Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2780 vulnerabilities reference this CWE, most recent first.
CVE-2026-113606 (GCVE-0-2026-113606)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-23 01:46
VLAI
EPSS
VEX
Title
Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
Summary
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 01:45 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/abraxas/stirling-storage-folder-idor | exploittechnical-description |
| https://abraxaslabs.tech/research/stirling-storag… | technical-description |
| https://abraxaslabs.tech/research/stirling-pdf-3.… | technical-description |
| https://github.com/Stirling-Tools/Stirling-PDF/bl… | technical-description |
| https://github.com/Stirling-Tools/Stirling-PDF/bl… | technical-description |
| https://www.vulncheck.com/advisories/stirling-pdf… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Stirling-Tools | Stirling-PDF |
Affected:
3.0.0 , ≤ 3.2.0
(semver)
cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:* |
Date Public
2026-10-17 23:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113606",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T01:45:56.083130Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T01:46:06.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Stirling-Tools/Stirling-PDF",
"product": "Stirling-PDF",
"repo": "https://github.com/Stirling-Tools/Stirling-PDF",
"vendor": "Stirling-Tools",
"versions": [
{
"lessThanOrEqual": "3.2.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:stirling:stirling_pdf:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.2.0",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-17T23:55:18.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users\u0027 stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/\u003cvictimUserId\u003e, list files, and run pipelines to read, modify, or destroy victims\u0027 files."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:32.691Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit",
"technical-description"
],
"url": "https://github.com/abraxas/stirling-storage-folder-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/stirling-storage-folder-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftovers"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ProcessingFolderController.java"
},
{
"name": "VulnCheck Advisory: Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/stirling-pdf-3.0.0-through-3.2.0-authorization-bypass-via-processing-folders"
}
],
"title": "Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113606",
"datePublished": "2026-10-20T15:40:32.691Z",
"dateReserved": "2026-10-20T11:48:58.244Z",
"dateUpdated": "2026-10-23T01:46:06.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113603 (GCVE-0-2026-113603)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-21 15:54
VLAI
EPSS
VEX
Title
x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
Summary
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:40 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/x402-foundation/x402/issues/3838 | issue-tracking |
| https://github.com/x402-foundation/x402/pull/3840 | patchissue-tracking |
| https://github.com/x402-foundation/x402/blob/npm-… | technical-description |
| https://github.com/x402-foundation/x402/blob/pypi… | technical-description |
| https://github.com/x402-foundation/x402/blob/go/v… | technical-description |
| https://www.vulncheck.com/advisories/x402-x402-ex… | third-party-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| x402-foundation | @x402/extensions |
Affected:
2.3.1 , ≤ 2.28.0
(semver)
|
|
| x402-foundation | x402 |
Affected:
2.11.0 , ≤ 2.25.0
(semver)
|
|
| x402-foundation | github.com/x402-foundation/x402/go/v2 |
Affected:
2.16.0 , ≤ 2.28.0
(semver)
|
Date Public
2026-10-17 12:38
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:40:26.284069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:54:28.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40x402/extensions",
"product": "@x402/extensions",
"repo": "https://github.com/x402-foundation/x402",
"vendor": "x402-foundation",
"versions": [
{
"lessThanOrEqual": "2.28.0",
"status": "affected",
"version": "2.3.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/x402",
"product": "x402",
"repo": "https://github.com/x402-foundation/x402",
"vendor": "x402-foundation",
"versions": [
{
"lessThanOrEqual": "2.25.0",
"status": "affected",
"version": "2.11.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/x402-foundation/x402/go/v2",
"product": "github.com/x402-foundation/x402/go/v2",
"repo": "https://github.com/x402-foundation/x402",
"vendor": "x402-foundation",
"versions": [
{
"lessThanOrEqual": "2.28.0",
"status": "affected",
"version": "2.16.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CBF, Lza"
}
],
"datePublic": "2026-10-17T12:38:29.000Z",
"descriptions": [
{
"lang": "en",
