CVE-2026-50214: Shared Secret Quota Inflation
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace the shared global API token model. Configure the /v1/Plan service to refuse the global/shared API token and require per-user or per-service least-privilege API tokens or service accounts for administrative actions.
/v1/Plan service authentication = disable shared global API token; use least-privilege individual/service tokens - Configuration
Enforce server-side authorization and RBAC on the plan-creation endpoint so only authorized principals can create or modify plans, and ensure creation of zero-cost plans is restricted to approved roles.
/v1/Plan service authorization_checks = enforced - Compensating control
Temporarily restrict access to the /v1/Plan endpoint (e.g., IP allowlist, internal network only, firewall rules, WAF) and apply rate limiting to reduce abuse while permanent fixes are implemented.
- Operational
Rotate and immediately revoke the existing shared global API token used by /v1/Plan. Issue new tokens only after implementing least-privilege credentials and authorization controls.
- Operational
Audit existing plans for unauthorized zero-cost entries created using the shared token; delete or remediate any unauthorized plans and reconcile any quota or billing impacts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50214?
CVE-2026-50214 has a critical severity rating of 9.3.
How do I fix CVE-2026-50214?
To mitigate CVE-2026-50214, it is essential to implement stronger authentication mechanisms and eliminate reliance on a single global API token.
What is CVE-2026-50214 about?
CVE-2026-50214 is a vulnerability that allows arbitrary creation of zero-cost network access plans due to reliance on a shared global API token.
What software is affected by CVE-2026-50214?
CVE-2026-50214 affects the Acer Connect M6e 5g Firmware.
When was CVE-2026-50214 published?
CVE-2026-50214 was published on June 4, 2026.