Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2780 vulnerabilities reference this CWE, most recent first.
CVE-2026-119663 (GCVE-0-2026-119663)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-04 22:35
VLAI
EPSS
VEX
Title
Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create
Summary
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId in a batch request to insert attacker-named resource rows listed by the victim's client.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:35 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/wannabespace/tamery/issues/601 | issue-tracking |
| https://github.com/wannabespace/tamery/commit/400… | patch |
| https://github.com/wannabespace/tamery/blob/v0.32… | technical-description |
| https://hackmd.io/@hieuPenguinnn/conar-broken-own… | third-party-advisory |
| https://github.com/wannabespace/tamery | product |
| https://www.vulncheck.com/advisories/tamery-conar… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wannabespace | tamery |
Affected:
0.32.0 , < 0.99.0
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119663",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:35:42.840263Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:35:52.067Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "tamery",
"repo": "https://github.com/wannabespace/tamery",
"vendor": "wannabespace",
"versions": [
{
"lessThan": "0.99.0",
"status": "affected",
"version": "0.32.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "letstri"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users\u0027 connections. Attackers owning one connection can include a victim\u0027s connectionId in a batch request to insert attacker-named resource rows listed by the victim\u0027s client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:23.361Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/wannabespace/tamery/issues/601"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wannabespace/tamery/commit/400a9001a661e5ab2f87c51de25da1c4afa7ceed"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wannabespace/tamery/blob/v0.32.0/apps/api/orpc/routers/connections-resources/create.ts#L14-L32"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/conar-broken-ownership-cross-user-write"
},
{
"tags": [
"product"
],
"url": "https://github.com/wannabespace/tamery"
},
{
"name": "VulnCheck Advisory: Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tamery-conar-0.32.0-before-0.99.0-broken-authorization-via-connectionsresources-create"
}
],
"title": "Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119663",
"datePublished": "2026-10-30T14:16:23.361Z",
"dateReserved": "2026-10-30T13:43:50.239Z",
"dateUpdated": "2026-11-04T22:35:52.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119661 (GCVE-0-2026-119661)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 15:52
VLAI
EPSS
VEX
Title
ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
Summary
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/star7th/showdoc/issues/2612 | issue-tracking |
| https://github.com/star7th/showdoc/commit/5322851… | patch |
| https://github.com/star7th/showdoc/blob/v3.9.5/se… | technical-description |
| https://hackmd.io/@hieuPenguinnn/showdoc-paramdes… | third-party-advisory |
| https://github.com/star7th/showdoc | product |
| https://www.vulncheck.com/advisories/showdoc-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119661",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:25.839972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:52:32.619Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/star7th/showdoc",
"product": "ShowDoc",
"repo": "https://github.com/star7th/showdoc",
"vendor": "star7th",
"versions": [
{
"lessThanOrEqual": "3.9.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:showdoc:showdoc:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.9.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "star7th"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users\u0027 entry ids to permanently delete those parameter-description entries."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:21.954Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/star7th/showdoc/issues/2612"
},
{
"tags": [
"patch"
],
"url": "https://github.com/star7th/showdoc/commit/53228511e656904abf7841c3d25ff78a4b5ce9c2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/star7th/showdoc/blob/v3.9.5/server/app/Api/Controller/ParamDescLibController.php#L545-L584"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/showdoc-paramdesclib-cross-item-idor-delete"
},
{
"tags": [
"product"
],
"url": "https://github.com/star7th/showdoc"
},
{
"name": "VulnCheck Advisory: ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/showdoc-through-3.9.5-authorization-bypass-via-paramdesclib-deleteentries"
}
],
"title": "ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119661",
"datePublished": "2026-10-30T14:16:21.954Z",
"dateReserved": "2026-10-30T13:43:49.459Z",
"dateUpdated": "2026-10-30T15:52:32.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119659 (GCVE-0-2026-119659)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-04 22:34
VLAI
EPSS
VEX
Title
Blossom through 1.17.1 Authorization Bypass via Folder Endpoints
Summary
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:34 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/blossom-editor/blossom/issues/213 | issue-tracking |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://hackmd.io/@hieuPenguinnn/blossom-folder-i… | third-party-advisory |
| https://github.com/blossom-editor/blossom | product |
| https://www.vulncheck.com/advisories/blossom-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blossom-editor | Blossom |
Affected:
0 , ≤ 1.17.1
(semver)
cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119659",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:34:45.454666Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:34:56.679Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blossom-editor/blossom",
"product": "Blossom",
"repo": "https://github.com/blossom-editor/blossom",
"vendor": "blossom-editor",
"versions": [
{
