Full Report
A critical vulnerability identified as CVE-2026-84115 affects Cleo Harmony versions through 5.8.1.10, with the weakness tied to the platform’s JWT Refresh Token Handler and the /api/connections endpoint. MITRE documented the issue on September 1, 2026, while VulDB classified it as a serious privilege-management vulnerability with a CVSS score of 8.3. CVE-2026-84115 Targets JWT Refresh Token Handler According to the vulnerability analysis, CVE-2026-84115 involves an unknown function within the JWT Refresh Token Handler component. The affected functionality processes requests sent to /api/connections, where manipulation of the Bearer argument in HTTP authorization headers can lead to improper privilege management. The weakness is classified as CWE-269, which refers to Improper Privilege Management. The flaw can allow an attacker to manipulate authentication-token arguments and potentially bypass intended access controls, gaining privileges beyond those assigned to the account. Remote Exploitation Raises CVE-2026-84115 Risk The vulnerability is remotely exploitable because the attack can be conducted through network-based HTTP requests without requiring local or physical access to the targeted system. The risk is heightened because a public exploit has reportedly been made available. An attacker exploiting CVE-2026-84115 could potentially obtain unauthorized administrative access, view sensitive information stored within Harmony, or interfere with integration workflows managed through the platform. Such activity could affect the confidentiality, integrity, and availability of systems that depend on Cleo Harmony for file transfer and API connectivity. The VulDB analysis links the exploitation method to authentication bypass through token manipulation. Attackers could potentially intercept legitimate traffic or create forged requests using malformed or replayed bearer tokens to circumvent JWT refresh-token controls. In environments where Cleo Harmony is connected to other systems, successful exploitation could also provide opportunities for further lateral movement. CVE-2026-84115 Remediation Requires an Upgrade Organizations using affected Cleo Harmony versions should upgrade to version 5.8.1.11 or later. The release contains the necessary correction for the privilege-management problem affecting the JWT Refresh Token Handler. Until patching is possible, organizations can strengthen input validation on API endpoints and monitor for unusual patterns involving bearer tokens. These measures may improve detection and reduce exposure, but they do not replace the recommended software upgrade, particularly given the reported public exploit. VulDB is listed as the responsible organization, with the vulnerability recorded under VDB-397558. Disclosure took place on September 1, 2026, and the entry has an accepted moderation status, with CPE marked as ready. CWE-269 is confirmed for the vulnerability. VulDB assigns CVE-2026-84115 a CVSS score of 8.3 and an EPSS score of 0.00284. The vulnerability record also identifies an exploit as available for download.
Analysis Summary
# Vulnerability: Cleo Harmony Privilege Escalation via JWT Refresh Token Handler
## CVE Details
- **CVE ID:** CVE-2026-84115
- **CVSS Score:** 8.3 (High)
- **CWE:** CWE-269 (Improper Privilege Management)
## Affected Systems
- **Products:** Cleo Harmony
- **Versions:** All versions through 5.8.1.10
- **Configurations:** Systems utilizing the JWT Refresh Token Handler and the `/api/connections` endpoint.
## Vulnerability Description
A flaw exists within the JWT Refresh Token Handler component of Cleo Harmony. The vulnerability is triggered by the improper processing of the `Bearer` argument in HTTP authorization headers sent to the `/api/connections` endpoint. By manipulating this argument, an attacker can bypass intended access controls and perform unauthorized privilege management. This allows the attacker to elevate their permissions beyond those originally assigned to their account.
## Exploitation
- **Status:** PoC available (Public exploit reported as available for download).
- **Complexity:** Not explicitly stated, but categorized as an authentication bypass via token manipulation.
- **Attack Vector:** Network (Remote exploitation via network-based HTTP requests).
## Impact
- **Confidentiality:** High (Unauthorized access to sensitive information stored within the platform).
- **Integrity:** High (Ability to interfere with integration workflows and manipulate authentication tokens).
- **Availability:** High (Potential to affect the availability of file transfer and API connectivity services).
- **Note:** Successful exploitation may also allow for lateral movement into connected internal systems.
## Remediation
### Patches
- **Upgrade to version 5.8.1.11** or later immediately to resolve the privilege management flaw.
### Workarounds
- **Input Validation:** Strengthen validation for all API endpoints, specifically focusing on HTTP authorization headers.
- **Token Monitoring:** Implement rigorous monitoring for unusual or malformed patterns involving bearer tokens and replayed refresh tokens.
- **Note:** These are temporary measures and do not fully mitigate the risk; patching remains the only definitive fix.
## Detection
- **Indicators of Compromise:** Unusual activity on the `/api/connections` endpoint; multiple failed or malformed JWT refresh attempts; unauthorized administrative-level changes.
- **Detection methods and tools:** Log analysis of HTTP Authorization headers and API traffic monitoring for token replay signatures.
## References
- **VulDB Entry:** [https://vuldb.com/?id.397558](https://vuldb.com/?id.397558)
- **Vendor Information:** Cleo Harmony Advisory (hXXps://thecyberexpress[.]com/cve-2026-84115-cleo-harmony-jwt-refresh-token/)