Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2780 vulnerabilities reference this CWE, most recent first.
CVE-2026-114078 (GCVE-0-2026-114078)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-27 21:50
VLAI
EPSS
VEX
Title
Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup
Summary
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable actions through their own project's schedule route with a victim schedule friendlyId to destroy other organizations' IMPERATIVE cron schedules.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-27 21:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/triggerdotdev/trigger.dev/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/trigger-dev-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| triggerdotdev | trigger.dev |
Affected:
0 , < 4.5.6
(semver)
Unaffected: 4.5.6 (semver) |
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114078",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T21:49:15.370548Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T21:50:08.509Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-j4r3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/trigger.dev",
"product": "trigger.dev",
"vendor": "triggerdotdev",
"versions": [
{
"lessThan": "4.5.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.6",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CyberKareem"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations\u0027 schedules. Attackers can send delete or disable actions through their own project\u0027s schedule route with a victim schedule friendlyId to destroy other organizations\u0027 IMPERATIVE cron schedules."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:36:47.218Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h4pj-26m5-j4r3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-h4pj-26m5-j4r3"
},
{
"name": "VulnCheck Advisory: Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-organization-schedule-deletion-via-unscoped-friendlyid-lookup"
}
],
"title": "Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114078",
"datePublished": "2026-10-21T00:36:47.218Z",
"dateReserved": "2026-10-20T21:44:47.242Z",
"dateUpdated": "2026-10-27T21:50:08.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114077 (GCVE-0-2026-114077)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-22 17:44
VLAI
EPSS
VEX
Title
Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4
Summary
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 17:44 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/triggerdotdev/trigger.dev/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/trigger-dev-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| triggerdotdev | trigger.dev |
Affected:
0 , < 4.5.6
(semver)
Unaffected: 4.5.6 (semver) |
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114077",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T17:44:23.076826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T17:44:28.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-2gvw-9968-v578"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/trigger.dev",
"product": "trigger.dev",
"vendor": "triggerdotdev",
"versions": [
{
"lessThan": "4.5.6",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.6",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CyberKareem"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim\u0027s deployment ID to re-point that in-progress deployment at a worker in the attacker\u0027s environment."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:36:46.529Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2gvw-9968-v578)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-2gvw-9968-v578"
},
{
"name": "VulnCheck Advisory: Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/trigger-dev-before-4.5.6-cross-tenant-deployment-hijack-via-createdeploymentbackgroundworkerv4"
}
],
"title": "Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114077",
"datePublished": "2026-10-21T00:36:46.529Z",
"dateReserved": "2026-10-20T21:44:47.242Z",
"dateUpdated": "2026-10-22T17:44:28.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114068 (GCVE-0-2026-114068)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-27 21:45
VLAI
EPSS
VEX
Title
Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint
Summary
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-27 21:44 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/triggerdotdev/trigger.dev/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/trigger-dev-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| triggerdotdev | trigger.dev |
Affected:
0 , < 4.6.0
(semver)
Unaffected: 4.6.0 (semver) |
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114068",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T21:44:41.086546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T21:45:14.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xrp6-5fpv-4fxf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "trigger.dev",
