Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2780 vulnerabilities reference this CWE, most recent first.
CVE-2026-115706 (GCVE-0-2026-115706)
Vulnerability from cvelistv5 – Published: 2026-10-29 14:09 – Updated: 2026-10-30 17:18
VLAI
EPSS
VEX
Title
Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation
Summary
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 03:56 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
elastic
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Elastic | Elastic Cloud Enterprise |
Affected:
1.0.0 , ≤ 3.8.5
(semver)
Affected: 4.0.0 , ≤ 4.2.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115706",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T03:56:15.368437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:18:29.029Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Elastic Cloud Enterprise",
"vendor": "Elastic",
"versions": [
{
"lessThanOrEqual": "3.8.5",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.2.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.\u003c/p\u003e"
}
],
"value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T14:09:58.330Z",
"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"shortName": "elastic"
},
"references": [
{
"url": "https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-6-and-4-2-1-security-update-esa-2026-211/391260"
}
],
"source": {
"discovery": "Elastic"
},
"title": "Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation",
"x_generator": {
"engine": "Elastic CVE Publisher 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"assignerShortName": "elastic",
"cveId": "CVE-2026-115706",
"datePublished": "2026-10-29T14:09:58.330Z",
"dateReserved": "2026-10-23T11:09:45.804Z",
"dateUpdated": "2026-10-30T17:18:29.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115453 (GCVE-0-2026-115453)
Vulnerability from cvelistv5 – Published: 2026-10-22 15:22 – Updated: 2026-10-30 18:49 X_Open Source
VLAI
EPSS
VEX
Title
Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries
Summary
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:48 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Secur0
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/MarcosCamara01/ecommerce-templ… | patch |
| https://secur0.com/en/cna/cve-list/cve-2026-11545… | third-party-advisorytechnical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MarcosCamara01 | Ecommerce Template |
Affected:
b139a11c7bfab82b9c54c738b9a5d6015b439972 , < adf7dedbb41894c0bad0b33a26999b0da7e967b7
(git)
cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T18:48:53.638694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:49:27.205Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:marcoscamara01:ecommerce-template:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "Ecommerce Template",
"programFiles": [
"src/lib/db/drizzle/repositories/cart.repository.ts",
"src/lib/db/drizzle/repositories/wishlist.repository.ts",
"src/lib/db/drizzle/connection.ts"
],
"repo": "https://github.com/MarcosCamara01/ecommerce-template",
"vendor": "MarcosCamara01",
"versions": [
{
"lessThan": "adf7dedbb41894c0bad0b33a26999b0da7e967b7",
"status": "affected",
"version": "b139a11c7bfab82b9c54c738b9a5d6015b439972",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dar\u00edo Rivas"
},
{
"lang": "en",
"type": "finder",
"value": "Gerard Martinez Guillamon"
},
{
"lang": "en",
"type": "analyst",
"value": "Cristian Fern\u00e1ndez Cornejo"
},
{
"lang": "en",
"type": "analyst",
"value": "Xo\u00e1n M. Otero Jorge"
},
{
"lang": "en",
"type": "coordinator",
"value": "Secur0 CNA"
},
{
"lang": "en",
"type": "remediation developer",
"value": "MarcosCamara01"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because \u003ccode\u003ecartRepository.delete()\u003c/code\u003e, \u003ccode\u003ecartRepository.updateQuantityInternal()\u003c/code\u003e and \u003ccode\u003ewishlistRepository.delete()\u003c/code\u003e in \u003ccode\u003esrc/lib/db/drizzle/repositories/\u003c/code\u003e match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run \u003ccode\u003eALTER TABLE ... ENABLE ROW LEVEL SECURITY\u003c/code\u003e and create policies comparing \u003ccode\u003eapp.current_user_id()\u003c/code\u003e with \u003ccode\u003euser_id\u003c/code\u003e, but never \u003ccode\u003eALTER TABLE ... FORCE ROW LEVEL SECURITY\u003c/code\u003e, and PostgreSQL does not apply policies to the role that owns a table. The template uses one \u003ccode\u003eDATABASE_URL\u003c/code\u003e both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. \u003ccode\u003ecart_items.id\u003c/code\u003e and \u003ccode\u003ewishlist.id\u003c/code\u003e are sequential \u003ccode\u003ebigserial\u003c/code\u003e values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation."
