CVE-2026-41960 — Permission control vulnerability in calls. Impact:

title: Potential CVE-2026-41960 Exploitation Attempt via Malicious Call Parameter - Free Tier
id: scw-2026-05-15-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation attempts targeting CVE-2026-41960. It specifically looks for web server access logs where a request to a call-related API endpoint (e.g., '/api/v1/calls') contains common parameters used in call management ('call_id', 'user_id') and results in a Forbidden (403) status code. This specific combination, especially when coupled with the vulnerability description indicating a permission control issue in calls, suggests an attacker attempting to abuse or enumerate call data, aligning with the CWE-200 (Information Exposure) and the potential impact on availability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-15
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41960/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri-query|contains:
          - 'call_id='
          - 'user_id='
      cs-uri|contains:
          - '/api/v1/calls'
      sc-status|exact:
          - '403'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse