CVE-2024-6426 is a high severity (CVSS 8.1) information exposure flaw in MESbook version 20221021.03. A user with ordinary privileges can reach resources they should not see by changing an API value in the application. The record names no fixed release, so check the INCIBE notice for vendor guidance.
What's affected
The record lists one product and one build: MESbook 20221021.03. No other versions are named, and no fixed version is given in the NVD data.
The weakness is CWE-200, exposure of sensitive information to an unauthorized actor. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. That means network reachable, low complexity, a low privilege account needed, no user interaction, with high impact on confidentiality and integrity and none on availability.
The description says "local attacker, with user privileges", while the vector says the attack vector is network. Both come from the same record. In practice it means the person needs a valid login, and then reaches the API over the network. The record is not in KEV, and nothing I could confirm says it is exploited in the wild.
How to check if you're exposed
MESbook is a vendor application, so there is no package manager command that answers this.
- Find out whether you run MESbook and which build. The record covers 20221021.03 only.
- Ask your vendor or integrator whether a later build addresses CVE-2024-6426.
- Read the INCIBE notice titled "Multiple vulnerabilities in MESbook". The same notice covers a second CVE in this build, CVE-2024-6427, so treat the two together.
- Review who holds accounts. The flaw needs a logged-in user, so every account on the system is part of the exposure.
What to do now
- Confirm the version in production and note any copies in test or staging.
- Contact the vendor for a patched build and a date. Do not assume one exists because the CVE is public.
- Restrict network access to the application to the plants, offices or VPN ranges that need it.
- Remove unused accounts and review role assignments, since the attacker model starts with a low privilege user.
- Turn on access logging for the API and look for one account requesting many different resource identifiers.
- Record the decision in your risk register with an owner and a review date.
Why it matters
Operational applications tend to hold orders, records and process data. Reading data that belongs to someone else is a confidentiality problem, and the vector also scores high integrity impact, so the advisory treats it as more than a read.
The class of bug is an authorization check that trusts a value the client controls. If the server accepts whatever identifier the caller supplies without asking whether that caller may use it, changing the value changes the data returned. Fixes usually mean enforcing the check on the server for every request, not hiding the value in the interface.
Quick check
Do I need an attacker on the same machine?
The record says "local attacker", but the vector marks the attack as network reachable. What it clearly requires is a valid user account. Check the INCIBE notice for the vendor's wording.
Is a fixed version published?
The NVD record does not name one. Check the INCIBE notice and ask the vendor before you assume a patch exists.
Sources
- NVD record for CVE-2024-6426
- INCIBE notice: multiple vulnerabilities in MESbook (the page did not load when this post was prepared, so details here come from the NVD record)
Last reviewed: 19 October 2026.
