Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

2780 vulnerabilities reference this CWE, most recent first.

CVE-2026-116018 (GCVE-0-2026-116018)

Vulnerability from cvelistv5 – Published: 2026-10-24 11:40 – Updated: 2026-10-29 15:23
VLAI
Title
ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint
Summary
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:21 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
ONEARMY community-platform Affected: 0 , < 2.165.2 (semver)
Create a notification for this product.
Date Public
2026-10-21 06:36
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116018",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T15:21:20.554747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T15:23:13.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ONEARMY/community-platform",
          "product": "community-platform",
          "repo": "https://github.com/ONEARMY/community-platform",
          "vendor": "ONEARMY",
          "versions": [
            {
              "lessThan": "2.165.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-21T06:36:05.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users\u0027 notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T11:40:34.948Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/ONEARMY/community-platform/issues/5022"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/ONEARMY/community-platform/pull/5011"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ONEARMY/community-platform/commit/571732c26caf1a0a46e5335d275cef2e19dfab08"
        },
        {
          "name": "community-platform v2.165.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/ONEARMY/community-platform/releases/tag/v2.165.2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/ONEARMY/community-platform/blob/v2.163.2/src/routes/api.notifications.$id.read.ts#L6-L22"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/onearmy-community-platform-notification-read-idor"
        },
        {
          "name": "VulnCheck Advisory: ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/onearmy-community-platform-before-2.165.2-idor-via-notification-read-endpoint"
        }
      ],
      "title": "ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116018",
    "datePublished": "2026-10-24T11:40:34.948Z",
    "dateReserved": "2026-10-24T11:23:56.802Z",
    "dateUpdated": "2026-10-29T15:23:13.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116017 (GCVE-0-2026-116017)

Vulnerability from cvelistv5 – Published: 2026-10-24 11:40 – Updated: 2026-10-29 18:24
VLAI
Title
Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint
Summary
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 18:24 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
xinnan-tech xiaozhi-esp32-server Affected: 0 , < 0.9.8 (semver)
Create a notification for this product.
Date Public
2026-10-22 14:24
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T18:24:26.211619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T18:24:38.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/xinnan-tech/xiaozhi-esp32-server",
          "product": "xiaozhi-esp32-server",
          "repo": "https://github.com/xinnan-tech/xiaozhi-esp32-server",
          "vendor": "xinnan-tech",
          "versions": [
            {
              "lessThan": "0.9.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T14:24:34.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users\u0027 device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user\u0027s device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T11:40:34.247Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/issues/3459"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/pull/3460"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/commit/d4ff9c5c17cbd82ec98a2a6bb4f82a07c1be0f03"
        },
        {
          "name": "xiaozhi-esp32-server v0.9.8 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/releases/tag/v0.9.8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/java/xiaozhi/modules/device/controller/DeviceController.java#L173-L178"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/xinnan-tech/xiaozhi-esp32-server/blob/v0.9.7/main/manager-api/src/main/resources/mapper/device/DeviceAddressBookDao.xml#L5-L10"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/xiaozhi-esp32-server-address-book-idor"
        },
        {
          "name": "VulnCheck Advisory: Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/xiaozhi-esp32-server-before-0.9.8-idor-via-device-address-book-endpoint"
        }
      ],
      "title": "Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116017",
    "datePublished": "2026-10-24T11:40:34.247Z",
    "dateReserved": "2026-10-24T11:23:56.439Z",
    "dateUpdated": "2026-10-29T18:24:38.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116015 (GCVE-0-2026-116015)

