Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2780 vulnerabilities reference this CWE, most recent first.
CVE-2026-119645 (GCVE-0-2026-119645)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 15:53
VLAI
EPSS
VEX
Title
ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
Summary
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/easysoft/zentaopms/issues/215 | issue-tracking |
| https://github.com/easysoft/zentaopms/blob/zentao… | technical-description |
| https://hackmd.io/@hieuPenguinnn/zentaopms-doc-aj… | third-party-advisory |
| https://github.com/easysoft/zentaopms | product |
| https://www.vulncheck.com/advisories/zentao-pms-t… | third-party-advisory |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119645",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:19.261386Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:53:14.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "zentaopms",
"repo": "https://github.com/easysoft/zentaopms",
"vendor": "easysoft",
"versions": [
{
"lessThanOrEqual": "22.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:09.559Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/easysoft/zentaopms/issues/215"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/easysoft/zentaopms/blob/zentaopms_22.6_20260917/module/doc/control.php#L2524-L2589"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/zentaopms-doc-ajaxgetdoc-private-doc-disclosure-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/easysoft/zentaopms"
},
{
"name": "VulnCheck Advisory: ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zentao-pms-through-22.6-missing-authorization-via-doc-ajaxgetdoc"
}
],
"title": "ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119645",
"datePublished": "2026-10-30T14:16:09.559Z",
"dateReserved": "2026-10-30T13:43:41.064Z",
"dateUpdated": "2026-10-30T15:53:14.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119644 (GCVE-0-2026-119644)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-05 21:30
VLAI
EPSS
VEX
Title
Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints
Summary
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:30 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/blossom-editor/blossom/issues/214 | issue-tracking |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://github.com/blossom-editor/blossom/blob/v1… | technical-description |
| https://hackmd.io/@hieuPenguinnn/blossom-picture-… | third-party-advisory |
| https://github.com/blossom-editor/blossom | product |
| https://www.vulncheck.com/advisories/blossom-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blossom-editor | Blossom |
Affected:
0 , ≤ 1.17.1
(semver)
cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119644",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:30:11.430575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:30:31.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blossom-editor/blossom",
"product": "Blossom",
"repo": "https://github.com/blossom-editor/blossom",
"vendor": "blossom-editor",
"versions": [
{
"lessThanOrEqual": "1.17.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wangyunf:blossom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users\u0027 pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims\u0027 images and stored files or change their star status."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:08.905Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/blossom-editor/blossom/issues/214"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureService.java#L222-L232"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blossom-editor/blossom/blob/v1.17.1/blossom-backend/backend/src/main/java/com/blossom/backend/server/picture/PictureController.java#L56-L109"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/blossom-picture-idor-cross-user-delete"
},
{
"tags": [
"product"
],
"url": "https://github.com/blossom-editor/blossom"
},
{
"name": "VulnCheck Advisory: Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blossom-through-1.17.1-authorization-bypass-via-picture-delete-and-star-endpoints"
}
],
"title": "Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119644",
"datePublished": "2026-10-30T14:16:08.905Z",
"dateReserved": "2026-10-30T13:43:32.954Z",
"dateUpdated": "2026-11-05T21:30:31.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119598 (GCVE-0-2026-119598)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-10-30 15:53
VLAI
EPSS
VEX
Title
Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id
Summary
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external_subscription_id parameter to disclose override scripts, filter rules, custom request headers and health-check URLs.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/iluobei/miaomiaowu/commit/14cc… | patch |
| https://github.com/iluobei/miaomiaowu/issues/131 | issue-tracking |
| https://github.com/iluobei/miaomiaowu/blob/v0.9.2… | technical-description |
| https://github.com/iluobei/miaomiaowu/blob/v0.9.2… | technical-description |
| https://github.com/iluobei/miaomiaowu/releases/ta… | release-notes |
| https://hackmd.io/@hieuPenguinnn/miaomiaowu-proxy… | third-party-advisory |
| https://github.com/iluobei/miaomiaowu | product |
| https://www.vulncheck.com/advisories/miaomiaowu-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| iluobei | miaomiaowu |
Affected:
0 , < 0.9.3
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:14.576493Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:53:35.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "miaomiaowu",
"repo": "https://github.com/iluobei/miaomiaowu",
"vendor": "iluobei",
"versions": [
{