}
],
"value": "Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() in src/lib/db/drizzle/repositories/ match rows by primary key alone, with no predicate on the owning user, and the per user authorization for those three operations rests on PostgreSQL row level security. The migrations run ALTER TABLE ... ENABLE ROW LEVEL SECURITY and create policies comparing app.current_user_id() with user_id, but never ALTER TABLE ... FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the role that owns a table. The template uses one DATABASE_URL both to run the migrations, which create the tables, and for the application at runtime, so the application connects as the owner of the tables and the policies do not apply to it. cart_items.id and wishlist.id are sequential bigserial values, so the identifiers of rows belonging to other users can be enumerated, and the update path returns the modified row, which carries the identifier of the user it belongs to. This results in the destruction and modification of cart and wishlist contents belonging to other accounts of the installation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T11:11:04.861Z",
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MarcosCamara01/ecommerce-template/commit/adf7dedbb41894c0bad0b33a26999b0da7e967b7"
},
{
"tags": [
"third-party-advisory",
"technical-description"
],
"url": "https://secur0.com/en/cna/cve-list/cve-2026-115453-cross-user-cart-wishlist-idor"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update to a revision of the repository that includes commit \u003ccode\u003eadf7dedbb41894c0bad0b33a26999b0da7e967b7\u003c/code\u003e of 27 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit."
}
],
"value": "Update to a revision of the repository that includes commit adf7dedbb41894c0bad0b33a26999b0da7e967b7 of 27 July 2026. The repository publishes no versioned releases and carries no git tags, so the fix can only be identified by commit."
}
],
"source": {
"discovery": "INTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"assignerShortName": "Secur0",
"cveId": "CVE-2026-115453",
"datePublished": "2026-10-22T15:22:09.445Z",
"dateReserved": "2026-10-22T14:49:43.872Z",
"dateUpdated": "2026-10-30T18:49:27.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115334 (GCVE-0-2026-115334)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-11-04 20:59
VLAI
EPSS
VEX
Title
Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
Summary
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:59 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@leediay/BkUc3WL2Mx | technical-description |
| https://github.com/uselotus/lotus/blob/0.10.2/bac… | technical-description |
| https://github.com/uselotus/lotus | product |
| https://www.vulncheck.com/advisories/lotus-throug… | third-party-advisory |
Date Public
2026-07-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115334",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:59:48.681026Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:59:55.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/uselotus/lotus",
"product": "lotus",
"vendor": "uselotus",
"versions": [
{
"lessThanOrEqual": "0.10.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-07-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization\u0027s UUID can send a POST request to /app/switch_organization/ to access that tenant\u0027s data and billing configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:50.195Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@leediay/BkUc3WL2Mx"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/views/views.py#L326-L340"
},
{
"tags": [
"product"
],
"url": "https://github.com/uselotus/lotus"
},
{
"name": "VulnCheck Advisory: Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-authorization-bypass-via-switch-organization-endpoint"
}
],
"title": "Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115334",
"datePublished": "2026-10-22T10:57:50.195Z",
"dateReserved": "2026-10-22T10:37:08.370Z",
"dateUpdated": "2026-11-04T20:59:55.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115329 (GCVE-0-2026-115329)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-23 15:04
VLAI
EPSS
VEX
Title
Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Summary
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/uselotus/lotus/issues/799 | issue-tracking |
| https://github.com/uselotus/lotus/pull/802 | patchissue-tracking |
| https://github.com/uselotus/lotus/commit/1375d514… | patch |
| https://github.com/uselotus/lotus/blob/0.10.2/bac… | technical-description |
| https://github.com/uselotus/lotus | product |
| https://www.vulncheck.com/advisories/lotus-throug… | third-party-advisory |
Date Public
2026-07-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115329",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:15.604957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T15:04:20.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/uselotus/lotus",
"product": "lotus",
"vendor": "uselotus",
"versions": [
{
"lessThanOrEqual": "0.10.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212 (Lighthouse Research Project)"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-07-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization\u0027s subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant\u0027s billing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:46.708Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/uselotus/lotus/issues/799"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/uselotus/lotus/pull/802"
},
{
"tags": [
"patch"
],
"url": "https://github.com/uselotus/lotus/commit/1375d5140795d72251c89f47200879b9bd1d6d96"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/uselotus/lotus/blob/0.10.2/backend/api/views.py#L754"
},
{
"tags": [
"product"
],
"url": "https://github.com/uselotus/lotus"
},
{
"name": "VulnCheck Advisory: Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lotus-through-0.10.2-cross-organization-idor-via-subscriptionviewset"
}
],
"title": "Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115329",
"datePublished": "2026-10-22T10:57:46.708Z",
"dateReserved": "2026-10-22T10:37:07.682Z",
"dateUpdated": "2026-10-23T15:04:20.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115326 (GCVE-0-2026-115326)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-11-04 17:25
