Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2771 vulnerabilities reference this CWE, most recent first.
CVE-2026-121734 (GCVE-0-2026-121734)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:55 – Updated: 2026-11-07 03:38
VLAI
EPSS
VEX
Title
ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView
Summary
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:38 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/zane-ops/zane-ops/commit/0f3e3… | patch |
| https://github.com/zane-ops/zane-ops | product |
| https://github.com/zane-ops/zane-ops/security/adv… | vendor-advisory |
| https://github.com/zane-ops/zane-ops/blob/v1.15.1… | technical-description |
| https://github.com/zane-ops/zane-ops/releases/tag… | release-notes |
| https://www.vulncheck.com/advisories/zaneops-1.14… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121734",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:38:13.932833Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:38:38.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/zane-ops/zane-ops",
"product": "zane-ops",
"vendor": "zane-ops",
"versions": [
{
"lessThan": "1.15.2",
"status": "affected",
"version": "1.14.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Fredkiss3"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace\u0027s pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:55:38.573Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494"
},
{
"tags": [
"product"
],
"url": "https://github.com/zane-ops/zane-ops"
},
{
"name": "GitHub Security Advisory (GHSA-r87v-8542-wx9q)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/zane-ops/zane-ops/blob/v1.15.1/backend/zane_api/views/environments.py#L246-L248"
},
{
"name": "ZaneOps v1.15.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2"
},
{
"name": "VulnCheck Advisory: ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview"
}
],
"title": "ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121734",
"datePublished": "2026-11-03T22:55:38.573Z",
"dateReserved": "2026-11-03T22:17:05.334Z",
"dateUpdated": "2026-11-07T03:38:38.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121732 (GCVE-0-2026-121732)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:55 – Updated: 2026-11-09 17:00
VLAI
EPSS
VEX
Title
RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment
Summary
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools' student billing balances, breaking school isolation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:09 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/francoisjacquet/rosariosis/com… | patch |
| https://github.com/francoisjacquet/rosariosis | product |
| https://gitlab.com/francoisjacquet/rosariosis/-/i… | issue-tracking |
| https://github.com/francoisjacquet/rosariosis/blo… | technical-description |
| https://github.com/francoisjacquet/rosariosis/blo… | technical-description |
| https://github.com/francoisjacquet/rosariosis/rel… | release-notes |
| https://www.vulncheck.com/advisories/rosariosis-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| francoisjacquet | RosarioSIS |
Affected:
0 , < 12.9
(custom)
cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:* |
Date Public
2026-05-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:09:11.353014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:00:36.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/francoisjacquet/rosariosis",
"product": "RosarioSIS",
"vendor": "francoisjacquet",
"versions": [
{
"lessThan": "12.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rosariosis:rosariosis:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "harunmansor"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Fran\u00e7ois Jacquet"
}
],
"datePublic": "2026-05-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign student IDs in the student[] POST array of a modfunc=save request to alter other schools\u0027 student billing balances, breaking school isolation."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:55:37.220Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/francoisjacquet/rosariosis/commit/a8bb460aacb11661934e6e91fbe0d8158fbc0c4f"
},
{
"tags": [
"product"
],
"url": "https://github.com/francoisjacquet/rosariosis"
},
{
"tags": [
"issue-tracking"
],
"url": "https://gitlab.com/francoisjacquet/rosariosis/-/issues/376"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignFees.php#L15"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/francoisjacquet/rosariosis/blob/v12.8.1/modules/Student_Billing/MassAssignPayments.php#L16"
},
{
"name": "RosarioSIS v12.9 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/francoisjacquet/rosariosis/releases/tag/v12.9"
},
{
"name": "VulnCheck Advisory: RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/rosariosis-before-12.9-improper-authorization-via-student-billing-mass-assignment"
}
],
"title": "RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121732",
"datePublished": "2026-11-03T22:55:37.220Z",
"dateReserved": "2026-11-03T22:17:04.568Z",
"dateUpdated": "2026-11-09T17:00:36.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121631 (GCVE-0-2026-121631)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:06 – Updated: 2026-11-09 15:37 X_Open Source
VLAI
EPSS
VEX
Title
Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints
Summary
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:37 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/lightdash/lightdash/security/a… | vendor-advisorytechnical-description |
| https://github.com/lightdash/lightdash/releases/t… | patchissue-trackingrelease-notes |
