CVE-2026-54569 in Senaite
Summary
by MITRE • 08/26/2026
SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update_many, remove, doActionFor, doActionFor_many, and getusers, do not enforce the senaite.core: Access JSON API permission before resolving attacker-selected objects. In src/bika/lims/jsonapi/init.py, set_fields_from_request passes raw request values for RecordsField and RecordField instances to eval() before field mutator write-permission checks execute. An anonymous attacker can discover the bika_setup object identifier through @@uuid, send a value such as RejectionReasons to /@@API/update, and execute arbitrary Python in the Zope worker before a later mutation failure rolls back ZODB changes. The same unsafe evaluation pattern is present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py. Successful exploitation can expose or modify laboratory data, files, and accounts and can disrupt the service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within SENAITE.CORE versions 2.0.0 through 2.6.0 represents a critical security flaw involving unauthenticated remote code execution via the JSON API interface of the Laboratory Information Management System. This issue stems from two distinct but related technical failures: insufficient authorization enforcement on state-changing endpoints and unsafe evaluation of user-supplied input within field processing logic. The core framework, which serves as the foundation for SENAITE LIMS, relies heavily on Zope Object Database interactions to manage laboratory data, making these vulnerabilities particularly severe due to their potential impact on system integrity and confidentiality.
The first component of this vulnerability involves a missing authorization check in several state-changing routes defined within src/bika/lims/jsonapi/update.py. Specifically, endpoints such as update, update_many, remove, doActionFor, doActionFor_many, and getusers fail to enforce the senaite.core: Access JSON API permission before resolving objects selected by an attacker. This oversight allows anonymous users to interact with internal system objects without proper authentication or authorization validation. By leveraging the @@uuid endpoint, an unauthenticated actor can discover valid object identifiers within the Zope application context, such as bika_setup, which contains sensitive configuration data and potentially executable logic.
The second component involves unsafe evaluation of raw request values in src/bika/lims/jsonapi/init.py. The function set_fields_from_request processes input for RecordsField and RecordField instances by passing them directly to Python's eval() function before field mutator write-permission checks are executed. This sequence error means that arbitrary Python code can be injected into the application context via API requests, leading to remote code execution within the Zope worker process. The same unsafe evaluation pattern is also present in src/senaite/core/browser/fields/record.py and src/senaite/core/browser/fields/records.py, expanding the attack surface across multiple components of the framework.
Exploitation requires a two-request chain where an attacker first identifies target object identifiers and then submits crafted payloads to trigger code execution. Although mutation failures may roll back changes in the ZODB transaction, the initial evaluation occurs before this rollback mechanism engages, allowing attackers to execute arbitrary commands during the window between input processing and permission verification. This capability enables unauthorized access to laboratory data, modification of critical system configurations, manipulation of user accounts, and potential disruption of service availability by causing crashes or resource exhaustion through malicious code execution.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the use of eval() on unsanitized input, as well as CWE-287 Improper Authentication because state-changing operations proceed without verifying user credentials or permissions. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1059 Command and Scripting Interpreter for code execution and potentially T1136 Create Account if the executed code modifies system users, reflecting the high severity associated with unauthenticated remote access in enterprise laboratory management systems.
Mitigation strategies should prioritize immediate patching of SENAITE.CORE to versions beyond 2.6.0 where these issues have been addressed by developers. In environments where upgrading is not immediately feasible, administrators can implement network-level controls such as firewall rules or reverse proxy configurations to restrict access to the JSON API endpoints exclusively from trusted internal IP ranges and require explicit authentication headers for all requests. Additionally, input validation mechanisms should be strengthened at the application layer to prevent raw user data from reaching evaluation functions without rigorous sanitization checks that align with secure coding standards for dynamic code execution contexts.