"value": "The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a mismatched PaymentPayload.resource URL. Attackers can pay for the cheapest SIWX-protected route while setting resource.url to an expensive route, then repeatedly access it using only a SIGN-IN-WITH-X header without further payment."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:30.742Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/x402-foundation/x402/issues/3838"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/x402-foundation/x402/pull/3840"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/x402-foundation/x402/blob/npm-@x402/extensions@v2.28.0/typescript/packages/extensions/src/sign-in-with-x/hooks.ts"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/x402-foundation/x402/blob/pypi-x402@v2.25.0/python/x402/extensions/sign_in_with_x/hooks.py"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/x402-foundation/x402/blob/go/v2.28.0/go/extensions/signinwithx/server.go"
},
{
"name": "VulnCheck Advisory: x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/x402-x402-extensions-2.3.1-through-2.28.0-siwx-payment-bypass-via-paymentpayload-resource"
}
],
"title": "x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113603",
"datePublished": "2026-10-20T15:40:30.742Z",
"dateReserved": "2026-10-20T11:48:49.343Z",
"dateUpdated": "2026-10-21T15:54:28.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113600 (GCVE-0-2026-113600)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-23 13:53
VLAI
EPSS
VEX
Title
Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy
Summary
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 13:53 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/fatfreecrm/fat_free_crm/issues/1650 | issue-tracking |
| https://github.com/fatfreecrm/fat_free_crm/commit… | patch |
| https://github.com/fatfreecrm/fat_free_crm/releas… | release-notes |
| https://github.com/fatfreecrm/fat_free_crm/blob/v… | technical-description |
| https://www.vulncheck.com/advisories/fat-free-crm… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fatfreecrm | fat_free_crm |
Affected:
0 , < 0.26.0
(semver)
cpe:2.3:a:fatfreecrm:fat_free_crm:*:*:*:*:*:*:*:* |
Date Public
2026-02-27 16:47
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T13:53:17.647033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:53:31.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:gem/fat_free_crm",
"product": "fat_free_crm",
"repo": "https://github.com/fatfreecrm/fat_free_crm",
"vendor": "fatfreecrm",
"versions": [
{
"lessThan": "0.26.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fatfreecrm:fat_free_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.26.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-27T16:47:14.000Z",
"descriptions": [
{
"lang": "en",
"value": "Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users\u0027 comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization checks. Attackers can send PUT or DELETE requests to /comments/:id with enumerable sequential IDs to edit or delete comments on contacts, accounts, leads, and opportunities owned by others."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:28.303Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/fatfreecrm/fat_free_crm/issues/1650"
},
{
"tags": [
"patch"
],
"url": "https://github.com/fatfreecrm/fat_free_crm/commit/3c3199328dd10414b1f039ab8e4a82fe0f3baf87"
},
{
"name": "fat_free_crm v0.26.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/fatfreecrm/fat_free_crm/releases/tag/v0.26.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/fatfreecrm/fat_free_crm/blob/v0.25.0/app/controllers/comments_controller.rb"
},
{
"name": "VulnCheck Advisory: Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fat-free-crm-before-0.26.0-idor-via-commentscontroller-update-and-destroy"
}
],
"title": "Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113600",
"datePublished": "2026-10-20T15:40:28.303Z",
"dateReserved": "2026-10-20T11:48:48.267Z",
"dateUpdated": "2026-10-23T13:53:31.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113599 (GCVE-0-2026-113599)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-20 16:19
VLAI
EPSS
VEX
Title
Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
Summary
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims' settings or break their auto-reply management via MultipleObjectsReturned errors.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/modoboa/modoboa/issues/3945 | issue-tracking |
| https://github.com/modoboa/modoboa/commit/e0a4e3b… | patch |
| https://github.com/modoboa/modoboa/releases/tag/2.8.0 | release-notes |
| https://github.com/modoboa/modoboa/blob/2.7.2/mod… | technical-description |
| https://www.vulncheck.com/advisories/modoboa-befo… | third-party-advisory |
Impacted products
Date Public
2026-02-25 19:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:19:12.124795Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:19:21.574Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/modoboa",
"product": "modoboa",
"repo": "https://github.com/modoboa/modoboa",
"vendor": "modoboa",
"versions": [
{
"lessThan": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:modoboa:modoboa:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-25T19:34:33.000Z",
"descriptions": [
{
"lang": "en",