"lessThanOrEqual": "1.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users\u0027 folders because FolderService queries filter only on folder id. Attackers can supply another user\u0027s folder id to /folder/info, /folder/upd, /folder/open or /folder/del to read storage paths, rename, toggle visibility, or delete folders."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:20.531Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/blossom-editor/blossom/issues/213"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/folder/FolderService.java#L123-L202"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/resources/mapper/FolderMapper.xml#L64-L92"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/blossom-folder-idor-cross-user-modify-delete"
},
{
"tags": [
"product"
],
"url": "https://github.com/blossom-editor/blossom"
},
{
"name": "VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Folder Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-folder-endpoints"
}
],
"title": "Blossom through 1.17.1 Authorization Bypass via Folder Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119659",
"datePublished": "2026-10-30T14:16:20.531Z",
"dateReserved": "2026-10-30T13:43:48.691Z",
"dateUpdated": "2026-11-04T22:34:56.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119658 (GCVE-0-2026-119658)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 16:15
VLAI
EPSS
VEX
Title
PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update
Summary
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:15 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/PowerDNS-Admin/PowerDNS-Admin/… | issue-tracking |
| https://github.com/PowerDNS-Admin/PowerDNS-Admin/… | issue-trackingpatch |
| https://github.com/PowerDNS-Admin/PowerDNS-Admin/… | technical-description |
| https://github.com/PowerDNS-Admin/PowerDNS-Admin/… | technical-description |
| https://hackmd.io/@hieuPenguinnn/powerdns-admin-r… | third-party-advisory |
| https://github.com/PowerDNS-Admin/PowerDNS-Admin | product |
| https://www.vulncheck.com/advisories/powerdns-adm… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PowerDNS-Admin | PowerDNS-Admin |
Affected:
0 , ≤ 2026.08.1
(custom)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119658",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:15:27.447630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:15:55.020Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/powerdns-admin-record-update-body-domain-override-cross-zone-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PowerDNS-Admin",
"repo": "https://github.com/PowerDNS-Admin/PowerDNS-Admin",
"vendor": "PowerDNS-Admin",
"versions": [
{
"lessThanOrEqual": "2026.08.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different \u0027domain\u0027 field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users\u0027 secondary zones and infer zone existence from differing responses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:19.832Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1940"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/pull/1942"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/domain.py#L738-L766"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/models/domain.py#L702-L730"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/powerdns-admin-record-update-body-domain-override-cross-zone-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin"
},
{
"name": "VulnCheck Advisory: PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/\u003cdomain_name\u003e/update",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/powerdns-admin-through-2026.08.1-authorization-bypass-via-domain-domain-name-update"
}
],
"title": "PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/\u003cdomain_name\u003e/update",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119658",
"datePublished": "2026-10-30T14:16:19.832Z",
"dateReserved": "2026-10-30T13:43:48.291Z",
"dateUpdated": "2026-10-30T16:15:55.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119657 (GCVE-0-2026-119657)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 15:52
VLAI
EPSS
VEX
Title
FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations
Summary
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/zyx0814/FilePress/issues/76 | issue-tracking |
| https://github.com/zyx0814/FilePress/blob/3.0.1/d… | technical-description |
| https://github.com/zyx0814/FilePress/blob/3.0.1/d… | technical-description |
| https://github.com/zyx0814/FilePress/blob/3.0.1/d… | technical-description |
| https://github.com/zyx0814/FilePress/blob/3.0.1/c… | technical-description |
| https://hackmd.io/@hieuPenguinnn/filepress-pichom… | third-party-advisory |
| https://github.com/zyx0814/FilePress | product |
| https://www.vulncheck.com/advisories/filepress-th… | third-party-advisory |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:24.212068Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:52:45.124Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FilePress",
"repo": "https://github.com/zyx0814/FilePress",
"vendor": "zyx0814",
"versions": [
{
"lessThanOrEqual": "3.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries\u0027 folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library\u0027s appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:19.114Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/zyx0814/FilePress/issues/76"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library.php#L9"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/folder.php#L6-L50"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/dzz/pichome/library/rightdata.php#L6-L30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zyx0814/FilePress/blob/3.0.1/core/class/table/table_pichome_vappmember.php#L56-L64"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/filepress-pichome-library-missing-per-library-authorization-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/zyx0814/FilePress"
},
{
"name": "VulnCheck Advisory: FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/filepress-through-3.0.1-missing-authorization-in-pichome-library-folder-operations"
}
],
"title": "FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119657",
"datePublished": "2026-10-30T14:16:19.114Z",
"dateReserved": "2026-10-30T13:43:47.844Z",
