CVE-2026-40742

CVE-2026-40742 is a Missing Authorization vulnerability in Nelio Software's Nelio AB Testing plugin affecting versions 8.2.8 and earlier. The flaw stems from incorrectly configured access control security levels that could allow unauthorized exploitation. This vulnerability enables attackers to bypass intended access restrictions within the plugin's functionality. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with a network-based attack vector requiring no special privileges or user interaction. While the attack complexity is low and the vulnerability is remotely exploitable, the impact is limited to availability degradation with no confidentiality or integrity compromise noted. The FAUCET Risk Score of 41.0/100 indicates moderate concern from a practical risk perspective. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. The low EPSS score of 0.0005 suggests minimal likelihood of near-term exploitation in the wild, indicating this is not presently a critical operational threat despite its authorization bypass nature.