"vendor": "triggerdotdev",
"versions": [
{
"lessThan": "4.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.6.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "sajdakabir"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:36:40.255Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xrp6-5fpv-4fxf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-xrp6-5fpv-4fxf"
},
{
"name": "VulnCheck Advisory: Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/trigger-dev-before-4.6.0-missing-authorization-via-waitpoint-token-wait-endpoint"
}
],
"title": "Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114068",
"datePublished": "2026-10-21T00:36:40.255Z",
"dateReserved": "2026-10-20T21:43:23.218Z",
"dateUpdated": "2026-10-27T21:45:14.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-114066 (GCVE-0-2026-114066)
Vulnerability from cvelistv5 – Published: 2026-10-21 00:36 – Updated: 2026-10-28 15:21
VLAI
EPSS
VEX
Title
Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints
Summary
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/triggerdotdev/trigger.dev/secu… | vendor-advisory |
| https://www.vulncheck.com/advisories/trigger-dev-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| triggerdotdev | trigger.dev |
Affected:
0 , < 4.7.0
(semver)
Unaffected: 4.7.0 (semver) |
Date Public
2026-10-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-114066",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T15:21:08.338431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T15:21:20.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "trigger.dev",
"vendor": "triggerdotdev",
"versions": [
{
"lessThan": "4.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Feldspar-AI-Agent"
}
],
"datePublic": "2026-10-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T00:36:38.884Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qwrm-2cq8-xfr8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-qwrm-2cq8-xfr8"
},
{
"name": "VulnCheck Advisory: Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/trigger-dev-before-4.7.0-missing-authorization-via-batch-parentrunid-waitpoints"
}
],
"title": "Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-114066",
"datePublished": "2026-10-21T00:36:38.884Z",
"dateReserved": "2026-10-20T21:43:23.218Z",
"dateUpdated": "2026-10-28T15:21:20.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113727 (GCVE-0-2026-113727)
Vulnerability from cvelistv5 – Published: 2026-10-20 21:08 – Updated: 2026-10-23 02:10
VLAI
EPSS
VEX
Title
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs
Summary
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 02:10 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
GitHub_M
CNA
References
12 references
| URL | Tags |
|---|---|
| https://github.com/openchoreo/openchoreo/security… | x_refsource_CONFIRM |
| https://github.com/openchoreo/openchoreo/pull/4596 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4618 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4626 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/pull/4627 | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/0… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/4… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/9… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/commit/d… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
| https://github.com/openchoreo/openchoreo/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openchoreo | openchoreo |
Affected:
>= 1.0.0, < 1.0.6
Affected: >= 1.1.0, < 1.1.7 Affected: >= 1.2.0, < 1.2.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113727",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T02:10:51.680790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T02:10:59.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "openchoreo",
"vendor": "openchoreo",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.6"
},
{
"status": "affected",
"version": "\u003e= 1.1.0, \u003c 1.1.7"
},
{
"status": "affected",
"version": "\u003e= 1.2.0, \u003c 1.2.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run\u0027s ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T21:08:37.372Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4596",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4596"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4618",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4618"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4626",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4626"
},
{
"name": "https://github.com/openchoreo/openchoreo/pull/4627",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/pull/4627"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14"
},
{
"name": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7"
},
{
"name": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"
}
],
"source": {
