A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh …

A vulnerability was identified in Cleo Harmony versions up to 5.8.1.10 affecting the JWT Refresh Token Handler component at the /api/connections endpoint. The flaw allows manipulation of the Bearer argument, leading to improper privilege management. The vulnerability is remotely exploitable and a public exploit has been released, increasing the risk of active exploitation. Affected users are advised to upgrade to version 5.8.1.11, which resolves the issue. The vulnerability has been assigned CVE-2026-84115 and is tracked by both NVD and VulDB.