Vulnerability from cvelistv5 – Published: 2026-10-24 11:40 – Updated: 2026-10-26 17:40
VLAI
Title
yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
Summary
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:38 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
YunaiV yudao-cloud Affected: 0 , ≤ 2026.09 (custom)
Create a notification for this product.
Date Public
2026-10-22 14:24
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116015",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:38:58.671211Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:40:10.123Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/YunaiV/yudao-cloud",
          "product": "yudao-cloud",
          "repo": "https://github.com/YunaiV/yudao-cloud",
          "vendor": "YunaiV",
          "versions": [
            {
              "lessThanOrEqual": "2026.09",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T14:24:44.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members\u0027 after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T11:40:32.903Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/YunaiV/yudao-cloud/issues/344"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/YunaiV/yudao-cloud/commit/df604fbd9824195ec3e48e2dfd3341c1d4e1edea"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/controller/app/aftersale/AppAfterSaleLogController.java#L33-L40"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/YunaiV/yudao-cloud/blob/593354d92a63f401ba73b95da868aade8c3d855d/yudao-module-mall/yudao-module-trade-server/src/main/java/cn/iocoder/yudao/module/trade/dal/mysql/aftersale/AfterSaleLogMapper.java#L13-L17"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/yudao-cloud-mall-after-sale-log-cross-member-idor"
        },
        {
          "name": "VulnCheck Advisory: yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/yudao-cloud-through-2026.09-idor-via-after-sale-log-list-endpoint"
        }
      ],
      "title": "yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116015",
    "datePublished": "2026-10-24T11:40:32.903Z",
    "dateReserved": "2026-10-24T11:23:55.707Z",
    "dateUpdated": "2026-10-26T17:40:10.123Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116010 (GCVE-0-2026-116010)

Vulnerability from cvelistv5 – Published: 2026-10-24 11:40 – Updated: 2026-10-29 14:46
VLAI
Title
RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
Summary
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 14:45 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
francoisjacquet RosarioSIS Affected: 0 , < 12.9.1 (semver)
    cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-06-03 13:19
Credits
harunmansor
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116010",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:45:20.516800Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:46:14.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://gitlab.com/francoisjacquet/rosariosis/-/work_items/377"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/francoisjacquet/rosariosis",
          "product": "RosarioSIS",
          "repo": "https://gitlab.com/francoisjacquet/rosariosis",
          "vendor": "francoisjacquet",
          "versions": [
            {
              "lessThan": "12.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.9.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "harunmansor"
        }
      ],
      "datePublic": "2026-06-03T13:19:19.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T11:40:29.488Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/377"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/francoisjacquet/rosariosis/-/commit/37b67dad841479799cc41bc969c7aea6626bab66"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.com/francoisjacquet/rosariosis/-/blob/v12.9/modules/Discipline/MakeReferral.php#L75"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.com/francoisjacquet/rosariosis/-/releases/v12.9.1"
        },
        {
          "name": "VulnCheck Advisory: RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/rosariosis-before-12.9.1-missing-authorization-in-teacher-save-handlers"
        }
      ],
      "title": "RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116010",
    "datePublished": "2026-10-24T11:40:29.488Z",
    "dateReserved": "2026-10-24T11:23:53.806Z",
    "dateUpdated": "2026-10-29T14:46:14.817Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115998 (GCVE-0-2026-115998)

Vulnerability from cvelistv5 – Published: 2026-10-24 09:28 – Updated: 2026-11-02 14:05
VLAI
Title
IDOR: User reads and modifies findings from other people's projects
Summary
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:04 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Grayback CNA
References
Impacted products
Vendor Product Version
CervantesSec cervantes Affected: alpha 0.3 , ≤ 1.3-beta (custom)
Unaffected: v.1.4.0-beta
    cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Joan Arranz
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:04:10.816409Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:05:02.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cervantes",
          "vendor": "CervantesSec",
          "versions": [
            {
              "lessThanOrEqual": "1.3-beta",
              "status": "affected",
              "version": "alpha 0.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "v.1.4.0-beta"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3-beta",
                  "versionStartIncluding": "alpha_0.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joan Arranz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eIDOR i\u003cspan\u003en Cervantes version v1.3-beta could allow a\u003c/span\u003en authenticated attacker ca\u0026nbsp;access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity.\u003c/p\u003e\u003c/div\u003e"
            }
          ],
          "value": "IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca\u00a0access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T09:28:05.849Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IDOR: User reads and modifies findings from other people\u0027s projects",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-115998",
    "datePublished": "2026-10-24T09:28:05.849Z",
    "dateReserved": "2026-10-24T09:23:13.297Z",
    "dateUpdated": "2026-11-02T14:05:02.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115994 (GCVE-0-2026-115994)

