Common Weakness Enumeration
CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
1235 vulnerabilities reference this CWE, most recent first.
CVE-2026-120224 (GCVE-0-2026-120224)
Vulnerability from cvelistv5 – Published: 2026-11-01 10:15 – Updated: 2026-11-02 14:21
VLAI
EPSS
VEX
Title
Oray Pugongying X5 Pro API Authorization run_async_task improper authorization
Summary
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
9.9 (Critical)
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:20 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429583 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429583/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120224 | third-party-advisory |
| https://vuldb.com/submit/1007541 | third-party-advisory |
| https://vuldb.com/submit/1007542 | third-party-advisory |
| https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Oray | Pugongying X5 Pro |
Affected:
7.6.0
Affected: 7.6.1 cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:20:59.358631Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:21:10.830Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:oray:pugongying_x5_pro:*:*:*:*:*:*:*:*"
],
"modules": [
"API Authorization"
],
"product": "Pugongying X5 Pro",
"vendor": "Oray",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"status": "affected",
"version": "7.6.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "FirmHarness (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T10:15:16.501Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429583 | Oray Pugongying X5 Pro API Authorization run_async_task improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429583"
},
{
"name": "VDB-429583 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429583/cti"
},
{
"name": "CVE-2026-120224 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120224"
},
{
"name": "Submit #1007541 | Oray Pgyer X5 Pro Router 7.6.1 Incorrect Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1007541"
},
{
"name": "Submit #1007542 | Oray Pgyer X5 Pro Router 7.6.1 Incorrect Authorization (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1007542"
},
{
"tags": [
"exploit"
],
"url": "https://app.notion.com/p/Oray-Pgyer-X5-Pro-Router-7-6-1-Restricted-Account-Can-Invoke-Factory-Reset-through-the-JSON-Batch-AP-3eb797159f1580febfd2f0e1ee239352"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-31T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-31T20:26:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "Oray Pugongying X5 Pro API Authorization run_async_task improper authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120224",
"datePublished": "2026-11-01T10:15:16.501Z",
"dateReserved": "2026-10-31T19:20:53.566Z",
"dateUpdated": "2026-11-02T14:21:10.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120185 (GCVE-0-2026-120185)
Vulnerability from cvelistv5 – Published: 2026-10-31 22:15 – Updated: 2026-11-02 14:39
VLAI
EPSS
VEX
Title
ken678 YznCMS Auth Group Group.php Backend privileges management
Summary
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:38 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/429502 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/429502/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-120185 | third-party-advisory |
| https://vuldb.com/submit/1026603 | third-party-advisory |
| https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f… | patch |
| https://gitee.com/ken678/YZNCMS/tree/v2.2.1 | patch |
| https://gitee.com/ken678/YZNCMS/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:38:42.410773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:39:02.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:yzncms:yzncms:*:*:*:*:*:*:*:*"
],
"modules": [
"Auth Group Handler"
],
"product": "YznCMS",
"vendor": "ken678",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2.0"
},
{
"status": "unaffected",
"version": "2.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "danieluec (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T22:15:20.469Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429502 | ken678 YznCMS Auth Group Group.php Backend privileges management",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429502"
},
{
"name": "VDB-429502 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429502/cti"
},
{
"name": "CVE-2026-120185 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120185"
},
{
"name": "Submit #1026603 | YZNCMS YznCMS 2.1.5 Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1026603"
},
{
"tags": [
"patch"
],
"url": "https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d"
},
{
"tags": [
"patch"
],
"url": "https://gitee.com/ken678/YZNCMS/tree/v2.2.1"
},
{
"tags": [
"product"
],
"url": "https://gitee.com/ken678/YZNCMS/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-31T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-31T08:06:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "ken678 YznCMS Auth Group Group.php Backend privileges management",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120185",
"datePublished": "2026-10-31T22:15:20.469Z",
"dateReserved": "2026-10-31T07:01:45.637Z",
"dateUpdated": "2026-11-02T14:39:02.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119922 (GCVE-0-2026-119922)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:08 – Updated: 2026-11-06 18:16
VLAI
EPSS
VEX
Title
Babelfish for PostgreSQL Privilege Escalation