"value": "Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user\u0027s mbox value. Attackers can POST to /api/v2/armessages/ to inject attacker-controlled auto-reply subject and content into victims\u0027 settings or break their auto-reply management via MultipleObjectsReturned errors."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:27.636Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/modoboa/modoboa/issues/3945"
},
{
"tags": [
"patch"
],
"url": "https://github.com/modoboa/modoboa/commit/e0a4e3b9ee8ad84dba46e4c0f04cbbe7cf78c38d"
},
{
"name": "modoboa 2.8.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/modoboa/modoboa/releases/tag/2.8.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/modoboa/modoboa/blob/2.7.2/modoboa/autoreply/api/v2/serializers.py"
},
{
"name": "VulnCheck Advisory: Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/modoboa-before-2.8.0-idor-via-api-v2-armessages-auto-reply-creation"
}
],
"title": "Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113599",
"datePublished": "2026-10-20T15:40:27.636Z",
"dateReserved": "2026-10-20T11:48:47.917Z",
"dateUpdated": "2026-10-20T16:19:21.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113598 (GCVE-0-2026-113598)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-21 15:54
VLAI
EPSS
VEX
Title
Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
Summary
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:24 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/modoboa/modoboa/issues/3945 | issue-tracking |
| https://github.com/modoboa/modoboa/commit/e0a4e3b… | patch |
| https://github.com/modoboa/modoboa/releases/tag/2.8.0 | release-notes |
| https://github.com/modoboa/modoboa/blob/2.7.2/mod… | technical-description |
| https://www.vulncheck.com/advisories/modoboa-befo… | third-party-advisory |
Impacted products
Date Public
2026-02-25 19:34
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:24:26.921865Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:54:34.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/modoboa",
"product": "modoboa",
"repo": "https://github.com/modoboa/modoboa",
"vendor": "modoboa",
"versions": [
{
"lessThan": "2.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:modoboa:modoboa:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-25T19:34:33.000Z",
"descriptions": [
{
"lang": "en",
"value": "Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms server-wide, hiding problems from responsible administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:26.960Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/modoboa/modoboa/issues/3945"
},
{
"tags": [
"patch"
],
"url": "https://github.com/modoboa/modoboa/commit/e0a4e3b9ee8ad84dba46e4c0f04cbbe7cf78c38d"
},
{
"name": "modoboa 2.8.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/modoboa/modoboa/releases/tag/2.8.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/modoboa/modoboa/blob/2.7.2/modoboa/admin/api/v2/viewsets.py"
},
{
"name": "VulnCheck Advisory: Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/modoboa-before-2.8.0-idor-via-api-v2-alarms-bulk-delete"
}
],
"title": "Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113598",
"datePublished": "2026-10-20T15:40:26.960Z",
"dateReserved": "2026-10-20T11:48:39.690Z",
"dateUpdated": "2026-10-21T15:54:34.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113597 (GCVE-0-2026-113597)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-20 16:40
VLAI
EPSS
VEX
Title
Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures
Summary
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:40 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/blinkospace/blinko/issues/1112 | issue-tracking |
| https://github.com/blinkospace/blinko/pull/1171 | patchissue-tracking |
| https://github.com/blinkospace/blinko/blob/1.8.8/… | technical-description |
| https://www.vulncheck.com/advisories/blinko-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| blinkospace | blinko |
Affected:
0 , ≤ 1.8.8
(custom)
cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:* |
Date Public
2026-02-21 17:39
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:40:12.152236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:40:26.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/blinkospace/blinko",
"product": "blinko",
"repo": "https://github.com/blinkospace/blinko",
"vendor": "blinkospace",
"versions": [
{
"lessThanOrEqual": "1.8.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:blinko:blinko:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.8.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-21T17:39:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users\u0027 tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder to reveal private note topics and tamper with tag icons and ordering."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:26.082Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/blinkospace/blinko/issues/1112"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/blinkospace/blinko/pull/1171"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/blinkospace/blinko/blob/1.8.8/server/routerTrpc/tag.ts"
},
{
"name": "VulnCheck Advisory: Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blinko-through-1.8.8-idor-via-tag-trpc-router-procedures"
}
],
