CVE-2026-89212 PUBLISHED

XML External Entity in Akana API Platform

Assigner: Perforce
Reserved: 11.09.2026 Published: 11.09.2026 Updated: 11.09.2026

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N
CVSS Score: 9.2

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	None	Integrity	Low
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 8.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Perforce
Product	Akana
Versions	Default: affected Version 2024.1.6, 2025.1.2, 2026.2 is unaffected Version All versions prior to 2024.1 is affected affected from 2024.1.0 to 2024.1.5 (incl.) affected from 2025.1.0 to 2025.1.1 (incl.) Version 2026.1 is affected

Credits

Yoeri Vegt finder

References

https://portal.perforce.com/s/cve/a91Qi000003CxPBIA0/xml-external-entity-in-akana-api-platform

Problem Types

CWE-611 Improper restriction of XML external entity reference CWE