Summary
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 20:13 UTC
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
AMZN
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://github.com/babelfish-for-postgresql/babel… | release-notespatch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/babelfish-for-postgresql/babel… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| AWS | babelfish-for-postgresql |
Affected:
1.2 , ≤ 1.5
(custom)
Affected: 2.1 , ≤ 2.15 (custom) Affected: 3.1 , ≤ 3.12 (custom) Affected: 4.0 , ≤ 4.8 (custom) Affected: 5.1 , ≤ 5.4 (custom) cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:* |
|
| Amazon | Amazon Aurora PostgreSQL with Babelfish |
Affected:
1.0.0 , < 1.5.5
(custom)
Affected: 1.6.0 , < 1.17.2 (custom) Affected: 2.0.0 , < 2.3.5 (custom) Affected: 2.4.0 , < 2.12.4 (custom) Affected: 2.13.0 , < 2.13.3 (custom) Affected: 2.14.0 , < 2.14.2 (custom) Affected: 2.15.0 , < 2.15.2 (custom) Affected: 2.16.0 , < 2.16.1 (custom) Affected: 3.0.0 , < 3.8.4 (custom) Affected: 3.9.0 , < 3.9.4 (custom) Affected: 3.10.0 , < 3.10.3 (custom) Affected: 3.11.0 , < 3.11.2 (custom) Affected: 3.12.0 , < 3.12.2 (custom) Affected: 3.13.0 , < 3.13.1 (custom) Affected: 4.0.0 , < 4.5.5 (custom) Affected: 4.6.0 , < 4.6.3 (custom) Affected: 4.7.0 , < 4.7.2 (custom) Affected: 4.8.0 , < 4.8.2 (custom) Affected: 4.9.0 , < 4.9.1 (custom) Affected: 5.0.0 , < 5.1.4 (custom) Affected: 5.2.0 , < 5.2.3 (custom) Affected: 5.3.0 , < 5.3.2 (custom) Affected: 5.4.0 , < 5.4.2 (custom) Affected: 5.5.0 (custom) Affected: 6.0.0 , < 6.0.2 (custom) cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:5.5.0:*:*:*:*:*:*:* cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T20:13:35.320527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:13:48.531Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "babelfish-for-postgresql",
"vendor": "AWS",
"versions": [
{
"lessThanOrEqual": "1.5",
"status": "affected",
"version": "1.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.15",
"status": "affected",
"version": "2.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.12",
"status": "affected",
"version": "3.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.8",
"status": "affected",
"version": "4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.4",
"status": "affected",
"version": "5.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Amazon Aurora PostgreSQL with Babelfish",
"vendor": "Amazon",
"versions": [
{
"lessThan": "1.5.5",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThan": "1.17.2",
"status": "affected",
"version": "1.6.0",
"versionType": "custom"
},
{
"lessThan": "2.3.5",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
},
{
"lessThan": "2.12.4",
"status": "affected",
"version": "2.4.0",
"versionType": "custom"
},
{
"lessThan": "2.13.3",
"status": "affected",
"version": "2.13.0",
"versionType": "custom"
},
{
"lessThan": "2.14.2",
"status": "affected",
"version": "2.14.0",
"versionType": "custom"
},
{
"lessThan": "2.15.2",
"status": "affected",
"version": "2.15.0",
"versionType": "custom"
},
{
"lessThan": "2.16.1",
"status": "affected",
"version": "2.16.0",
"versionType": "custom"
},
{
"lessThan": "3.8.4",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "3.9.4",
"status": "affected",
"version": "3.9.0",
"versionType": "custom"
},
{
"lessThan": "3.10.3",
"status": "affected",
"version": "3.10.0",
"versionType": "custom"
},
{
"lessThan": "3.11.2",
"status": "affected",
"version": "3.11.0",
"versionType": "custom"
},
{
"lessThan": "3.12.2",
"status": "affected",
"version": "3.12.0",
"versionType": "custom"
},
{
"lessThan": "3.13.1",
"status": "affected",
"version": "3.13.0",
"versionType": "custom"
},
{
"lessThan": "4.5.5",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.6.3",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.2",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
},
{
"lessThan": "4.8.2",
"status": "affected",
"version": "4.8.0",
"versionType": "custom"
},
{
"lessThan": "4.9.1",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "5.1.4",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
},
{
"lessThan": "5.2.3",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.3.2",
"status": "affected",
"version": "5.3.0",
"versionType": "custom"
},
{
"lessThan": "5.4.2",
"status": "affected",
"version": "5.4.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.5.0",
"versionType": "custom"
},
{
"lessThan": "6.0.2",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.5",
"versionStartIncluding": "1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.15",
"versionStartIncluding": "2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.12",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.8",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:aws:babelfish-for-postgresql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.4",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.5",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.17.2",
"versionStartIncluding": "1.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.5",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.12.4",
"versionStartIncluding": "2.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.13.3",
"versionStartIncluding": "2.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.14.2",
"versionStartIncluding": "2.14.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.2",
