Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2790 vulnerabilities reference this CWE, most recent first.
CVE-2026-89029 (GCVE-0-2026-89029)
Vulnerability from cvelistv5 – Published: 2026-09-16 13:59 – Updated: 2026-10-01 15:21
VLAI
EPSS
VEX
Title
Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler
Summary
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://wordpress.org/plugins/blog2social/#developers | release-notespatch |
| https://www.vulncheck.com/advisories/blog2social-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Adenion | Blog2Social |
Affected:
0 , < 9.1.0
(semver)
cpe:2.3:a:adenion:blog2social:*:*:*:*:*:wordpress:*:* |
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89029",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:39.619616Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:26:30.928Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Blog2Social",
"vendor": "Adenion",
"versions": [
{
"lessThan": "9.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adenion:blog2social:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "9.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Choriyev Qahramon (ciprobe)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulnCheck"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display names without verifying that the caller is authorized to read user account data, allowing any user with the edit_posts capability to map WordPress user IDs to display names and confirm account existence for arbitrary IDs."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T15:21:52.173Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "WordPress Changelog",
"tags": [
"release-notes",
"patch"
],
"url": "https://wordpress.org/plugins/blog2social/#developers"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blog2social-wordpress-plugin-user-enumeration-via-ajax-handler"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Blog2Social WordPress Plugin \u003c 9.1.0 User Enumeration via AJAX Handler",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89029",
"datePublished": "2026-09-16T13:59:48.640Z",
"dateReserved": "2026-09-10T16:23:54.472Z",
"dateUpdated": "2026-10-01T15:21:52.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88982 (GCVE-0-2026-88982)
Vulnerability from cvelistv5 – Published: 2026-11-05 22:25 – Updated: 2026-11-10 04:44
VLAI
EPSS
VEX
Title
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
Summary
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace's cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 04:44 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/kubeflow/pipelines/security/ad… | x_refsource_CONFIRM |
| https://github.com/kubeflow/pipelines/pull/14359 | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/commit/620d… | x_refsource_MISC |
| https://github.com/kubeflow/pipelines/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T04:44:20.203048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T04:44:31.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pipelines",
"vendor": "kubeflow",
"versions": [
{
"status": "affected",
"version": "\u003c 2.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes namespace, use the key alone for lookups and duplicate checks, and trust the mutable pipelines.kubeflow.org/execution_cache_key annotation when publishing outputs. In multi-user deployments where tenant namespaces share the cache service, a tenant with workload-submission privileges can read another namespace\u0027s cached outputs or seed matching outputs that are substituted into a later step. Standard KFP V2 component pods bypass this cache, matching requires the selected template fields and staleness policy, and arbitrary code execution or service availability impact is not established. This issue is fixed in version 2.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T22:25:58.995Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/kubeflow/pipelines/security/advisories/GHSA-2xwh-426q-42c5"
},
{
"name": "https://github.com/kubeflow/pipelines/pull/14359",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/pull/14359"
},
{
"name": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/commit/620d0cc89ae0d042a484a003f8ffe6e9a55d347e"
},
{
"name": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/kubeflow/pipelines/releases/tag/2.18.0"
}
],
"source": {
"advisory": "GHSA-2xwh-426q-42c5",
"discovery": "UNKNOWN"
},
"title": "Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88982",
"datePublished": "2026-11-05T22:25:58.995Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-11-10T04:44:31.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88978 (GCVE-0-2026-88978)
Vulnerability from cvelistv5 – Published: 2026-09-21 15:49 – Updated: 2026-09-24 22:18
VLAI
EPSS
VEX
Title
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
Summary
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 22:18 UTC
Assigner
GitHub_M
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/hatchet-dev/hatchet/security/a… | x_refsource_CONFIRM |
| https://github.com/hatchet-dev/hatchet/commit/15b… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hatchet-dev | hatchet |
Affected:
< 0.106.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88978",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T22:18:07.030391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T22:18:16.195Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hatchet",
"vendor": "hatchet-dev",
"versions": [
{
"status": "affected",
"version": "\u003c 0.106.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant\u0027s durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:49:12.735Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x"
},
{
"name": "https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85"
}
],
"source": {
"advisory": "GHSA-992g-9cr3-vm5x",
"discovery": "UNKNOWN"
},
"title": "Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88978",
"datePublished": "2026-09-21T15:49:12.735Z",
"dateReserved": "2026-09-10T16:02:31.342Z",
"dateUpdated": "2026-09-24T22:18:16.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88877 (GCVE-0-2026-88877)
Vulnerability from cvelistv5 – Published: 2026-09-10 13:05 – Updated: 2026-10-08 15:51
VLAI
EPSS
VEX
Title
Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
Summary
Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 14:09 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/traefik/traefik/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/traefik-3.7.… | third-party-advisory |
Impacted products
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88877",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T14:09:57.234385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T14:10:07.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v3",
"product": "traefik",
"vendor": "traefik",
"versions": [
{
"lessThanOrEqual": "3.7.13",
"status": "affected",
"version": "3.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.7.13",
