1
General Board / Security Vulnerability with Sparx EA CVE-2026-42098
« on: May 21, 2026, 10:41:55 am »
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-42098
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Further scanning of the internet revealed some other vulnerabilities https://cert.pl/en/posts/2026/05/CVE-2026-42096/
Does anyone at Sparx Systems have any further information on whether this issues have been acknowledged and are they going to be fixed.
We were in middle of procurement process to purchase Trerado - Sparx EA and Prolaborate in the cloud. Which I'm putting on hold until we find out more.
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Further scanning of the internet revealed some other vulnerabilities https://cert.pl/en/posts/2026/05/CVE-2026-42096/
Does anyone at Sparx Systems have any further information on whether this issues have been acknowledged and are they going to be fixed.
We were in middle of procurement process to purchase Trerado - Sparx EA and Prolaborate in the cloud. Which I'm putting on hold until we find out more.