Vulnerability from cvelistv5 – Published: 2026-10-24 09:04 – Updated: 2026-11-02 14:03
VLAI
Title
BOLA Allows Cross-Project Target Tampering
Summary
BOLA Allows Cross-Project Target Tampering  in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 14:03 UTC
CWE
  • CWE-639 - - Authorization Bypass Through User-Controlled Key
Assigner
Grayback CNA
References
Impacted products
Vendor Product Version
CervantesSec cervantes Affected: alpha 0.3 , ≤ 1.3-beta (custom)
Unaffected: v.1.4.0-beta
    cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Jaime Ramírez
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115994",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:03:17.722632Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:03:51.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cervantes",
          "vendor": "CervantesSec",
          "versions": [
            {
              "lessThanOrEqual": "1.3-beta",
              "status": "affected",
              "version": "alpha 0.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "v.1.4.0-beta"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3-beta",
                  "versionStartIncluding": "alpha_0.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cervantessec:cervantes:v.1.4.0-beta:*:*:*:*:*:*:*",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jaime Ram\u00edrez"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eBOLA Allows Cross-Project Target Tampering\u0026nbsp;\nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
            }
          ],
          "value": "BOLA Allows Cross-Project Target Tampering\u00a0\nin Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 - Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T09:04:02.750Z",
        "orgId": "772f0079-75c2-41ca-913e-d9072716578b",
        "shortName": "Grayback"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/advisories"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.grayback.es/en/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
            }
          ],
          "value": "This vulnerability has been patched in version 1.4.0-beta of Cervantes"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "BOLA Allows Cross-Project Target Tampering",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "772f0079-75c2-41ca-913e-d9072716578b",
    "assignerShortName": "Grayback",
    "cveId": "CVE-2026-115994",
    "datePublished": "2026-10-24T09:04:02.750Z",
    "dateReserved": "2026-10-24T08:56:03.942Z",
    "dateUpdated": "2026-11-02T14:03:51.629Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115804 (GCVE-0-2026-115804)

Vulnerability from cvelistv5 – Published: 2026-10-26 18:09 – Updated: 2026-10-26 19:38
VLAI
Title
Consul vulnerable to an authorization bypass in health check registration
Summary
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.
Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 18:53 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
HashiCorp CNA
References
Impacted products
Vendor Product Version
HashiCorp Consul Affected: 0.7.2 , < 2.1.0 (semver)
Create a notification for this product.
HashiCorp Consul Enterprise Affected: 0.7.2 , < 2.1.0 (semver)
Create a notification for this product.
Credits
This issue was reported to HashiCorp by Immad Sahin of ZeroTrail.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T18:53:55.561242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T19:38:28.416Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Consul",
          "repo": "https://github.com/hashicorp/consul",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Consul Enterprise",
          "repo": "https://github.com/hashicorp/consul",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.21.19",
                  "status": "unaffected"
                }
              ],
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0.7.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was reported to HashiCorp by Immad Sahin of ZeroTrail."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19.\u003c/p\u003e\u003cbr/\u003e"
            }
          ],
          "value": "HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T18:09:52.286Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2026-49-consul-vulnerable-to-an-authorization-bypass-in-health-check-registration/77914"
        }
      ],
      "source": {
        "advisory": "HCSEC-2026-49",
        "discovery": "EXTERNAL"
      },
      "title": "Consul vulnerable to an authorization bypass in health check registration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2026-115804",
    "datePublished": "2026-10-26T18:09:52.286Z",
    "dateReserved": "2026-10-23T15:53:43.970Z",
    "dateUpdated": "2026-10-26T19:38:28.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115803 (GCVE-0-2026-115803)

