CVE-2026-42160: Sovity Dataspace-Portal

Critical severity, CVSS 10.0. EPSS: 0.4% chance of exploitation in the next 30 days.

Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PENDING" organization / user accounts. This issue has been patched in version 7.3.2.

Affected products

• Sovity Dataspace-Portal: from 2.1.1, before 7.3.2 (fixed in 7.3.2)

Published 2026-05-08. Last modified 2026-06-17.