| https://www.vulncheck.com/advisories/lightdash-be… | third-party-advisory |
Impacted products
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121631",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:37:10.850573Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:37:34.330Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/lightdash/lightdash",
"product": "lightdash",
"repo": "https://github.com/lightdash/lightdash",
"vendor": "lightdash",
"versions": [
{
"lessThan": "3.137.0",
"status": "affected",
"version": "0.2609.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lightdash:lightdash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.137.0",
"versionStartIncluding": "0.2609.0",
"vulnerable": true
}
],
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aleksandr Anashin (DAFFIER)"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T14:01:02.542Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h6fw-x63x-9gr6)",
"tags": [
"vendor-advisory",
"technical-description"
],
"url": "https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6"
},
{
"name": "lightdash 3.137.0 Release Notes",
"tags": [
"patch",
"issue-tracking",
"release-notes"
],
"url": "https://github.com/lightdash/lightdash/releases/tag/3.137.0"
},
{
"name": "VulnCheck Advisory: Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameservice-dashboard-endpoints"
}
],
"tags": [
"x_open-source"
],
"title": "Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121631",
"datePublished": "2026-11-03T17:06:08.113Z",
"dateReserved": "2026-11-03T17:01:51.315Z",
"dateUpdated": "2026-11-09T15:37:34.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121585 (GCVE-0-2026-121585)
Vulnerability from cvelistv5 – Published: 2026-11-03 23:30 – Updated: 2026-11-07 03:39
VLAI
EPSS
VEX
Title
InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization
Summary
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:39 UTC
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430429 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430429/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121585 | third-party-advisory |
| https://vuldb.com/submit/1020561 | third-party-advisory |
| https://github.com/infiniflow/ragflow/issues/15123 | broken-linkissue-tracking |
| https://github.com/infiniflow/ragflow/pull/15124 | issue-trackingpatch |
| https://github.com/ZSH402/RAGFlow-Cross-Tenant-Read | exploit |
| https://github.com/infiniflow/ragflow/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| InfiniFlow | RAGFlow |
Affected:
0.27.0
Affected: 0.27.1 Affected: 0.27.2 Affected: 1.0.0-rc1 Affected: 1.0.0-rc2 cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121585",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:39:11.146517Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:39:25.578Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:infiniflow:ragflow:*:*:*:*:*:*:*:*"
],
"modules": [
"Text To SQL Retrieval"
],
"product": "RAGFlow",
"vendor": "InfiniFlow",
"versions": [
{
"status": "affected",
"version": "0.27.0"
},
{
"status": "affected",
"version": "0.27.1"
},
{
"status": "affected",
"version": "0.27.2"
},
{
"status": "affected",
"version": "1.0.0-rc1"
},
{
"status": "affected",
"version": "1.0.0-rc2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zsh07 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T23:30:17.239Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430429 | InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430429"
},
{
"name": "VDB-430429 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430429/cti"
},
{
"name": "CVE-2026-121585 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121585"
},
{
"name": "Submit #1020561 | InfiniFlow RAGFlow 1.0.0-rc1 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1020561"
},
{
"tags": [
"broken-link",
"issue-tracking"
],
"url": "https://github.com/infiniflow/ragflow/issues/15123"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/infiniflow/ragflow/pull/15124"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ZSH402/RAGFlow-Cross-Tenant-Read"
},
{
"tags": [
"product"
],
"url": "https://github.com/infiniflow/ragflow/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T17:02:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121585",
"datePublished": "2026-11-03T23:30:17.239Z",
"dateReserved": "2026-11-03T15:57:18.140Z",
"dateUpdated": "2026-11-07T03:39:25.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121583 (GCVE-0-2026-121583)
Vulnerability from cvelistv5 – Published: 2026-11-03 23:15 – Updated: 2026-11-04 18:58
VLAI
EPSS
VEX
Title
Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization
Summary
A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:58 UTC
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430428 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430428/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121583 | third-party-advisory |
| https://vuldb.com/submit/1020265 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:58:25.527271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:58:33.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"
],
"product": "PublicCMS",
"vendor": "Sanluan",
"versions": [
{
"status": "affected",
"version": "5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "s1mple_xy (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB Vulnerability Moderation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437)."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T23:15:17.259Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430428 | Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430428"