"advisory": "GHSA-46r4-q7wv-32fc",
"discovery": "UNKNOWN"
},
"title": "OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113727",
"datePublished": "2026-10-20T21:08:37.372Z",
"dateReserved": "2026-10-20T16:03:14.863Z",
"dateUpdated": "2026-10-23T02:10:59.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113702 (GCVE-0-2026-113702)
Vulnerability from cvelistv5 – Published: 2026-11-09 10:45 – Updated: 2026-11-09 13:59 X_Open Source
VLAI
EPSS
VEX
Title
iomad PDF Certificate lib.php local_iomad_pluginfile authorization
Summary
A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
Severity
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433093 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433093/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113702 | third-party-advisory |
| https://github.com/iomad/iomad/issues/2817 | issue-tracking |
| https://github.com/iomad/iomad/commit/66f7417c535… | patch |
| https://github.com/iomad/iomad/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | iomad |
Affected:
4.5.0
Affected: 4.5.1 Affected: 4.5.2 Affected: 4.5.3 Affected: 4.5.4 Affected: 4.5.5 Affected: 4.5.6 Affected: 4.5.7 Affected: 4.5.8 Affected: 4.5.9 Affected: 4.5.10 Affected: 4.5.11 Affected: 4.5.12 Affected: 4.5.13 Affected: 4.5.14 Affected: 4.5.15 Affected: 5.0.0 Affected: 5.0.1 Affected: 5.0.2 Affected: 5.0.3 Affected: 5.0.4 Affected: 5.0.5 Affected: 5.0.6 Affected: 5.0.7 Affected: 5.0.8 Affected: 5.0.9 Affected: 5.0.10 Affected: 5.0.11 Affected: 5.1.0 Affected: 5.1.1 Affected: 5.1.2 Affected: 5.1.3 Affected: 5.1.4 Affected: 5.1.5 Affected: 5.1.6 Affected: 5.1.7 Affected: 5.1.8 Affected: 5.2.0 Affected: 5.2.1 Affected: 5.2.2 Affected: 5.2.3 Affected: 5.2.4 cpe:2.3:a:iomad:iomad:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:iomad:iomad:*:*:*:*:*:*:*:*"
],
"modules": [
"PDF Certificate Handler"
],
"product": "iomad",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "4.5.0"
},
{
"status": "affected",
"version": "4.5.1"
},
{
"status": "affected",
"version": "4.5.2"
},
{
"status": "affected",
"version": "4.5.3"
},
{
"status": "affected",
"version": "4.5.4"
},
{
"status": "affected",
"version": "4.5.5"
},
{
"status": "affected",
"version": "4.5.6"
},
{
"status": "affected",
"version": "4.5.7"
},
{
"status": "affected",
"version": "4.5.8"
},
{
"status": "affected",
"version": "4.5.9"
},
{
"status": "affected",
"version": "4.5.10"
},
{
"status": "affected",
"version": "4.5.11"
},
{
"status": "affected",
"version": "4.5.12"
},
{
"status": "affected",
"version": "4.5.13"
},
{
"status": "affected",
"version": "4.5.14"
},
{
"status": "affected",
"version": "4.5.15"
},
{
"status": "affected",
"version": "5.0.0"
},
{
"status": "affected",
"version": "5.0.1"
},
{
"status": "affected",
"version": "5.0.2"
},
{
"status": "affected",
"version": "5.0.3"
},
{
"status": "affected",
"version": "5.0.4"
},
{
"status": "affected",
"version": "5.0.5"
},
{
"status": "affected",
"version": "5.0.6"
},
{
"status": "affected",
"version": "5.0.7"
},
{
"status": "affected",
"version": "5.0.8"
},
{
"status": "affected",
"version": "5.0.9"
},
{
"status": "affected",
"version": "5.0.10"
},
{
"status": "affected",
"version": "5.0.11"
},
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.1.1"
},
{
"status": "affected",
"version": "5.1.2"
},
{
"status": "affected",
"version": "5.1.3"
},
{
"status": "affected",
"version": "5.1.4"
},
{
"status": "affected",
"version": "5.1.5"
},
{
"status": "affected",
"version": "5.1.6"
},
{
"status": "affected",
"version": "5.1.7"
},
{
"status": "affected",
"version": "5.1.8"
},
{
"status": "affected",
"version": "5.2.0"
},
{
"status": "affected",
"version": "5.2.1"
},
{
"status": "affected",
"version": "5.2.2"
},
{
"status": "affected",
"version": "5.2.3"
},
{
"status": "affected",
"version": "5.2.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter de Haas (Augmentic)"
},
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The patch is identified as ac7427130865ce0ed80870813317c87ae3060fa4/7bf0b10199782e04aa579e9d516e473b164afd1c/db903abdcb3aba124cce670608ae6d7ba5f51a84/66f7417c5357b7575e39e8be390602156c1a1225. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T13:59:51.132Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433093 | iomad PDF Certificate lib.php local_iomad_pluginfile authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433093"
},
{
"name": "VDB-433093 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433093/cti"
},
{
"name": "CVE-2026-113702 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113702"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/iomad/iomad/issues/2817"
},
{
"tags": [
"patch"
],
"url": "https://github.com/iomad/iomad/commit/66f7417c5357b7575e39e8be390602156c1a1225"
},
{
"tags": [
"product"
],