VLAI
EPSS
VEX
Title
QloApps through 1.7.0 IDOR via OrderDetailController Refund Request
Summary
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:25 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qloapps/QloApps/pull/1930 | patchissue-tracking |
| https://github.com/Qloapps/QloApps/commit/105241f… | patch |
| https://github.com/Qloapps/QloApps/blob/v1.7.0/co… | technical-description |
| https://github.com/Qloapps/QloApps | product |
| https://www.vulncheck.com/advisories/qloapps-thro… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:25:12.614614Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:25:21.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Qloapps/QloApps",
"product": "QloApps",
"vendor": "Webkul",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webkul:qloapps:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Chu Hoang Cuong"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers\u0027 service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims\u0027 service lines, and corrupt refund quantities."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:44.551Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/Qloapps/QloApps/pull/1930"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Qloapps/QloApps/commit/105241f9a77e94b30d6c2d577d14b247f33a5fba"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Qloapps/QloApps/blob/v1.7.0/controllers/front/OrderDetailController.php#L624-L631"
},
{
"tags": [
"product"
],
"url": "https://github.com/Qloapps/QloApps"
},
{
"name": "VulnCheck Advisory: QloApps through 1.7.0 IDOR via OrderDetailController Refund Request",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/qloapps-through-1.7.0-idor-via-orderdetailcontroller-refund-request"
}
],
"title": "QloApps through 1.7.0 IDOR via OrderDetailController Refund Request",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115326",
"datePublished": "2026-10-22T10:57:44.551Z",
"dateReserved": "2026-10-22T10:37:07.284Z",
"dateUpdated": "2026-11-04T17:25:21.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115325 (GCVE-0-2026-115325)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-23 15:05
VLAI
EPSS
VEX
Title
Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup
Summary
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:54 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/gravitl/netmaker/issues/3875 | issue-tracking |
| https://github.com/gravitl/netmaker/pull/4153 | patchissue-tracking |
| https://github.com/gravitl/netmaker/commit/332d8b… | patch |
| https://github.com/gravitl/netmaker/blob/v1.7.0/c… | technical-description |
| https://github.com/gravitl/netmaker | product |
| https://www.vulncheck.com/advisories/netmaker-thr… | third-party-advisory |
Impacted products
Date Public
2026-02-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115325",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:54:19.333170Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T15:05:01.043Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/gravitl/netmaker",
"product": "netmaker",
"vendor": "gravitl",
"versions": [
{
"lessThanOrEqual": "1.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212 (Lighthouse Research Project)"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:43.846Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/gravitl/netmaker/issues/3875"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/gravitl/netmaker/pull/4153"
},
{
"tags": [
"patch"
],
"url": "https://github.com/gravitl/netmaker/commit/332d8b9bab030ee65e78b9141259e4e0e80ac4b0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gravitl/netmaker/blob/v1.7.0/controllers/ext_client.go#L879"
},
{
"tags": [
"product"
],
"url": "https://github.com/gravitl/netmaker"
},
{
"name": "VulnCheck Advisory: Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/netmaker-through-1.7.0-authorization-bypass-via-updateextclient-unscoped-lookup"
}
],
"title": "Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115325",
"datePublished": "2026-10-22T10:57:43.846Z",
"dateReserved": "2026-10-22T10:37:07.151Z",
"dateUpdated": "2026-10-23T15:05:01.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115322 (GCVE-0-2026-115322)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-11-05 17:28
VLAI
EPSS
VEX
Title
Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers
Summary
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 17:28 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/bytebase/bytebase/issues/19369 | issue-tracking |
| https://github.com/bytebase/bytebase/pull/19554 | patchissue-tracking |
| https://github.com/bytebase/bytebase/commit/bb553… | patch |
| https://github.com/bytebase/bytebase/releases/tag… | release-notes |
| https://github.com/bytebase/bytebase/blob/3.15.1/… | technical-description |
| https://github.com/bytebase/bytebase | product |
| https://www.vulncheck.com/advisories/bytebase-bef… | third-party-advisory |
Impacted products
Date Public
2026-03-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115322",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T17:28:06.649361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:28:19.503Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/bytebase/bytebase",
"product": "bytebase",
"vendor": "bytebase",
"versions": [
{
"lessThan": "3.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.16.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bytebase:bytebase:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212 (Lighthouse Research Project)"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-03-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects\u0027 task runs by UID. Attackers with permission on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:41.716Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/bytebase/bytebase/issues/19369"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/bytebase/bytebase/pull/19554"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bytebase/bytebase/commit/bb553e8423b38c826cd7b1da5c7117080cc8705d"
},
{
"name": "3.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/bytebase/bytebase/releases/tag/3.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/rollout_service.go#L505"
