not restrict writes to shared assets without a recorded creator, and enabling it does not assign creators retroactively.
Exploitation
- Unknown. The vendor advisory does not mention exploitation. Third-party trackers reported no known exploitation and no public proof-of-concept code at the time of research; this status is recent and should be re-checked.
Our recommendation
- Identify all Telerik Report Server instances and their versions.
- Upgrade all instances below 12.3.26.1110 to version 12.3.26.1110 or later.
- Review accounts with access to the Report Designer and remove unneeded accounts.
- Limit access to the Report Server management interface, especially if it is reachable from the internet.
- After upgrading, enable the shared write access restriction and check the CISA KEV catalog and the vendor advisory again.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik Report Server knowledge base: Incorrect Authorization (CVE-2026-106133) www.telerik.com
- CVE-2026-106133 tracker (threatint) cve.threatint.com
- CVE-2026-106133 tracker (OffSeq) radar.offseq.com
- SecurityWeek: Progress patches Telerik Report Server vulnerability www.securityweek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:27.
Original description (NVD)
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web Report Designer allows an authenticated attacker with low privileges to perform unauthorized operations on shared report resources, affecting their integrity and availability.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.