# CVE-2026-19979: GL.iNet WebDAV authorization bypass in COPY/MOVE Source: https://junglewise.ai/threats/cve-2026-19979-gl-inet-webdav-authorization-bypass-in-copy-move Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-08-17. Updated: 2026-09-25 License: CC BY 4.0 with a link back CVE-2026-19979 · Severity: high · CVSS 8.3 · Published 2026-08-17 GL.iNet routers and mesh devices include a WebDAV file-sharing service that is used to store and synchronize files. A flaw in the COPY and MOVE functionality allows an attacker with access to a public share to bypass authorization checks and create, move, or overwrite files in private areas without authentication. This could lead to unauthorized data access, file corruption, or system compromise. Technologies: [GL.iNet A1300](https://junglewise.ai/threats/technologies/a1300), [GL.iNet AX1800](https://junglewise.ai/threats/technologies/ax1800), [GL.iNet AXT1800](https://junglewise.ai/threats/technologies/axt1800), [GL.iNet BE10000](https://junglewise.ai/threats/technologies/be10000), [GL.iNet BE1400](https://junglewise.ai/threats/technologies/be1400), [GL.iNet BE3600](https://junglewise.ai/threats/technologies/be3600), [GL.iNet E5800](https://junglewise.ai/threats/technologies/e5800), [GL.iNet MT2500](https://junglewise.ai/threats/technologies/mt2500), [GL.iNet MT3000](https://junglewise.ai/threats/technologies/mt3000), [GL.iNet MT3600BE](https://junglewise.ai/threats/technologies/mt3600be), [GL.iNet MT5000](https://junglewise.ai/threats/technologies/mt5000), [GL.iNet MT6000](https://junglewise.ai/threats/technologies/mt6000), [GL.iNet X2000](https://junglewise.ai/threats/technologies/x2000), [GL.iNet X3000](https://junglewise.ai/threats/technologies/x3000), [GL.iNet XE3000](https://junglewise.ai/threats/technologies/xe3000). Vendors: [GL.iNet](https://junglewise.ai/threats/vendors/gl-inet). ## Quick answers **Is CVE-2026-19979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19979 being exploited in the wild. **How severe is CVE-2026-19979?** High severity, with a CVSS score of 8.3, published 17 August 2026. **Which products and versions are affected?** GL.iNet A1300 4.5 to 4.8.x; GL.iNet AX1800 4.5 to 4.8.x; GL.iNet AXT1800 4.5 to 4.8.x; GL.iNet BE10000 4.5 to 4.8.x; and 11 more. **Is there a fix for CVE-2026-19979?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-19979 attacked?** It is attacked over the network, in device firmware. **Am I affected by CVE-2026-19979?** Check whether you run GL.iNet A1300, GL.iNet AX1800, GL.iNet AXT1800 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details The vulnerability is an authorization bypass in the WebDAV service's COPY and MOVE operations. The service correctly validates the source path but fails to perform the same authorization check on the attacker-controlled destination path. This allows an authenticated (or public) user to use a public writable share as a confused deputy to write or move files to restricted locations. Unauthenticated attackers can create, move, and overwrite private files in the WebDAV namespace that would normally return 401 Unauthorized on direct requests. The attack requires network access to the WebDAV service but does not require authentication. A patch is expected from the vendor; affected firmware versions are 4.5.x and later through 4.8.x. ## Affected products - GL.iNet A1300 4.5 to 4.8.x - GL.iNet AX1800 4.5 to 4.8.x - GL.iNet AXT1800 4.5 to 4.8.x - GL.iNet BE1400 4.5 to 4.8.x - GL.iNet BE3600 4.5 to 4.8.x - GL.iNet BE6500 4.5 to 4.8.x - GL.iNet BE9300 4.5 to 4.8.x - GL.iNet BE10000 4.5 to 4.8.x - GL.iNet E5800 4.5 to 4.8.x - GL.iNet MT2500 4.5 to 4.8.x - GL.iNet MT3000 4.5 to 4.8.x - GL.iNet MT3600BE 4.5 to 4.8.x - GL.iNet MT5000 4.5 to 4.8.x - GL.iNet MT6000 4.5 to 4.8.x - GL.iNet X2000 4.5 to 4.8.x - GL.iNet X3000 4.5 to 4.8.x - GL.iNet XE3000 4.5 to 4.8.x ## Timeline - 2026-08-17: disclosed - 2026-08-17: advisory: CVE-2026-19979 published ## References - [https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/WebDAV%20Public-Share%20Destination%20Authorization%20Bypass.md](https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/WebDAV%20Public-Share%20Destination%20Authorization%20Bypass.md) - [https://vuldb.com/cve/CVE-2026-19979](https://vuldb.com/cve/CVE-2026-19979) ## Related threats - [GL.iNet multiple routers OS command injection in NAS service](https://junglewise.ai/threats/cve-2026-19983-gl-inet-multiple-routers-os-command-injection-in-nas-service) - [GL.iNet BE9300 and MT6000 OS command injection in firewall-management RPC](https://junglewise.ai/threats/cve-2026-19982-gl-inet-be9300-and-mt6000-os-command-injection-in-firewall) - [GL.iNet Router OS command injection in Wi-Fi Timer Power-Schedule](https://junglewise.ai/threats/cve-2026-19981-gl-inet-router-os-command-injection-in-wi-fi-timer-power-schedule) - [GL.iNet Router Code Injection in Language Update](https://junglewise.ai/threats/cve-2026-19980-gl-inet-router-code-injection-in-language-update) - [GL.iNet AX1800 command injection in RPC endpoint](https://junglewise.ai/threats/cve-2026-18787-gl-inet-ax1800-command-injection-in-rpc-endpoint)