{"cvss":0.0,"datePublished":"2026-09-18T00:00:00Z","dateUpdated":"2026-09-18T00:00:00Z","description":"Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure REST endpoint that accepts a plugins query parameter and forwards it to the plugin manager without authentication or authorization. Attackers can supply a URL to a malicious Python file through the plugins parameter, causing the Arelle webserver to download and execute the attacker-controlled code within the Arelle process with its privileges.","dueDate":"","id":"CVE-2026-42796","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"arelle","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"workiva arelle Missing Authentication for Critical Functionality","vendor":"workiva"}