boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-32582

CVE-2026-32582MEDIUM
iatoai IATO MCP — WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  N  H  N    6.5   .0017    6.5     —
AFFECTED
  Product   Versions     Fixed
  IATO MCP  unspecified  1.12.1
TIMELINE
  Mar 12  Reserved by Patchstack
  Oct 6   Published (CNA: Patchstack)
  Oct 8   PATCH SHIPPED — CVE-2026-32582 (iatoai IATO MCP). Fixed in IATO MCP 1.12.1.
CWE-862 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

Description

Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
March 12, 2026ReservedReserved by Patchstack
October 6, 2026PublishedPublished (CNA: Patchstack)
October 8, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-32582 (iatoai IATO MCP). Fixed in IATO MCP 1.12.1.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
iatoaiIATO MCP——1.12.1

Weaknesses

CWE-862

References (1)

Related

Authoritative record: CVE-2026-32582 at cve.org

Vendors: iatoai

Weaknesses: CWE-862

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-32582 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.