CVE-2025-26853 is a Critical (CVSS 10.0) broken authorization issue in DESCOR INFOCAD 3.5.1 and earlier. The record says version 3.5.2.0 fixes it. Upgrade to 3.5.2.0 or later and keep the application off the open internet until you have. Check the vendor changelog for details.
What's affected
Affected: DESCOR INFOCAD 3.5.1 and before. Fixed: 3.5.2.0, per the record and the vendor changelog entry named broken authorization schema.
The vendor page is brief, and the record says only that the product has a broken authorization schema. It does not list which functions are open to the wrong users, so you cannot narrow the exposure by feature. Assume all users and all network paths matter.
The same fixed version also covers a SQL injection, CVE-2025-26852. If you are planning one upgrade, plan for both.
How to check if you're exposed
Check the version in the application's system or about page, or ask the person who administers it. Anything at 3.5.1 or older is in scope.
Because the weakness is in authorization, the useful evidence is in your access logs. Look for requests from accounts or addresses that should not reach administrative or data functions, and for successful responses to those requests.
grep -i "infocad" /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head
That command lists the addresses making the most requests to paths containing the product name. Adjust the log path and field to your web server. It will not prove a problem, but an unexpected source address is worth a closer look.
Also confirm who can reach the application over the network. The CVSS vector shows no privileges and no user interaction are needed, so network reachability is the main control you have before patching.
What to do now
- Locate all INFOCAD instances and their versions.
- Upgrade 3.5.1 and older to 3.5.2.0 or later.
- Restrict access to the application by network rules or a VPN until the upgrade is done.
- Review user roles and remove accounts that are no longer needed.
- Examine access logs for use of administrative functions by unexpected users or addresses.
- Ask the vendor for any further guidance on checking whether data was reached.
Why it matters
The record lists CWE-862 (missing authorization) and CWE-863 (incorrect authorization). These weaknesses mean the application does not check, or checks wrongly, whether the caller is allowed to do what they ask. Authentication tells you who someone is, and authorization decides what they may do. Skipping the second step lets a normal user act as an administrator, or lets an anonymous caller act as a user.
The record scores all three impact areas high and the scope as changed, giving the maximum 10.0. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog. The record does not say the flaw has been used against anyone.
Authorization bugs are hard for scanners to find because the application responds normally. They tend to show up in design reviews and in testing with more than one account, which is a good reason to include role based tests in your own application checks.
Quick check
What is the difference from the SQL injection CVE?
CVE-2025-26852 is an injection flaw in database queries. This one is a failure to enforce who may do what. Both are fixed in 3.5.2.0 according to the record.
Is there a workaround?
The record gives none. Limiting network access to the application is a reasonable stopgap, and the upgrade is the fix.
Sources
Last reviewed: 19 October 2026.