},
{
"tags": [
"product"
],
"url": "https://github.com/bytebase/bytebase"
},
{
"name": "VulnCheck Advisory: Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-rollout-service-task-run-handlers"
}
],
"title": "Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115322",
"datePublished": "2026-10-22T10:57:41.716Z",
"dateReserved": "2026-10-22T10:37:06.741Z",
"dateUpdated": "2026-11-05T17:28:19.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115321 (GCVE-0-2026-115321)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-23 15:05
VLAI
EPSS
VEX
Title
Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment
Summary
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project's issue as parent and reference another project's comment UID to overwrite comments they cannot access.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/bytebase/bytebase/issues/19369 | issue-tracking |
| https://github.com/bytebase/bytebase/pull/19552 | patchissue-tracking |
| https://github.com/bytebase/bytebase/commit/270e2… | patch |
| https://github.com/bytebase/bytebase/releases/tag… | release-notes |
| https://github.com/bytebase/bytebase/blob/3.15.1/… | technical-description |
| https://github.com/bytebase/bytebase | product |
| https://www.vulncheck.com/advisories/bytebase-bef… | third-party-advisory |
Impacted products
Date Public
2026-03-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115321",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:48:14.004741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T15:05:29.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/bytebase/bytebase",
"product": "bytebase",
"vendor": "bytebase",
"versions": [
{
"lessThan": "3.16.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.16.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bytebase:bytebase:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212 (Lighthouse Research Project)"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-03-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including Project Viewer, can set their own project\u0027s issue as parent and reference another project\u0027s comment UID to overwrite comments they cannot access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:40.982Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/bytebase/bytebase/issues/19369"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/bytebase/bytebase/pull/19552"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bytebase/bytebase/commit/270e25529731b59988b58f4a4b3bda431c748bc9"
},
{
"name": "3.16.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/bytebase/bytebase/releases/tag/3.16.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/bytebase/bytebase/blob/3.15.1/backend/api/v1/issue_service.go#L1116"
},
{
"tags": [
"product"
],
"url": "https://github.com/bytebase/bytebase"
},
{
"name": "VulnCheck Advisory: Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bytebase-before-3.16.0-authorization-bypass-via-updateissuecomment"
}
],
"title": "Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115321",
"datePublished": "2026-10-22T10:57:40.982Z",
"dateReserved": "2026-10-22T10:37:06.605Z",
"dateUpdated": "2026-10-23T15:05:29.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115295 (GCVE-0-2026-115295)
Vulnerability from cvelistv5 – Published: 2026-11-03 16:44 – Updated: 2026-11-03 17:32
VLAI
EPSS
VEX
Title
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
Summary
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:32 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
elastic
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:32:29.152720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:32:42.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kibana",
"vendor": "Elastic",
"versions": [
{
"lessThanOrEqual": "8.19.23",
"status": "affected",
"version": "8.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.8",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.5",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.\u003c/p\u003e"
}
],
"value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:44:06.555Z",
"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"shortName": "elastic"
},
"references": [
{
"url": "https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-206/391360"
}
],
"source": {
"discovery": "Elastic"
},
"title": "Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure",
"x_generator": {
"engine": "Elastic CVE Publisher 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"assignerShortName": "elastic",
"cveId": "CVE-2026-115295",
"datePublished": "2026-11-03T16:44:06.555Z",
"dateReserved": "2026-10-22T09:42:41.199Z",
"dateUpdated": "2026-11-03T17:32:42.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115292 (GCVE-0-2026-115292)
Vulnerability from cvelistv5 – Published: 2026-11-03 16:44 – Updated: 2026-11-03 17:34
VLAI
EPSS
VEX
Title
Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure
Summary
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:34 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
elastic
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:34:15.868921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:34:27.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kibana",
"vendor": "Elastic",
"versions": [
{
"lessThanOrEqual": "8.19.23",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.8",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.5",
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.\u003c/p\u003e"
}
],
"value": "Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:44:01.388Z",
"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"shortName": "elastic"
},
"references": [
{
"url": "https://discuss.elastic.co/t/kibana-8-19-24-9-4-9-9-5-6-security-update-esa-2026-203/391357"
}
],
"source": {
"discovery": "Elastic"
},
"title": "Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure",
"x_generator": {
"engine": "Elastic CVE Publisher 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"assignerShortName": "elastic",
"cveId": "CVE-2026-115292",
"datePublished": "2026-11-03T16:44:01.388Z",
"dateReserved": "2026-10-22T09:42:41.198Z",
"dateUpdated": "2026-11-03T17:34:27.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.