"lessThan": "0.9.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users\u0027 configurations. Attackers can iterate the global auto-increment external_subscription_id parameter to disclose override scripts, filter rules, custom request headers and health-check URLs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:18:17.785Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/iluobei/miaomiaowu/commit/14ccf37ef82cff06b636454c29db7752cdce7cab"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/iluobei/miaomiaowu/issues/131"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/iluobei/miaomiaowu/blob/v0.9.2/internal/handler/proxy_provider.go#L114"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/iluobei/miaomiaowu/blob/v0.9.2/internal/storage/traffic.go#L4808"
},
{
"name": "miaomiaowu v0.9.3 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/iluobei/miaomiaowu/releases/tag/v0.9.3"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/miaomiaowu-proxy-provider-config-cross-user-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/iluobei/miaomiaowu"
},
{
"name": "VulnCheck Advisory: Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/miaomiaowu-before-0.9.3-cross-user-proxy-provider-config-disclosure-via-external-subscription-id"
}
],
"title": "Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119598",
"datePublished": "2026-10-30T13:18:17.785Z",
"dateReserved": "2026-10-30T11:46:45.711Z",
"dateUpdated": "2026-10-30T15:53:35.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119596 (GCVE-0-2026-119596)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-11-04 22:27
VLAI
EPSS
VEX
Title
UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download
Summary
UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:27 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/HDInnovations/UNIT3D/pull/5622 | patchissue-tracking |
| https://github.com/HDInnovations/UNIT3D/commit/ad… | patch |
| https://github.com/HDInnovations/UNIT3D/issues/5621 | issue-tracking |
| https://github.com/HDInnovations/UNIT3D/blob/v9.2… | technical-description |
| https://hackmd.io/@hieuPenguinnn/unit3d-playlist-… | third-party-advisory |
| https://github.com/HDInnovations/UNIT3D | product |
| https://www.vulncheck.com/advisories/unit3d-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| HDInnovations | UNIT3D |
Affected:
0 , ≤ 9.2.0
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:27:18.835121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:27:31.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UNIT3D",
"repo": "https://github.com/HDInnovations/UNIT3D",
"vendor": "HDInnovations",
"versions": [
{
"lessThanOrEqual": "9.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members\u0027 private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:18:16.431Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/HDInnovations/UNIT3D/pull/5622"
},
{
"tags": [
"patch"
],
"url": "https://github.com/HDInnovations/UNIT3D/commit/addc2829cefa2d4aad6511bc71311fa5887b9998"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/HDInnovations/UNIT3D/issues/5621"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/HDInnovations/UNIT3D/blob/v9.2.0/app/Http/Controllers/PlaylistZipController.php#L33"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/unit3d-playlist-zip-private-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/HDInnovations/UNIT3D"
},
{
"name": "VulnCheck Advisory: UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/unit3d-through-9.2.0-private-playlist-disclosure-via-playlist-zip-download"
}
],
"title": "UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119596",
"datePublished": "2026-10-30T13:18:16.431Z",
"dateReserved": "2026-10-30T11:46:44.896Z",
"dateUpdated": "2026-11-04T22:27:31.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119571 (GCVE-0-2026-119571)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-11-04 22:24
VLAI
EPSS
VEX
Title
Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
Summary
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:24 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/parse-community/parse-server/s… | vendor-advisory |
| https://www.vulncheck.com/advisories/parse-server… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| parse-community | parse-server |
Affected:
9.7.0 , < 9.10.5-alpha.10
(semver)
Unaffected: 9.10.5-alpha.10 (semver) cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119571",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:24:16.913784Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:24:28.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "9.10.5-alpha.10",
"status": "affected",
"version": "9.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.10.5-alpha.10",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10.5-alpha.10",
"versionStartIncluding": "9.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "mtrezza"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation\u0027s object ID can make a beforeSave trigger process that installation\u0027s protected fields while writing elsewhere."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:18:10.885Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8j8q-73xx-w3m4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-8j8q-73xx-w3m4"
},
{
"name": "VulnCheck Advisory: Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/parse-server-9.7.0-before-9.10.5-alpha.10-installation-update-misdirection-via-installation-id"
}
],
"title": "Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119571",
"datePublished": "2026-10-30T13:18:10.885Z",
"dateReserved": "2026-10-30T10:56:15.488Z",
"dateUpdated": "2026-11-04T22:24:28.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119555 (GCVE-0-2026-119555)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-11-05 21:20
VLAI
EPSS
VEX
Title
Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback
Summary
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:20 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/moodle/moodle/blob/v5.3.0/publ… | technical-description |
| https://abraxaslabs.tech/research/moodle-grades-f… | third-party-advisory |
| https://github.com/moodle/moodle | product |