"url": "https://github.com/iomad/iomad/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-16T14:38:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T12:45:49.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T15:04:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "iomad PDF Certificate lib.php local_iomad_pluginfile authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113702",
"datePublished": "2026-11-09T10:45:22.564Z",
"dateReserved": "2026-10-20T15:47:04.697Z",
"dateUpdated": "2026-11-09T13:59:51.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113665 (GCVE-0-2026-113665)
Vulnerability from cvelistv5 – Published: 2026-10-20 17:19 – Updated: 2026-10-28 13:57
VLAI
EPSS
VEX
Title
ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notification. This issue is fixed in version 4.33.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 13:57 UTC
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.33.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113665",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T13:57:36.942400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T13:57:53.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.33.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user\u0027s notification. This issue is fixed in version 4.33.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:19:56.123Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
}
],
"source": {
"advisory": "GHSA-vwwx-px9w-crrc",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113665",
"datePublished": "2026-10-20T17:19:56.123Z",
"dateReserved": "2026-10-20T14:27:46.641Z",
"dateUpdated": "2026-10-28T13:57:53.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113655 (GCVE-0-2026-113655)
Vulnerability from cvelistv5 – Published: 2026-10-20 16:38 – Updated: 2026-10-20 17:19
VLAI
EPSS
VEX
Title
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue is fixed in version 4.33.0.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 17:18 UTC
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.33.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113655",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T17:18:06.145633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:19:00.773Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2jrp-qc93-h2j8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.33.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibling ranks without create authorization on that parent. The non-default nesting must already exist, and the bypass is limited to sibling ordering rather than arbitrary content modification, confidentiality loss, or creation of the restricted nesting. This issue is fixed in version 4.33.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:38:27.002Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2jrp-qc93-h2j8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2jrp-qc93-h2j8"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
}
],
"source": {
"advisory": "GHSA-2jrp-qc93-h2j8",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent\u0027s children without create authorization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-113655",
"datePublished": "2026-10-20T16:38:27.002Z",
"dateReserved": "2026-10-20T14:27:46.641Z",
"dateUpdated": "2026-10-20T17:19:00.773Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113643 (GCVE-0-2026-113643)
Vulnerability from cvelistv5 – Published: 2026-10-20 18:15 – Updated: 2026-10-20 18:45 X_Open Source
VLAI
EPSS
VEX
Title
EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
Summary
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 18:44 UTC
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422794 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422794/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113643 | third-party-advisory |
| https://vuldb.com/submit/1010801 | third-party-advisory |
| https://github.com/espocrm/espocrm/security/advis… | exploit |
| https://github.com/espocrm/espocrm/security/advis… | broken-linkexploit |
| https://github.com/espocrm/espocrm/commit/91a9edb… | exploitpatch |
| https://github.com/espocrm/espocrm/ | exploitproduct |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | EspoCRM |
Affected:
9.3.0
Affected: 9.3.1 Affected: 9.3.2 Affected: 9.3.3 Affected: 9.3.4 Affected: 9.3.5 Affected: 9.3.6 Affected: 9.3.7 Affected: 9.3.8 Affected: 9.3.9 Affected: 9.3.10 Affected: 10.0.0 Affected: 10.0.1 Affected: 10.0.2 Affected: 10.0.3 Affected: 10.0.4 Affected: 10.0.5 Affected: 10.0.6 Affected: 10.0.7 Affected: 10.0.8 Affected: 10.0.9 Affected: 10.0.10 cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113643",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T18:44:37.586697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:45:14.681Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*"
],
"modules": [
"PDF Rendering Pipeline"
],
"product": "EspoCRM",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "9.3.0"
},
{
"status": "affected",
"version": "9.3.1"
},
{
"status": "affected",
"version": "9.3.2"
},
{