"title": "Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113597",
"datePublished": "2026-10-20T15:40:26.082Z",
"dateReserved": "2026-10-20T11:48:39.329Z",
"dateUpdated": "2026-10-20T16:40:26.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113596 (GCVE-0-2026-113596)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-23 01:43
VLAI
EPSS
VEX
Title
Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Summary
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 01:43 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/webstudio-is/webstudio/issues/5621 | issue-tracking |
| https://github.com/webstudio-is/webstudio/commit/… | patch |
| https://github.com/webstudio-is/webstudio/release… | release-notes |
| https://github.com/webstudio-is/webstudio/blob/0.… | technical-description |
| https://github.com/webstudio-is/webstudio/blob/0.… | technical-description |
| https://www.vulncheck.com/advisories/webstudio-be… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webstudio-is | webstudio |
Affected:
0 , < 0.256.0
(semver)
|
Date Public
2026-02-20 21:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T01:43:46.570337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T01:43:56.739Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "webstudio",
"repo": "https://github.com/webstudio-is/webstudio",
"vendor": "webstudio-is",
"versions": [
{
"lessThan": "0.256.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-20T21:05:52.000Z",
"descriptions": [
{
"lang": "en",
"value": "Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users\u0027 project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user\u0027s project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:25.087Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/webstudio-is/webstudio/issues/5621"
},
{
"tags": [
"patch"
],
"url": "https://github.com/webstudio-is/webstudio/commit/348d049ed2763d2b6c3e00319fa9086ca67c8aa6"
},
{
"name": "webstudio 0.256.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/webstudio-is/webstudio/releases/tag/0.256.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/project/src/trpc/project-router.ts"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/dashboard/src/db/projects.ts"
},
{
"name": "VulnCheck Advisory: Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/webstudio-before-0.256.0-information-disclosure-via-trpc-publishedbuilds-and-findmanybyids"
}
],
"title": "Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113596",
"datePublished": "2026-10-20T15:40:25.087Z",
"dateReserved": "2026-10-20T11:48:38.957Z",
"dateUpdated": "2026-10-23T01:43:56.739Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113511 (GCVE-0-2026-113511)
Vulnerability from cvelistv5 – Published: 2026-11-02 13:08 – Updated: 2026-11-06 18:38
VLAI
EPSS
VEX
Title
Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
Summary
Authorization bypass through User-Controlled key vulnerability in Apache Syncope.
A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.
Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:38 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
apache
CNA
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Syncope |
Affected:
3.0.0-M0 , ≤ 3.0.16
(semver)
Affected: 4.0.0-M0 , ≤ 4.0.8 (semver) Affected: 4.1.0-M0 , ≤ 4.1.3 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-11-02T21:05:12.418Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/02/9"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-113511",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:38:09.601571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:38:32.816Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.syncope.core.idrepo:syncope-core-idrepo-logic",
"packageURL": "pkg:maven/org.apache.syncope.core.idrepo/syncope-core-idrepo-logic",
"product": "Apache Syncope",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "3.0.16",
"status": "affected",
"version": "3.0.0-M0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.0.8",
"status": "affected",
"version": "4.0.0-M0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.1.3",
"status": "affected",
"version": "4.1.0-M0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muted Cybersecurity"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization bypass through User-Controlled key vulnerability in Apache Syncope.\u003c/p\u003e\u003cp\u003eA delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for\u0026nbsp;the destination\u003cbr\u003eThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.\u003c/p\u003e"
}
],
"value": "Authorization bypass through User-Controlled key vulnerability in Apache Syncope.\n\n\n\nA delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for\u00a0the destination\nThis issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3.\n\n\n\nUsers are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T13:08:12.025Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/gn7y6k37xgody4wt4o981cywcovgw106"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Syncope: Delegated administration boundaries can be bypassed for Realm update",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-113511",