},
{
"name": "VDB-430428 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430428/cti"
},
{
"name": "CVE-2026-121583 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121583"
},
{
"name": "Submit #1020265 | Sanluan publiccms V5 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1020265"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T16:56:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121583",
"datePublished": "2026-11-03T23:15:17.259Z",
"dateReserved": "2026-11-03T15:51:25.027Z",
"dateUpdated": "2026-11-04T18:58:33.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121582 (GCVE-0-2026-121582)
Vulnerability from cvelistv5 – Published: 2026-11-03 23:00 – Updated: 2026-11-09 17:00
VLAI
EPSS
VEX
Title
Umami Record API Endpoint route.ts authorization
Summary
A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:40 UTC
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/430425 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/430425/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-121582 | third-party-advisory |
| https://vuldb.com/submit/1019998 | third-party-advisory |
| https://github.com/waterhunter2000-svg/vulnerabil… | related |
| https://github.com/umami-software/umami/security/… | broken-link |
| https://github.com/waterhunter2000-svg/vulnerabil… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121582",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:40:28.175334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:00:23.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:umami:umami:*:*:*:*:*:*:*:*"
],
"modules": [
"Record API Endpoint"
],
"product": "Umami",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "waterhunter (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T23:00:26.095Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-430425 | Umami Record API Endpoint route.ts authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/430425"
},
{
"name": "VDB-430425 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/430425/cti"
},
{
"name": "CVE-2026-121582 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-121582"
},
{
"name": "Submit #1019998 | umami-software umami 3.4.0 Improper Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1019998"
},
{
"tags": [
"related"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/umami-software/umami/security/advisories/GHSA-4cww-5p37-v8r2"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/02-umami-record-unauth-write.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-03T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-03T16:54:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "Umami Record API Endpoint route.ts authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-121582",
"datePublished": "2026-11-03T23:00:26.095Z",
"dateReserved": "2026-11-03T15:48:58.248Z",
"dateUpdated": "2026-11-09T17:00:23.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121560 (GCVE-0-2026-121560)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-03 16:42
VLAI
EPSS
VEX
Title
LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts
Summary
LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:42 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/logchimp/logchimp/commit/a78b6… | patch |
| https://github.com/logchimp/logchimp | product |
| https://github.com/logchimp/logchimp/blob/v0.9.2/… | technical-description |
| https://github.com/logchimp/logchimp/blob/v0.9.2/… | technical-description |
| https://github.com/logchimp/logchimp/releases/tag… | technical-descriptionrelease-notes |
| https://www.vulncheck.com/advisories/logchimp-bef… | third-party-advisory |
Impacted products
Date Public
2026-11-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:42:12.790602Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:42:29.845Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/logchimp/logchimp",
"product": "logchimp",
"vendor": "logchimp",
"versions": [
{
"lessThan": "0.9.3",
"status": "affected",
"version": "0.9.0-alpha.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "leediay153 from Viettel Post"
},
{
"lang": "en",
"type": "remediation developer",
"value": "mittalyashu"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:16.390Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/logchimp/logchimp/commit/a78b69af342908472ad400285187e43729295a7c"
},
{
"tags": [
"product"
],
"url": "https://github.com/logchimp/logchimp"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/controllers/post/updatePost.ts#L67"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/logchimp/logchimp/blob/v0.9.2/packages/server/src/middlewares/postExists.ts#L72-L77"
},
{
"name": "logchimp v0.9.3 Release Notes",
"tags": [
"technical-description",
"release-notes"
],
"url": "https://github.com/logchimp/logchimp/releases/tag/v0.9.3"
},
{
"name": "VulnCheck Advisory: LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/logchimp-before-0.9.3-authorization-bypass-via-patch-api-v1-posts"
}
],
"title": "LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121560",
"datePublished": "2026-11-03T15:17:16.390Z",
"dateReserved": "2026-11-03T14:46:17.953Z",
"dateUpdated": "2026-11-03T16:42:29.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121558 (GCVE-0-2026-121558)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-09 15:17
VLAI
EPSS
VEX
Title
AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id
Summary
AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:13 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Ricky-7-Yan/intelligent-audit-… | issue-tracking |