"versionStartIncluding": "2.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.16.1",
"versionStartIncluding": "2.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.8.4",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.9.4",
"versionStartIncluding": "3.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.10.3",
"versionStartIncluding": "3.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.11.2",
"versionStartIncluding": "3.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.12.2",
"versionStartIncluding": "3.12.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.13.1",
"versionStartIncluding": "3.13.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.5",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.2",
"versionStartIncluding": "4.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.2",
"versionStartIncluding": "4.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.1",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.1.4",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.3",
"versionStartIncluding": "5.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.2",
"versionStartIncluding": "5.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.2",
"versionStartIncluding": "5.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:5.5.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:amazon:amazon_aurora_postgresql_with_babelfish:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.2",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch.\u003c/p\u003e"
}
],
"value": "Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend users upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later. Customers using Amazon Aurora PostgreSQL with Babelfish should upgrade their cluster to Aurora PostgreSQL 13.9.16 (1.5.5), 13.23.3 (1.17.2), 14.6.16 (2.3.5), 14.17.8 (2.12.4), 14.18.6 (2.13.3), 14.19.5 (2.14.2), 14.20.5 (2.15.2), 14.22.3 (2.16.1), 14.23.1 (2.17.0), 15.10.8 (3.8.4), 15.12.8 (3.9.4), 15.13.6 (3.10.3), 15.14.5 (3.11.2), 15.15.5 (3.12.2), 15.17.3 (3.13.1), 15.18.1 (3.14.0), 16.8.8 (4.5.5), 16.9.6 (4.6.3), 16.10.5 (4.7.2), 16.11.5 (4.8.2), 16.13.3 (4.9.1), 16.14.1 (4.10.0), 17.4.8 (5.1.4), 17.5.6 (5.2.3), 17.6.5 (5.3.2), 17.7.5 (5.4.2), 17.9.3 (5.5.1), 17.10.1 (5.6.0), 18.3.4 (6.0.2), 18.4.1 (6.1.0) or later, and apply any pending maintenance to ensure they are on the latest patch."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:16:36.907Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_4_10_0__PG_16_14"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_5_6_0__PG_17_10"
},
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish-for-postgresql/releases/tag/BABEL_6_1_0__PG_18_4"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-165-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/babelfish-for-postgresql/babelfish_extensions/security/advisories/GHSA-fv9p-9rr9-fm35"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Babelfish for PostgreSQL Privilege Escalation",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-119922",
"datePublished": "2026-11-03T18:08:48.966Z",
"dateReserved": "2026-10-30T16:59:28.086Z",
"dateUpdated": "2026-11-06T18:16:36.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119599 (GCVE-0-2026-119599)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-10-30 14:07
VLAI
EPSS
VEX
Title
AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes
Summary
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 14:06 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/looplj/axonhub/commit/e5c904ef… | patch |
| https://github.com/looplj/axonhub/pull/2741 | patchissue-tracking |
| https://github.com/looplj/axonhub/issues/2724 | issue-tracking |
| https://github.com/looplj/axonhub/blob/v1.0.0-bet… | technical-description |
| https://github.com/looplj/axonhub/blob/v1.0.0-bet… | technical-description |
| https://hackmd.io/@hieuPenguinnn/axonhub-apikey-s… | third-party-advisory |
| https://github.com/looplj/axonhub | product |
| https://www.vulncheck.com/advisories/axonhub-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119599",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T14:06:47.047096Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:07:11.920Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/looplj/axonhub",
"product": "AxonHub",
"repo": "https://github.com/looplj/axonhub",
"vendor": "looplj",
"versions": [
{
"lessThanOrEqual": "1.0.0-beta11",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel\u0027s configuration, including base URLs and model lists."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:18:18.486Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/looplj/axonhub/commit/e5c904efbdabd80d74827dfae478330339c5a514"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/looplj/axonhub/pull/2741"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/looplj/axonhub/issues/2724"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key.go#L340"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key.go#L448"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation"
},
{
"tags": [
"product"
],
"url": "https://github.com/looplj/axonhub"
},
{
"name": "VulnCheck Advisory: AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/axonhub-through-1.0.0-beta11-privilege-escalation-via-service-account-api-key-scopes"
}
],
"title": "AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119599",
"datePublished": "2026-10-30T13:18:18.486Z",
