CVE-2026-2669 in Visual Integrated Command and Dispatch Platform
Summary
by MITRE • 02/19/2026
A vulnerability was determined in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260206. This impacts an unknown function of the file /dm/dispatch/user/delete of the component User Handler. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/27/2026
The vulnerability identified as CVE-2026-2669 resides within the Rongzhitong Visual Integrated Command and Dispatch Platform, a system designed for emergency response and operational coordination. This platform serves critical infrastructure functions where unauthorized access could severely compromise public safety and operational integrity. The affected component specifically involves the User Handler functionality located at the /dm/dispatch/user/delete endpoint, indicating this represents a core administrative capability for user management within the system. The vulnerability manifests through improper access control mechanisms that fail to properly validate user authorization before executing deletion operations, creating a significant security gap in the platform's privilege management framework.
The technical flaw stems from inadequate input validation within the ID argument processing of the user deletion function. When an attacker supplies a manipulated ID parameter to the delete endpoint, the system fails to properly authenticate or authorize the request, allowing unauthorized users to potentially delete accounts belonging to other users. This represents a classic access control vulnerability where the system does not properly enforce mandatory access controls or role-based permissions. The vulnerability aligns with CWE-285, which describes improper authorization in software systems, and specifically demonstrates weaknesses in the authorization enforcement mechanisms that should prevent unauthorized operations. The flaw exists at the application layer where user session management and privilege verification should occur but fails to properly validate the requesting user's permissions against the target resource.
Remote exploitation of this vulnerability presents a serious operational risk as attackers can leverage this weakness from outside the network perimeter without requiring physical access or legitimate credentials. The publicly disclosed nature of the exploit increases the likelihood of real-world exploitation, particularly given the vendor's lack of response to early disclosure notifications. This scenario creates a dangerous environment where critical infrastructure users could be targeted for account deletion, potentially disrupting command and dispatch operations during emergency situations. The impact extends beyond simple user account manipulation as it could lead to data integrity issues, operational disruption, and potential compromise of sensitive information within the command and dispatch environment. According to ATT&CK framework, this vulnerability maps to T1078 (Valid Accounts) and T1531 (Account Access Removal), representing both credential abuse and account manipulation techniques that attackers could leverage.
Organizations utilizing this platform should immediately implement mitigation strategies including network segmentation to limit access to the affected endpoints, enhanced monitoring of user deletion activities, and immediate patching if available. The lack of vendor response compounds the risk, suggesting that organizations may need to develop temporary workarounds or consider alternative security measures. Access controls should be strengthened through mandatory authentication checks, input parameter validation, and privilege escalation controls. Additionally, implementing comprehensive audit logging for user management operations would provide visibility into potential exploitation attempts. The vulnerability highlights the critical importance of timely vendor communication and response to security disclosures, as well as the necessity for organizations to maintain robust security monitoring capabilities to detect and respond to such threats. Without proper mitigation, the platform remains vulnerable to unauthorized account manipulation that could severely impact emergency response capabilities and overall operational security.