# SALTO ProAccess Space Privilege Escalation Exposes Critical Building Access Flaw
## The Threat
A newly disclosed privilege escalation vulnerability in SALTO ProAccess Space—a widely deployed building access control system used across commercial facilities and critical manufacturing environments worldwide—allows authenticated attackers to bypass tenant isolation and access spaces they shouldn't be able to reach. CVE-2026-11889 represents a significant breach in the logical security model that administrators rely on to segment access permissions across multi-tenant deployments.
The vulnerability exploits a flaw in how SALTO ProAccess Space handles user-controlled authorization keys when the tenancy (logical partitioning) feature is enabled. An attacker with valid operator credentials in one partition can manipulate these keys to escalate privileges and access spaces managed within other partitions of the same installation. This breaks the fundamental trust boundary that organizations depend on when deploying access control systems across multiple business units, departments, or customer environments within a single infrastructure.
What makes this particularly concerning is the combination of required preconditions: while the attacker must already possess valid authenticated credentials, the barrier to exploitation once inside the system is remarkably low. For facilities using SALTO's multi-tenant partitioning—a feature increasingly popular among managed service providers and large organizations managing multiple properties—this vulnerability effectively nullifies the security benefit of logical separation. An insider threat, compromised contractor account, or lateral movement following a phishing attack becomes dramatically more dangerous.
## Severity and Impact
| Metric | Details |
|--------|---------|
| CVE ID | CVE-2026-11889 |
| Affected Software | SALTO ProAccess Space < 6.13 |
| Vulnerability Type | Authorization Bypass Through User-Controlled Key (CWE-639) |
| CVSS v3.1 Score | 6.5 (MEDIUM) |
| CVSS v4.0 Score | 7.1 (HIGH) |
| CVSS Vector (v3.1) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CVSS Vector (v4.0) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| Attack Vector | Network |
| Authentication Required | Yes (valid operator credentials) |
| User Interaction | None |
| Scope | Same SALTO installation |
| Impact | Integrity compromise (unauthorized access to restricted spaces) |
| Reporter | Bernhard Lorenz, Limes Security |
## Affected Products
- Specifically impacts installations with the tenancy/logical partitioning feature enabled
- Single-partition deployments are not affected
- All versions 6.12 and earlier are vulnerable
## Mitigations
Immediate Actions:
Organizations using SALTO ProAccess Space should prioritize an upgrade to version 6.13 or later, which patches the authorization bypass. However, given the architectural implications of this vulnerability, CISA recommends a multi-layered defense strategy:
1. Apply the security update — Deploy version 6.13 immediately to affected systems, testing thoroughly in a non-production environment first given the criticality of access control systems.
2. Restrict network exposure — Do not expose ProAccess Space administrative interfaces directly to the internet. Implement strict network segmentation, ensuring the system operates only on protected internal networks behind firewalls.
3. Enforce least-privilege operator access — Audit all operator-level accounts and revoke unnecessary permissions. Apply the principle of least privilege rigorously: operators should only retain credentials for the partitions and spaces they legitimately need to manage.
4. Consider architectural alternatives — If strong tenant separation is a business requirement, evaluate whether running separate, isolated SALTO Space instances is more appropriate than relying on logical partitioning within a single installation. This eliminates the shared attack surface entirely.
5. Disable partitioning if feasible — For organizations that do not genuinely require multi-tenant functionality, disabling the partitioning feature and operating under a single partition eliminates this attack vector entirely.
6. Monitor for suspicious activity — Implement logging and alerting on cross-partition access attempts. Review audit logs for any unauthorized space access, particularly by privileged operators.
## References
---
## HackWire Analysis
This vulnerability exposes a critical blind spot in how organizations think about access control: logical separation is not the same as actual separation. When SALTO promoted its partitioning feature, the implicit promise was "you can trust this line between tenants." This CVE shatters that promise, and the fallout extends far beyond SALTO's install base.
The real story isn't just a coding error in authorization logic—it's architectural hubris. Building a single system that *appears* to serve multiple isolated customers through logical partitions is cheaper and more operationally convenient than running truly separate instances. But it introduces a single failure point that, once exploited, compromises the entire isolation model. For managed security service providers and facility management companies running dozens of client properties on one SALTO deployment, this isn't a minor patch; it's a fundamental crisis of trust.
What's particularly damning is that the vulnerability requires only baseline authenticated access. In real-world deployments, this means a disgruntled facilities contractor, a phishing-compromised employee account, or a former partner still holding credentials could escalate immediately to full facility access. In critical infrastructure environments—manufacturing floors, power distribution facilities, data centers—this crosses from "security inconvenience" to "physical safety incident."
The fix exists (version 6.13), but the architectural lesson shouldn't be lost: multi-tenant logical partitioning in access control systems needs adversarial scrutiny at design time, not vulnerability disclosure time. Organizations that have deployed SALTO with partitioning should treat this as an urgent wake-up call: update immediately, then seriously evaluate whether logical isolation actually meets your security requirements or if true instance separation is necessary.
— HackWire Editorial
## Related Coverage