"status": "affected",
"version": "9.3.3"
},
{
"status": "affected",
"version": "9.3.4"
},
{
"status": "affected",
"version": "9.3.5"
},
{
"status": "affected",
"version": "9.3.6"
},
{
"status": "affected",
"version": "9.3.7"
},
{
"status": "affected",
"version": "9.3.8"
},
{
"status": "affected",
"version": "9.3.9"
},
{
"status": "affected",
"version": "9.3.10"
},
{
"status": "affected",
"version": "10.0.0"
},
{
"status": "affected",
"version": "10.0.1"
},
{
"status": "affected",
"version": "10.0.2"
},
{
"status": "affected",
"version": "10.0.3"
},
{
"status": "affected",
"version": "10.0.4"
},
{
"status": "affected",
"version": "10.0.5"
},
{
"status": "affected",
"version": "10.0.6"
},
{
"status": "affected",
"version": "10.0.7"
},
{
"status": "affected",
"version": "10.0.8"
},
{
"status": "affected",
"version": "10.0.9"
},
{
"status": "affected",
"version": "10.0.10"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "spoo1k (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The patch is named 91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2. It is suggested to install a patch to address this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:15:12.276Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422794 | EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422794"
},
{
"name": "VDB-422794 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422794/cti"
},
{
"name": "CVE-2026-113643 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113643"
},
{
"name": "Submit #1010801 | EspoCRM 10.0.9 Improper Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1010801"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-r277-qh74-r86f"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/espocrm/espocrm/security/advisories/GHSA-w46f-mj7x-v5c6"
},
{
"tags": [
"exploit",
"patch"
],
"url": "https://github.com/espocrm/espocrm/commit/91a9edbcedb9c7aa8e3d3ac81d8a7acccb99bca2"
},
{
"tags": [
"exploit",
"product"
],
"url": "https://github.com/espocrm/espocrm/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T15:58:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113643",
"datePublished": "2026-10-20T18:15:12.276Z",
"dateReserved": "2026-10-20T13:53:10.882Z",
"dateUpdated": "2026-10-20T18:45:14.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113610 (GCVE-0-2026-113610)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-20 18:19
VLAI
EPSS
VEX
Title
Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
Summary
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 18:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/vatesfr/xen-orchestra/security… | vendor-advisory |
| https://github.com/vatesfr/xen-orchestra/commit/3… | patch |
| https://github.com/vatesfr/xen-orchestra/blob/f18… | technical-description |
| https://www.vulncheck.com/advisories/xen-orchestr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vatesfr | xen-orchestra |
Affected:
0 , < 6.9.0
(semver)
cpe:2.3:a:xen-orchestra:xen_orchestra_server:*:*:*:*:*:*:*:* |
Date Public
2026-09-30 08:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T18:19:42.474708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T18:19:50.195Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/vatesfr/xen-orchestra",
"product": "xen-orchestra",
"repo": "https://github.com/vatesfr/xen-orchestra",
"vendor": "vatesfr",
"versions": [
{
"lessThan": "6.9.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xen-orchestra:xen_orchestra_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Allan Victor"
}
],
"datePublic": "2026-09-30T08:30:12.000Z",
"descriptions": [
{
"lang": "en",
"value": "Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users\u0027 preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disable two-factor authentication, corrupt it to block logins, or overwrite stored xsCredentials and sshKeys."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:35.476Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mc4m-hc98-rhmv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/vatesfr/xen-orchestra/security/advisories/GHSA-mc4m-hc98-rhmv"
},
{
"tags": [
"patch"
],
"url": "https://github.com/vatesfr/xen-orchestra/commit/3dbf8738f1e682b96ade2074dc84bee02a0c2d48"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/vatesfr/xen-orchestra/blob/f187b7931988e3e5c9ccd58abe730d6b006cc246/packages/xo-server/src/api/user.mjs#L73-L93"
},
{
"name": "VulnCheck Advisory: Xen Orchestra before 6.9.0 Authorization Bypass via user.set API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/xen-orchestra-before-6.9.0-authorization-bypass-via-user-set-api"
}
],
"title": "Xen Orchestra before 6.9.0 Authorization Bypass via user.set API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113610",
"datePublished": "2026-10-20T15:40:35.476Z",
"dateReserved": "2026-10-20T11:49:07.404Z",
"dateUpdated": "2026-10-20T18:19:50.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.