| https://www.vulncheck.com/advisories/moodle-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Moodle Project | moodle |
Affected:
5.3.0
(semver)
Affected: 5.2.0 , ≤ 5.2.4 (semver) Affected: 5.1.0 , ≤ 5.1.8 (semver) Affected: 5.0.0 , ≤ 5.0.11 (semver) Affected: 4.2.0 , ≤ 4.5.15 (semver) cpe:2.3:a:moodle:moodle:5.3.0:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119555",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:20:33.886486Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:20:47.007Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://git.moodle.org",
"defaultStatus": "unaffected",
"packageName": "moodle",
"packageURL": "pkg:github/moodle/moodle",
"product": "moodle",
"repo": "https://github.com/moodle/moodle",
"vendor": "Moodle Project",
"versions": [
{
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.4",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.1.8",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.11",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.5.15",
"status": "affected",
"version": "4.2.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:moodle:moodle:5.3.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.2.4",
"versionStartIncluding": "5.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.1.8",
"versionStartIncluding": "5.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.0.11",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.5.15",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups\u0027 grade feedback and users\u0027 names and identity fields such as email."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:05.504Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/moodle/moodle/blob/v5.3.0/public/grade/classes/external/get_feedback.php#L77-L96"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/moodle-grades-feedback-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/moodle/moodle"
},
{
"name": "VulnCheck Advisory: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-information-disclosure-via-core-grades-get-feedback"
}
],
"title": "Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119555",
"datePublished": "2026-10-30T11:31:05.504Z",
"dateReserved": "2026-10-30T10:53:27.819Z",
"dateUpdated": "2026-11-05T21:20:47.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119548 (GCVE-0-2026-119548)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook
Summary
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://abraxaslabs.tech/research/lago-stripe-inv… | third-party-advisory |
| https://github.com/getlago/lago-api | product |
| https://www.vulncheck.com/advisories/lago-through… | third-party-advisory |
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119548",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:02.472992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:44.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lago",
"repo": "https://github.com/getlago/lago-api",
"vendor": "getlago",
"versions": [
{
"lessThanOrEqual": "1.55.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization\u0027s invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization\u0027s Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:00.682Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L116-L117"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L23-L24"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/lago-stripe-invoice-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/getlago/lago-api"
},
{
"name": "VulnCheck Advisory: Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lago-through-1.55.0-cross-organization-invoice-payment-manipulation-via-stripe-webhook"
}
],
"title": "Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119548",
"datePublished": "2026-10-30T11:31:00.682Z",
"dateReserved": "2026-10-30T10:53:25.150Z",
"dateUpdated": "2026-10-30T15:54:44.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119547 (GCVE-0-2026-119547)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-11-05 21:20
VLAI
EPSS
VEX
Title
Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
Summary
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://codeberg.org/forgejo/forgejo/src/tag/v17.… | technical-description |
| https://codeberg.org/forgejo/forgejo/src/tag/v17.… | technical-description |
| https://abraxaslabs.tech/research/forgejo-keys-idor | third-party-advisory |
| https://codeberg.org/forgejo/forgejo | product |
| https://www.vulncheck.com/advisories/forgejo-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119547",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:19:47.076699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:20:15.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://abraxaslabs.tech/research/forgejo-keys-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "forgejo",
"repo": "https://codeberg.org/forgejo/forgejo",
"vendor": "forgejo",
"versions": [
{
"lessThanOrEqual": "15.0.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "16.0.7",
"status": "affected",
"version": "16.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "17.0.1",
"status": "affected",
"version": "17.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "15.0.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "16.0.7",
"versionStartIncluding": "16.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*",
"versionEndIncluding": "17.0.1",
"versionStartIncluding": "17.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users\u0027 SSH, deploy and principal keys."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:00.001Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/routers/api/v1/user/key.go#L191"
},
{
"tags": [
"technical-description"
],
"url": "https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/models/asymkey/ssh_key.go#L139-L143"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/forgejo-keys-idor"
},
{
"tags": [
"product"
],