"datePublished": "2026-11-02T13:08:12.025Z",
"dateReserved": "2026-10-20T11:01:41.521Z",
"dateUpdated": "2026-11-06T18:38:32.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113359 (GCVE-0-2026-113359)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-21 15:54
VLAI
EPSS
VEX
Title
Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
Summary
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:24 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/baserow/baserow/issues/4870 | issue-tracking |
| https://github.com/baserow/baserow/security/advis… | vendor-advisory |
| https://github.com/baserow/baserow/commit/6884c1a… | patch |
| https://github.com/baserow/baserow/releases/tag/2.3.0 | release-notes |
| https://github.com/baserow/baserow/blob/2.2.2/bac… | technical-description |
| https://www.vulncheck.com/advisories/baserow-befo… | third-party-advisory |
Date Public
2026-02-25 19:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113359",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:24:25.305359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:54:41.612Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Baserow",
"repo": "https://github.com/baserow/baserow",
"vendor": "Baserow",
"versions": [
{
"lessThan": "2.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sectum AI"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-25T19:54:41.000Z",
"descriptions": [
{
"lang": "en",
"value": "Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables in workspaces they do not belong to."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:23.156Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/baserow/baserow/issues/4870"
},
{
"name": "GitHub Security Advisory (GHSA-r8cf-4rgr-x5cv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/baserow/baserow/security/advisories/GHSA-r8cf-4rgr-x5cv"
},
{
"tags": [
"patch"
],
"url": "https://github.com/baserow/baserow/commit/6884c1a49adb5eb0a32de1220e6d9f99e9d97c1f"
},
{
"name": "Baserow 2.3.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/baserow/baserow/releases/tag/2.3.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/baserow/baserow/blob/2.2.2/backend/src/baserow/contrib/database/api/fields/views.py"
},
{
"name": "VulnCheck Advisory: Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/baserow-before-2.3.0-cross-workspace-data-disclosure-via-unique-row-values-endpoint"
}
],
"title": "Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113359",
"datePublished": "2026-10-20T15:40:23.156Z",
"dateReserved": "2026-10-20T01:07:48.459Z",
"dateUpdated": "2026-10-21T15:54:41.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113353 (GCVE-0-2026-113353)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 14:32
VLAI
EPSS
VEX
Title
LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
Summary
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 14:32 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/LearnPress/learnpress/commit/7… | patch |
| https://plugins.svn.wordpress.org/learnpress/tags… | technical-description |
| https://plugins.svn.wordpress.org/learnpress/tags… | technical-description |
| https://learnpresslms.com/changelog/ | release-notes |
| https://wordpress.org/plugins/learnpress/ | product |
| https://www.vulncheck.com/advisories/learnpress-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ThimPress | LearnPress |
Affected:
0 , < 4.4.10
(semver)
cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:* |
Date Public
2026-10-09 01:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113353",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T14:32:42.250134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:32:51.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "LearnPress",
"vendor": "ThimPress",
"versions": [
{
"lessThan": "4.4.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "4.4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tr\u1ea7n V\u0103n Ho\u00e0ng"
}
],
"datePublic": "2026-10-09T01:50:25.000Z",
"descriptions": [
{
"lang": "en",
"value": "LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors\u0027 content. Authenticated instructors can reuse their own generic editor nonce with another object\u0027s id parameter to alter courses, change quiz answers, and trash questions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:41:38.826Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/LearnPress/learnpress/commit/77087dcdc0e974e8d0844453b4071189fc2c70d2"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/editor/class-lp-admin-editor-course.php"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php"
},
{
"tags": [
"release-notes"
],
"url": "https://learnpresslms.com/changelog/"
},
{
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/learnpress/"
},
{
"name": "VulnCheck Advisory: LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/learnpress-before-4.4.10-missing-authorization-via-legacy-editor-ajax-handlers"
}
],
"title": "LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113353",
"datePublished": "2026-10-20T10:41:38.826Z",
"dateReserved": "2026-10-20T01:07:46.397Z",
"dateUpdated": "2026-10-20T14:32:51.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.