| https://github.com/Ricky-7-Yan/intelligent-audit-system | product |
| https://github.com/Ricky-7-Yan/intelligent-audit-… | patch |
| https://github.com/Ricky-7-Yan/intelligent-audit-… | technical-description |
| https://github.com/Ricky-7-Yan/intelligent-audit-… | technical-description |
| https://www.vulncheck.com/advisories/auditpilot-b… | third-party-advisory |
| https://hackmd.io/@hieuPenguinnn/cve-2026-121558-… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ricky-7-Yan | intelligent-audit-system |
Affected:
0 , < 4669c93f3a7403a0e242bef14d771beef0b4356b
(git)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121558",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:13:55.295850Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:17:11.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/cve-2026-121558-auditpilot-rag-project-scope-idor-knowledge-query"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Ricky-7-Yan/intelligent-audit-system",
"product": "intelligent-audit-system",
"vendor": "Ricky-7-Yan",
"versions": [
{
"lessThan": "4669c93f3a7403a0e242bef14d771beef0b4356b",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects\u0027 knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:14.947Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #7",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Ricky-7-Yan/intelligent-audit-system/issues/7"
},
{
"tags": [
"product"
],
"url": "https://github.com/Ricky-7-Yan/intelligent-audit-system"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/Ricky-7-Yan/intelligent-audit-system/commit/4669c93f3a7403a0e242bef14d771beef0b4356b"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Ricky-7-Yan/intelligent-audit-system/blob/e4f1bf1c92cb14dd18bf0e11f4688fd1e346c9b9/rag/agentic_rag.py#L342-L365"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Ricky-7-Yan/intelligent-audit-system/blob/e4f1bf1c92cb14dd18bf0e11f4688fd1e346c9b9/web/main.py#L1197-L1206"
},
{
"name": "VulnCheck Advisory: AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/auditpilot-before-commit-4669c93-rag-project-scope-authorization-bypass-via-project-id"
}
],
"title": "AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121558",
"datePublished": "2026-11-03T15:17:14.947Z",
"dateReserved": "2026-11-03T14:46:17.306Z",
"dateUpdated": "2026-11-09T15:17:11.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121556 (GCVE-0-2026-121556)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-03 16:41
VLAI
EPSS
VEX
Title
FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints
Summary
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:40 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/beecue/FastBee/issues/32 | issue-tracking |
| https://github.com/kerwincui/FastBee | product |
| https://github.com/beecue/FastBee/commit/3393e322… | patch |
| https://github.com/kerwincui/FastBee/blob/v2.1.0/… | technical-description |
| https://github.com/kerwincui/FastBee/blob/v2.1.0/… | technical-description |
| https://github.com/kerwincui/FastBee/blob/v2.1.0/… | technical-description |
| https://www.vulncheck.com/advisories/fastbee-thro… | third-party-advisory |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:40:56.861758Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:41:09.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FastBee",
"vendor": "beecue",
"versions": [
{
"lessThanOrEqual": "2.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants\u0027 products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:13.547Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #32",
"tags": [
"issue-tracking"
],
"url": "https://github.com/beecue/FastBee/issues/32"
},
{
"tags": [
"product"
],
"url": "https://github.com/kerwincui/FastBee"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67"
},
{
"name": "VulnCheck Advisory: FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints"
}
],
"title": "FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121556",
"datePublished": "2026-11-03T15:17:13.547Z",
"dateReserved": "2026-11-03T14:46:16.668Z",
"dateUpdated": "2026-11-03T16:41:09.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121442 (GCVE-0-2026-121442)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-07 03:03
VLAI
EPSS
VEX
Title
Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
Summary
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:03 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/hrms/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-hrms-… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:03:01.098504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:03:18.271Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "hrms",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.61.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.61.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "geo-chen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iamkhanraheel"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees\u0027 expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:32.621Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9f7p-ppw4-57p6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/hrms/security/advisories/GHSA-9f7p-ppw4-57p6"
},
{
"name": "VulnCheck Advisory: Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-hrms-before-15.61.0-permission-bypass-via-expense-claim-advances-api"
}
],
"title": "Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121442",
"datePublished": "2026-11-03T14:28:32.621Z",
"dateReserved": "2026-11-03T12:32:14.752Z",
"dateUpdated": "2026-11-07T03:03:18.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.