Vulnerability from cvelistv5 – Published: 2026-10-24 06:45 – Updated: 2026-10-26 17:41
VLAI
Title
Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
Summary
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 15:39 UTC
CWE
Assigner
VulDB CNA
References
URL Tags
https://vuldb.com/vuln/425987 vdb-entrytechnical-description
https://vuldb.com/vuln/425987/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-115803 third-party-advisory
https://vuldb.com/submit/916011 third-party-advisory
Impacted products
Vendor Product Version
n/a Scada-LTS Affected: 2.8.0
    cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*
Credits
LianAldrich (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115803",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T15:39:01.541165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:41:20.319Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:scada-lts:scada-lts:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "AmCharts Data API"
          ],
          "product": "Scada-LTS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "2.8.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "LianAldrich (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: \"At this moment we are working on new release with security enhancements which will be introduced to the community soon.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T06:45:07.253Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-425987 | Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/425987"
        },
        {
          "name": "VDB-425987 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/425987/cti"
        },
        {
          "name": "CVE-2026-115803 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-115803"
        },
        {
          "name": "Submit #916011 | Scada-LTS 2.8.0 Improper Authorization",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/916011"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-23T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-23T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-23T17:19:46.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-115803",
    "datePublished": "2026-10-24T06:45:07.253Z",
    "dateReserved": "2026-10-23T15:14:35.243Z",
    "dateUpdated": "2026-10-26T17:41:20.319Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115748 (GCVE-0-2026-115748)

Vulnerability from cvelistv5 – Published: 2026-10-26 15:01 – Updated: 2026-11-02 21:22 Unsupported When Assigned
VLAI
Title
Apache Vysper: Authorization bypass
Summary
**UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 21:22 UTC
CWE
  • CWE-639 - Authorization bypass through User-Controlled key
Assigner
apache CNA
References
Impacted products
Credits
Ho1aAs <xxy010605@gmail.com>
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-26T15:34:11.951Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/23/21"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115748",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T21:22:24.490980Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T21:22:43.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.vysper:vysper",
          "packageURL": "pkg:maven/org.apache.vysper/vysper",
          "product": "Apache Vysper",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "*",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ho1aAs \u003cxxy010605@gmail.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e**UNSUPPORTED WHEN ASSIGNED**\u0026nbsp;\u0026nbsp;Authorization bypass in Apache Vysper, all versions.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eApache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cspan\u003eAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.\u003c/span\u003e"
            }
          ],
          "value": "**UNSUPPORTED WHEN ASSIGNED**\u00a0\u00a0Authorization bypass in Apache Vysper, all versions.\n\n\n\n\nApache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.\n\n\n\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization bypass through User-Controlled key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T15:01:40.644Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "https://mina.apache.org/vysper-project/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/979n9lzg10vc7tdrrlgy4lh5yrsw8wsj"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "unsupported-when-assigned"
      ],
      "title": "Apache Vysper: Authorization bypass",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-115748",
    "datePublished": "2026-10-26T15:01:40.644Z",
    "dateReserved": "2026-10-23T12:48:46.471Z",
    "dateUpdated": "2026-11-02T21:22:43.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115725 (GCVE-0-2026-115725)

Vulnerability from cvelistv5 – Published: 2026-10-23 11:36 – Updated: 2026-10-29 02:48
VLAI
Title
Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
Summary
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:48 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
chatwoot chatwoot Affected: 0 , < 4.17.0 (semver)
    cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-19 05:04
Credits
GrayOM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115725",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T02:48:40.240317Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T02:48:49.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/chatwoot/chatwoot",
          "product": "chatwoot",
          "repo": "https://github.com/chatwoot/chatwoot",
          "vendor": "chatwoot",
          "versions": [
            {
              "lessThan": "4.17.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:chatwoot:chatwoot:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.17.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "GrayOM"
        }
      ],
      "datePublic": "2026-08-19T05:04:15.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account\u0027s source_id to create or retrieve conversations and post messages to that account\u0027s contacts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T11:36:48.394Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/chatwoot/chatwoot/pull/15521"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/chatwoot/chatwoot/commit/2d173978fcd64e6927b407c171095a3a7ceb03dd"
        },
        {
          "name": "chatwoot v4.17.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/chatwoot/chatwoot/releases/tag/v4.17.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/controllers/api/v1/accounts/conversations_controller.rb#L206-L213"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/chatwoot/chatwoot/blob/v4.16.2/app/policies/inbox_policy.rb#L22-L27"
        },
        {
          "name": "VulnCheck Advisory: Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/chatwoot-before-4.17.0-cross-account-authorization-bypass-via-source-id"
        }
      ],
      "title": "Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115725",
    "datePublished": "2026-10-23T11:36:48.394Z",
    "dateReserved": "2026-10-23T11:26:43.547Z",
    "dateUpdated": "2026-10-29T02:48:49.269Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list