# CVE-2024-7956: Rockwell Automation DataMosaix Private Cloud incorrect authorization

Source: https://junglewise.ai/threats/cve-2024-7956-rockwell-automation-datamosaix-private-cloud-incorrect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-7956 · Severity: info · CVSS 8.1 · Published 2026-09-02

DataMosaix Private Cloud is an industrial automation and data management platform used by enterprises to manage production data and projects. A vulnerability allows authenticated users with basic privileges to access and modify other users' projects without proper authorization, potentially exposing sensitive operational data and enabling sabotage of critical industrial projects.

Technologies: [Rockwell Automation DataMosaix Private Cloud](https://junglewise.ai/threats/technologies/datamosaix-private-cloud). Vendors: [Rockwell Automation](https://junglewise.ai/threats/vendors/rockwell-automation).

## Quick answers

**Is CVE-2024-7956 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-7956 being exploited in the wild.

**How severe is CVE-2024-7956?** Informational severity, with a CVSS score of 8.1, published 2 September 2026.

**Which products and versions are affected?** Rockwell Automation DataMosaix Private Cloud ≤7.07.

**Is there a fix for CVE-2024-7956?** A patch was published on 2024-10-04: Corrected in DataMosaix Private Cloud v7.09 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-7956 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-7956?** Check whether you run Rockwell Automation DataMosaix Private Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2024-7956 is an incorrect authorization vulnerability in Rockwell Automation DataMosaix Private Cloud affecting versions ≤7.07, fixed in v7.09. The vulnerability allows an authenticated attacker with basic user privileges to gain unauthorized access to other users' projects through missing authorization checks. The attacker can view, modify, and delete projects they do not own, exploiting an unauthenticated or inadequately validated access control mechanism. Network reachability and valid user credentials are required; no user interaction is necessary. The vulnerability has been patched in version 7.09 and is not known to be exploited in the wild.

## Affected products

- Rockwell Automation DataMosaix Private Cloud ≤7.07

## Timeline

- 2024-10-04: disclosed: Published in Rockwell Automation Security Advisory SD1702
- 2024-10-04: patched: Corrected in DataMosaix Private Cloud v7.09

## References

- [https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1702.html](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1702.html)

## Related threats

- [Rockwell Automation DataMosaix Private Cloud privilege escalation](https://junglewise.ai/threats/cve-2024-7953-rockwell-automation-datamosaix-private-cloud-privilege-escalation)
- [Rockwell Automation DataMosaix Private Cloud sensitive data exposure](https://junglewise.ai/threats/cve-2024-7952-rockwell-automation-datamosaix-private-cloud-sensitive-data)