Description

A vulnerability has been found in Cleo Harmony up to 5.8.1.10. Impacted is the function LocalUserUtil.getNativeUserByAssertions of the component SAML Authentication. Such manipulation of the argument Email leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.8.1.11 is recommended to address this issue. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-01T15:17:41.407Z",
  "pubdate": "2026-09-01T15:17:41.407Z",
  "executiveSummary": "A critical improper authentication vulnerability exists within the SAML Authentication component of Cleo Harmony versions up to 5.8.1.10.\nThe vulnerability originates from the mishandling of the Email argument within the LocalUserUtil.getNativeUserByAssertions function, allowing for authentication bypass mechanisms.\nThis flaw enables remote, unauthenticated attackers to manipulate assertions, potentially leading to unauthorized access to the application.\nThe risk is significantly elevated as a public exploit exists, increasing the probability of active exploitation.\nAffected organizations are urged to prioritize upgrading to version 5.8.1.11 to neutralize this security risk, as the current implementation fails to adequately validate user assertions during the SAML login flow.",
  "technicalDetails": "The vulnerability resides in the LocalUserUtil.getNativeUserByAssertions function within the SAML Authentication component of Cleo Harmony.\nThe root cause is identified as improper validation and processing of the Email attribute provided within SAML assertions.\nDuring the SAML authentication handshake, the application is responsible for mapping assertions provided by the Identity Provider (IdP) to a local user account.\nThe getNativeUserByAssertions function is tasked with retrieving the corresponding user object based on the incoming assertion data. Due to flawed logic, the function does not properly sanitize or verify the Email argument before using it to identify or authenticate the user session.\nAn attacker can exploit this by crafting a malicious SAML response containing a manipulated Email address. By providing an arbitrary or specifically crafted identifier in the Email field, the attacker can force the application to associate the session with a target user account they are not authorized to access.\nBecause the component does not perform sufficient integrity or signature validation on the specific assertion attribute being processed by this function, the application accepts the input as trusted, effectively bypassing the intended authentication workflow.\nThe attack is remotely exploitable, requiring no prior authentication to the Cleo Harmony instance, as the entry point is the SAML assertion endpoint itself.\nThe exploitation flow proceeds as follows: 1) The attacker initiates a SAML authentication request to the Cleo Harmony server. 2) The attacker intercepts or generates a malicious SAML assertion response. 3) The attacker modifies the Email parameter within the assertion to target a specific legitimate user. 4) The application processes the assertion via LocalUserUtil.getNativeUserByAssertions, which accepts the forged email as a valid identifier. 5) The server authenticates the attacker as the targeted user, granting unauthorized access to the session.\nSuccessful exploitation results in full identity masquerading, allowing the attacker to assume the privileges of any user identified by the email address provided in the malicious payload. This represents a complete breakdown of the authentication model for SAML-integrated deployments."
}