"url": "https://codeberg.org/forgejo/forgejo"
},
{
"name": "VulnCheck Advisory: Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/forgejo-through-15.0.11-16.0.7-and-17.0.1-information-disclosure-via-api-v1-user-keys-id"
}
],
"title": "Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119547",
"datePublished": "2026-10-30T11:31:00.001Z",
"dateReserved": "2026-10-30T10:53:24.765Z",
"dateUpdated": "2026-11-05T21:20:15.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119421 (GCVE-0-2026-119421)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Summary
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant's publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/juspay/hyperswitch/commit/f114… | patch |
| https://github.com/juspay/hyperswitch/commit/607b… | patch |
| https://github.com/juspay/hyperswitch/blob/v1.128… | technical-description |
| https://github.com/juspay/hyperswitch/blob/2026.0… | technical-description |
| https://abraxaslabs.tech/research/hyperswitch-pay… | third-party-advisory |
| https://github.com/juspay/hyperswitch | product |
| https://www.vulncheck.com/advisories/hyperswitch-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| juspay | hyperswitch |
Affected:
0 , ≤ 1.128.0
(semver)
Affected: 0 , < 2026.10.19.0 (custom) |
Date Public
2026-09-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:56.954253Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:12.805Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "hyperswitch",
"repo": "https://github.com/juspay/hyperswitch",
"vendor": "juspay",
"versions": [
{
"lessThanOrEqual": "1.128.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2026.10.19.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sakil Mostak"
}
],
"datePublic": "2026-09-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merchant\u0027s publishable key and a payout_id can confirm payouts and overwrite amount, currency, connector, and routing fields to trigger unauthorized merchant payouts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:52.245Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/juspay/hyperswitch/commit/f1144ec5c7e38b3b048fe797fad57e743041f345"
},
{
"tags": [
"patch"
],
"url": "https://github.com/juspay/hyperswitch/commit/607b15fcc4b7dae71c2aafb8c004eea333ac6fd8"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/juspay/hyperswitch/blob/v1.128.0/crates/router/src/services/authentication.rs#L5921-L5927"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/juspay/hyperswitch/blob/2026.09.21.0/crates/router/src/core/payouts/helpers.rs#L1465"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/hyperswitch-payout-confirm-secret"
},
{
"tags": [
"product"
],
"url": "https://github.com/juspay/hyperswitch"
},
{
"name": "VulnCheck Advisory: Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/hyperswitch-through-1.128.0-missing-authorization-in-payout-confirmation"
}
],
"title": "Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119421",
"datePublished": "2026-10-30T11:30:52.245Z",
"dateReserved": "2026-10-30T02:41:12.548Z",
"dateUpdated": "2026-10-30T15:55:12.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119329 (GCVE-0-2026-119329)
Vulnerability from cvelistv5 – Published: 2026-10-30 19:51 – Updated: 2026-11-02 16:08
VLAI
EPSS
VEX
Title
Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers
Summary
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer's archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:07 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/immich-app/immich/security/adv… | x_refsource_CONFIRM |
| https://github.com/immich-app/immich/pull/29028 | x_refsource_MISC |
| https://github.com/immich-app/immich/commit/b633c… | x_refsource_MISC |
| https://github.com/immich-app/immich/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| immich-app | immich |
Affected:
< 3.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119329",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:07:46.248400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:08:15.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/immich-app/immich/security/advisories/GHSA-hv27-723h-qfjq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "immich",
"vendor": "immich-app",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every selected owner when isArchived=true. A view-only partner could therefore enumerate the GPS coordinates and existence of a sharer\u0027s archived photos or videos even though the timeline and direct-access paths exclude archived partner assets. The exposure is limited to location metadata and asset identifiers because image bytes remain protected by checkPartnerAccess. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T19:51:23.105Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/immich-app/immich/security/advisories/GHSA-hv27-723h-qfjq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/immich-app/immich/security/advisories/GHSA-hv27-723h-qfjq"
},
{
"name": "https://github.com/immich-app/immich/pull/29028",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/immich-app/immich/pull/29028"
},
{
"name": "https://github.com/immich-app/immich/commit/b633cc4f046f198bc11648c486e1e6e3f19d26d5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/immich-app/immich/commit/b633cc4f046f198bc11648c486e1e6e3f19d26d5"
},
{
"name": "https://github.com/immich-app/immich/releases/tag/v3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/immich-app/immich/releases/tag/v3.0.0"
}
],
"source": {
"advisory": "GHSA-hv27-723h-qfjq",
"discovery": "UNKNOWN"
},
"title": "Immich: Partner \"view-only\" sharing leaks GPS coordinates of the sharer\u0027s archived assets via GET /api/map/markers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119329",
"datePublished": "2026-10-30T19:51:23.105Z",
"dateReserved": "2026-10-29T20:44:30.285Z",
"dateUpdated": "2026-11-02T16:08:15.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.