"dateUpdated": "2026-10-30T15:52:45.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119652 (GCVE-0-2026-119652)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-05 21:46
VLAI
EPSS
VEX
Title
HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure
Summary
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:45 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/HuLaSpark/HuLa-Server/issues/34 | issue-tracking |
| https://github.com/HuLaSpark/HuLa-Server/blob/v3.… | technical-description |
| https://hackmd.io/@hieuPenguinnn/hula-server-idor… | third-party-advisory |
| https://github.com/HuLaSpark/HuLa-Server | product |
| https://www.vulncheck.com/advisories/hula-server-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HuLaSpark | HuLa-Server |
Affected:
0 , ≤ 3.0.7
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119652",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:45:25.938598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:46:03.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HuLa-Server",
"repo": "https://github.com/HuLaSpark/HuLa-Server",
"vendor": "HuLaSpark",
"versions": [
{
"lessThanOrEqual": "3.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users\u0027 friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim\u0027s uid, bypassing the missing administrator or owner check to read any user\u0027s contact list."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:15.521Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/issues/34"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/FriendController.java#L59-L66"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend"
},
{
"tags": [
"product"
],
"url": "https://github.com/HuLaSpark/HuLa-Server"
},
{
"name": "VulnCheck Advisory: HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hula-server-through-3.0.7-idor-via-user-friend-page-friend-list-disclosure"
}
],
"title": "HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119652",
"datePublished": "2026-10-30T14:16:15.521Z",
"dateReserved": "2026-10-30T13:43:43.766Z",
"dateUpdated": "2026-11-05T21:46:03.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119651 (GCVE-0-2026-119651)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-04 22:32
VLAI
EPSS
VEX
Title
HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion
Summary
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:32 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/HuLaSpark/HuLa-Server/issues/34 | issue-tracking |
| https://github.com/HuLaSpark/HuLa-Server/blob/v3.… | technical-description |
| https://github.com/HuLaSpark/HuLa-Server/blob/v3.… | technical-description |
| https://hackmd.io/@hieuPenguinnn/hula-server-idor… | third-party-advisory |
| https://github.com/HuLaSpark/HuLa-Server | product |
| https://www.vulncheck.com/advisories/hula-server-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HuLaSpark | HuLa-Server |
Affected:
0 , ≤ 3.0.7
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:32:19.802601Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:32:33.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HuLa-Server",
"repo": "https://github.com/HuLaSpark/HuLa-Server",
"vendor": "HuLaSpark",
"versions": [
{
"lessThanOrEqual": "3.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users\u0027 moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user\u0027s feedId to delete their moments along with associated media, comments, and likes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:14.833Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/issues/34"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/FeedController.java#L79-L83"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/src/main/java/com/luohuo/flex/im/core/user/service/impl/FeedServiceImpl.java#L356-L370"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend"
},
{
"tags": [
"product"
],
"url": "https://github.com/HuLaSpark/HuLa-Server"
},
{
"name": "VulnCheck Advisory: HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hula-server-through-3.0.7-idor-via-feed-del-moment-deletion"
}
],
"title": "HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119651",
"datePublished": "2026-10-30T14:16:14.833Z",
"dateReserved": "2026-10-30T13:43:43.388Z",
"dateUpdated": "2026-11-04T22:32:33.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119650 (GCVE-0-2026-119650)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 16:13
VLAI
EPSS
VEX
Title
HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController
Summary
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user's UserPrivacy settings without ownership checks.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:13 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/HuLaSpark/HuLa-Server/issues/34 | issue-tracking |
| https://github.com/HuLaSpark/HuLa-Server/blob/v3.… | technical-description |
| https://github.com/HuLaSpark/HuLa-Server/blob/v3.… | technical-description |
| https://hackmd.io/@hieuPenguinnn/hula-server-idor… | third-party-advisory |
| https://github.com/HuLaSpark/HuLa-Server | product |
| https://www.vulncheck.com/advisories/hula-server-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HuLaSpark | HuLa-Server |
Affected:
0 , ≤ 3.0.7
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119650",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:13:18.477647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:13:28.899Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "HuLa-Server",
"repo": "https://github.com/HuLaSpark/HuLa-Server",
"vendor": "HuLaSpark",
"versions": [
{
"lessThanOrEqual": "3.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users\u0027 privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and overwrite that user\u0027s UserPrivacy settings without ownership checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:14.132Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/issues/34"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-controller/src/main/java/com/luohuo/flex/im/controller/user/PrivacyController.java#L25-L36"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HuLaSpark/HuLa-Server/blob/v3.0.7/luohuo-cloud/luohuo-im/luohuo-im-biz/src/main/java/com/luohuo/flex/im/core/user/service/impl/PrivacyServiceImpl.java#L20-L35"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/hula-server-idor-privacy-feed-friend"