"dateReserved": "2026-10-30T11:46:46.108Z",
"dateUpdated": "2026-10-30T14:07:11.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119514 (GCVE-0-2026-119514)
Vulnerability from cvelistv5 – Published: 2026-11-09 10:00 – Updated: 2026-11-09 15:30 X_Open Source
VLAI
EPSS
VEX
Title
WordPress RepairBuddy plugin <= 4.1234 - Privilege Escalation vulnerability
Summary
Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:21 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Webful Creations | RepairBuddy |
Affected:
0 , ≤ 4.1234
(custom)
|
Date Public
2026-11-07 09:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119514",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:21:48.764861Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:30:35.547Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "computer-repair-shop",
"product": "RepairBuddy",
"vendor": "Webful Creations",
"versions": [
{
"changes": [
{
"at": "4.1235",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1234",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zhugez | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-07T09:43:36.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.\u003cp\u003eThis issue affects RepairBuddy: from n/a through 4.1234.\u003c/p\u003e"
}
],
"value": "Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T10:00:13.688Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1234-privilege-escalation-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress RepairBuddy plugin to the latest available version (at least 4.1235)."
}
],
"value": "Update the WordPress RepairBuddy plugin to the latest available version (at least 4.1235)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress RepairBuddy plugin \u003c= 4.1234 - Privilege Escalation vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119514",
"datePublished": "2026-11-09T10:00:13.688Z",
"dateReserved": "2026-10-30T09:20:18.657Z",
"dateUpdated": "2026-11-09T15:30:35.547Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119506 (GCVE-0-2026-119506)
Vulnerability from cvelistv5 – Published: 2026-11-09 00:37 – Updated: 2026-11-09 14:09 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability
Summary
Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:08 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DynamiApps | Frontend Admin by DynamiApps |
Affected:
0 , ≤ 3.30.1
(custom)
|
Date Public
2026-11-06 23:04
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119506",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:08:57.489605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:09:08.747Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "acf-frontend-form-element",
"product": "Frontend Admin by DynamiApps",
"vendor": "DynamiApps",
"versions": [
{
"changes": [
{
"at": "3.30.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.30.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nguyen Quang Tan | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-06T23:04:27.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.\u003cp\u003eThis issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.\u003c/p\u003e"
}
],
"value": "Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T00:37:53.164Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/acf-frontend-form-element/vulnerability/wordpress-frontend-admin-by-dynamiapps-plugin-3-30-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Frontend Admin by DynamiApps plugin to the latest available version (at least 3.30.2)."
}
],
"value": "Update the WordPress Frontend Admin by DynamiApps plugin to the latest available version (at least 3.30.2)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Frontend Admin by DynamiApps plugin \u003c= 3.30.1 - Privilege Escalation vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119506",
"datePublished": "2026-11-09T00:37:53.164Z",
"dateReserved": "2026-10-30T09:20:18.656Z",
"dateUpdated": "2026-11-09T14:09:08.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119481 (GCVE-0-2026-119481)
Vulnerability from cvelistv5 – Published: 2026-11-04 12:08 – Updated: 2026-11-04 15:08 X_Open Source
VLAI
EPSS
VEX
Title
WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability
Summary
Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 14:39 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Crocoblock | JetFormBuilder |
Affected:
0 , ≤ 3.6.7.1
(custom)
|
Date Public
2026-11-02 11:29
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119481",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T14:39:29.270754Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:08:50.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "jetformbuilder",
"product": "JetFormBuilder",
"vendor": "Crocoblock",
"versions": [
{
"changes": [
{
"at": "3.6.8",
"status": "unaffected"
}
],
"lessThanOrEqual": "3.6.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "dzaku | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-11-02T11:29:05.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.\u003cp\u003eThis issue affects JetFormBuilder: from n/a through 3.6.7.1.\u003c/p\u003e"
}
],
"value": "Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T12:08:34.250Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-7-1-privilege-escalation-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress JetFormBuilder plugin to the latest available version (at least 3.6.8)."