},
{
"tags": [
"product"
],
"url": "https://github.com/HuLaSpark/HuLa-Server"
},
{
"name": "VulnCheck Advisory: HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hula-server-through-3.0.7-idor-via-privacy-endpoint-in-privacycontroller"
}
],
"title": "HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119650",
"datePublished": "2026-10-30T14:16:14.132Z",
"dateReserved": "2026-10-30T13:43:43.011Z",
"dateUpdated": "2026-10-30T16:13:28.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119647 (GCVE-0-2026-119647)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-04 22:31
VLAI
EPSS
VEX
Title
RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}
Summary
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:31 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/dromara/RuoYi-Vue-Plus/issues/60 | issue-tracking |
| https://github.com/dromara/RuoYi-Vue-Plus/commit/… | patch |
| https://github.com/dromara/RuoYi-Vue-Plus/blob/v6… | technical-description |
| https://github.com/dromara/RuoYi-Vue-Plus/blob/v6… | technical-description |
| https://hackmd.io/@hieuPenguinnn/ruoyi-vue-plus-u… | third-party-advisory |
| https://github.com/dromara/RuoYi-Vue-Plus | product |
| https://www.vulncheck.com/advisories/ruoyi-vue-pl… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dromara | RuoYi-Vue-Plus |
Affected:
0 , ≤ 6.0.0
(semver)
cpe:2.3:a:dromara:ruoyi-vue-plus:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:31:17.538729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:31:30.907Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dromara/RuoYi-Vue-Plus",
"product": "RuoYi-Vue-Plus",
"repo": "https://github.com/dromara/RuoYi-Vue-Plus",
"vendor": "dromara",
"versions": [
{
"lessThanOrEqual": "6.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dromara:ruoyi-vue-plus:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "CrazyLionCat"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:10.847Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/dromara/RuoYi-Vue-Plus/issues/60"
},
{
"tags": [
"patch"
],
"url": "https://github.com/dromara/RuoYi-Vue-Plus/commit/a8b1bea7b7a4ca260172cf74fbf4ea7763092996"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dromara/RuoYi-Vue-Plus/blob/v6.0.0/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/service/impl/SysUserServiceImpl.java#L555-L560"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/dromara/RuoYi-Vue-Plus/blob/v6.0.0/ruoyi-modules/ruoyi-system/src/main/java/org/dromara/system/controller/system/SysUserController.java#L352-L356"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/ruoyi-vue-plus-user-list-by-dept-datascope-bypass"
},
{
"tags": [
"product"
],
"url": "https://github.com/dromara/RuoYi-Vue-Plus"
},
{
"name": "VulnCheck Advisory: RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ruoyi-vue-plus-through-6.0.0-data-scope-bypass-via-system-user-list-dept-deptid"
}
],
"title": "RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119647",
"datePublished": "2026-10-30T14:16:10.847Z",
"dateReserved": "2026-10-30T13:43:41.854Z",
"dateUpdated": "2026-11-04T22:31:30.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119646 (GCVE-0-2026-119646)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 16:17
VLAI
EPSS
VEX
Title
Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API
Summary
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site's session_id or order_id to read its visit history, IP addresses, user agents and order data.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:17 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/Open-Web-Analytics/Open-Web-An… | issue-tracking |
| https://github.com/Open-Web-Analytics/Open-Web-An… | patch |
| https://github.com/Open-Web-Analytics/Open-Web-An… | patch |
| https://github.com/Open-Web-Analytics/Open-Web-An… | release-notes |
| https://github.com/Open-Web-Analytics/Open-Web-An… | technical-description |
| https://hackmd.io/@hieuPenguinnn/open-web-analyti… | third-party-advisory |
| https://github.com/Open-Web-Analytics/Open-Web-An… | product |
| https://www.vulncheck.com/advisories/open-web-ana… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Open Web Analytics | Open Web Analytics |
Affected:
0 , < 1.14.1
(semver)
cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119646",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:17:26.017947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:17:52.032Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Open-Web-Analytics/Open-Web-Analytics",
"product": "Open Web Analytics",
"repo": "https://github.com/Open-Web-Analytics/Open-Web-Analytics",
"vendor": "Open Web Analytics",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "padams"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites\u0027 report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site can supply that siteId with another site\u0027s session_id or order_id to read its visit history, IP addresses, user agents and order data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:10.196Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/issues/1236"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/9a1b62893fe8242048a1129d96f89a52f910be72"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/commit/e6832fa60ead473c5792a999ae32abb3fecc2790"
},
{
"name": "Open Web Analytics 1.14.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.14.1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/1.14.0/modules/Base/Controller/ReportsRest.php#L466-L618"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/open-web-analytics-reports-rest-cross-site-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/Open-Web-Analytics/Open-Web-Analytics"
},
{
"name": "VulnCheck Advisory: Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-web-analytics-before-1.14.1-cross-site-data-disclosure-via-rest-report-api"
}
],
"title": "Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119646",
"datePublished": "2026-10-30T14:16:10.196Z",
"dateReserved": "2026-10-30T13:43:41.455Z",
"dateUpdated": "2026-10-30T16:17:52.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.