}
],
"value": "Update the WordPress JetFormBuilder plugin to the latest available version (at least 3.6.8)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress JetFormBuilder plugin \u003c= 3.6.7.1 - Privilege Escalation vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-119481",
"datePublished": "2026-11-04T12:08:34.250Z",
"dateReserved": "2026-10-30T09:20:18.654Z",
"dateUpdated": "2026-11-04T15:08:50.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118644 (GCVE-0-2026-118644)
Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-11-03 13:18
VLAI
EPSS
VEX
Title
n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
Summary
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 13:17 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-2… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118644",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T13:17:47.451503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T13:18:09.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.42.2",
"status": "affected",
"version": "2.42.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.42.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.41.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.41.5",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.42.2",
"versionStartIncluding": "2.42.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.41.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "sm1ee"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow\u0027s full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague\u0027s workflow settings.errorWorkflow to an error workflow they own, inherit the colleague\u0027s identity when that workflow fails, and resolve the colleague\u0027s per-user dynamic credential secrets."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:59:44.266Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pcr3-v5vr-qppf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-pcr3-v5vr-qppf"
},
{
"name": "VulnCheck Advisory: n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-2.41.5-and-2.42.2-credential-theft-via-error-workflow-context-inheritance"
}
],
"title": "n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118644",
"datePublished": "2026-10-28T18:59:44.266Z",
"dateReserved": "2026-10-28T17:24:54.846Z",
"dateUpdated": "2026-11-03T13:18:09.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118086 (GCVE-0-2026-118086)
Vulnerability from cvelistv5 – Published: 2026-10-30 18:30 – Updated: 2026-10-30 22:15
VLAI
EPSS
VEX
Title
WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability
Summary
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 21:21 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hakan Ozevin | WP BASE Booking |
Affected:
n/a , ≤ 6.5.2
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118086",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T21:21:10.377189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T22:15:49.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-base-booking-of-appointments-services-and-events",
"product": "WP BASE Booking",
"vendor": "Hakan Ozevin",
"versions": [
{
"lessThanOrEqual": "6.5.2",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "m1ngt | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Subscriber Privilege Escalation in WP BASE Booking \u003c= 6.5.2 versions."
}
],
"value": "Subscriber Privilege Escalation in WP BASE Booking \u003c= 6.5.2 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:30:54.718Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-base-booking-of-appointments-services-and-events/vulnerability/wordpress-wp-base-booking-plugin-6-5-2-privilege-escalation-vulnerability?_s_id=cve"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress WP BASE Booking plugin \u003c= 6.5.2 - Privilege Escalation vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-118086",
"datePublished": "2026-10-30T18:30:54.718Z",
"dateReserved": "2026-10-27T16:00:44.818Z",
"dateUpdated": "2026-10-30T22:15:49.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118082 (GCVE-0-2026-118082)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:24 – Updated: 2026-10-30 18:49
VLAI
EPSS
VEX
Title
WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
Summary
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:33 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| BuddyBoss | Buddyboss Platform |
Affected:
n/a , ≤ 3.5.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118082",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T18:33:50.510803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:49:59.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Buddyboss Platform",
"vendor": "BuddyBoss",
"versions": [
{
"lessThanOrEqual": "3.5.0",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Hung Bach Ngoc - VinSOC (@tomchuoi) | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Subscriber Privilege Escalation in Buddyboss Platform \u003c= 3.5.0 versions."
}
],
"value": "Subscriber Privilege Escalation in Buddyboss Platform \u003c= 3.5.0 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:25:08.061Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/buddyboss-platform/vulnerability/wordpress-buddyboss-platform-plugin-3-5-0-privilege-escalation-vulnerability?_s_id=cve"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Buddyboss Platform plugin \u003c= 3.5.0 - Privilege Escalation vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-118082",
"datePublished": "2026-10-29T15:24:39.565Z",
"dateReserved": "2026-10-27T16:00:44.817Z",
"dateUpdated": "2026-10-30T18:49:59.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.