"versionStartIncluding": "3.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "thaidn"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Traefik is a HTTP reverse proxy and load balancer. In versions \u003e= v3.7.0 and \u003c= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional \u0027sibling\u0027 router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router\u0027s protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik\u0027s host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example \u0027Host: www.example.com:x\u0027) selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress\u0027s annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:51:50.406Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cjr6-pf59-jq29)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-cjr6-pf59-jq29"
},
{
"name": "VulnCheck Advisory: Traefik v3.7.0 Authentication Bypass via from-to-www-redirect",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/traefik-3.7.0-authentication-bypass-via-from-to-www-redirect"
}
],
"title": "Traefik v3.7.0 Authentication Bypass via from-to-www-redirect",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-88877",
"datePublished": "2026-09-10T13:05:29.471Z",
"dateReserved": "2026-09-10T11:24:26.196Z",
"dateUpdated": "2026-10-08T15:51:50.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88865 (GCVE-0-2026-88865)
Vulnerability from cvelistv5 – Published: 2026-09-10 13:05 – Updated: 2026-09-18 17:23
VLAI
EPSS
VEX
Title
AVideo Missing Authorization via getRestream.json.php
Summary
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users' stream keys from getLiveKey.json.php and publish to their YouTube, Twitch, or RTMP destinations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:10 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/WWBN/AVideo/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/avideo-missi… | third-party-advisory |
Impacted products
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:10:44.334542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:23:08.210Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AVideo",
"vendor": "WWBN",
"versions": [
{
"lessThanOrEqual": "c3edcc274c389816d434acadac07ee78eaf330c1",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "santhreal"
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with canStream permission to mint tokens for arbitrary restreams. Attackers can exchange the token to retrieve other users\u0027 stream keys from getLiveKey.json.php and publish to their YouTube, Twitch, or RTMP destinations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:05:21.208Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7jf4-mmqm-7p7x)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-7jf4-mmqm-7p7x"
},
{
"name": "VulnCheck Advisory: AVideo Missing Authorization via getRestream.json.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/avideo-missing-authorization-via-getrestream-json-php"
}
],
"title": "AVideo Missing Authorization via getRestream.json.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-88865",
"datePublished": "2026-09-10T13:05:21.208Z",
"dateReserved": "2026-09-10T11:23:56.027Z",
"dateUpdated": "2026-09-18T17:23:08.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-88065 (GCVE-0-2026-88065)
Vulnerability from cvelistv5 – Published: 2026-09-15 20:20 – Updated: 2026-09-16 13:58
VLAI
EPSS
VEX
Title
`tts-be` application has a Broken Access Control vulnerability
Summary
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:58 UTC
CWE
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/NIAEFEUP/tts-be/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-88065",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:58:01.235301Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:58:11.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tts-be",
"vendor": "NIAEFEUP",
"versions": [
{
"status": "affected",
"version": "\u003c 2.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T20:20:08.958Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/NIAEFEUP/tts-be/security/advisories/GHSA-fpfp-hr42-fvpm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/NIAEFEUP/tts-be/security/advisories/GHSA-fpfp-hr42-fvpm"
}
],
"source": {
"advisory": "GHSA-fpfp-hr42-fvpm",
"discovery": "UNKNOWN"
},
"title": "`tts-be` application has a Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-88065",
"datePublished": "2026-09-15T20:20:08.958Z",
"dateReserved": "2026-09-09T21:22:45.435Z",
"dateUpdated": "2026-09-16T13:58:11.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87997 (GCVE-0-2026-87997)
Vulnerability from cvelistv5 – Published: 2026-09-09 21:30 – Updated: 2026-09-14 13:44
VLAI
EPSS
VEX
Title
Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
Summary
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 13:43 UTC
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | x_refsource_CONFIRM |
| https://github.com/open-webui/open-webui/pull/28366 | x_refsource_MISC |
| https://github.com/open-webui/open-webui/commit/d… | x_refsource_MISC |
| https://github.com/open-webui/open-webui/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
>= 0.10.0, < 0.11.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87997",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T13:43:57.477520Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:44:20.104Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3pf7-q2g3-wj28"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.10.0, \u003c 0.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/chat/completions in backend/open_webui/main.py copied a client-supplied folder_id into a new chat without applying the folder write-access check used by the dedicated chat routes. An authenticated user who knew a shared folder identifier could inject an attacker-controlled chat into a folder where the user had read-only or no write access, causing the entry to appear to authorized folder readers. This issue is fixed in version 0.11.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T21:30:09.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3pf7-q2g3-wj28",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3pf7-q2g3-wj28"
},
{
"name": "https://github.com/open-webui/open-webui/pull/28366",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/pull/28366"
},
{
"name": "https://github.com/open-webui/open-webui/commit/d9e23b90c100d19b00270aea3cde0501d2354a6c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/commit/d9e23b90c100d19b00270aea3cde0501d2354a6c"
},
{
"name": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
}
],
"source": {
"advisory": "GHSA-3pf7-q2g3-wj28",
"discovery": "UNKNOWN"
},
"title": "Open WebUI: Any authenticated user can inject chats into another user\u0027s folder via chat completions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-87997",
"datePublished": "2026-09-09T21:30:09.334Z",
"dateReserved": "2026-09-09T19:19:27.405Z",
"dateUpdated": "2026-09-14T13:44:20.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87994 (GCVE-0-2026-87994)
Vulnerability from cvelistv5 – Published: 2026-09-09 21:24 – Updated: 2026-09-10 15:59
VLAI
EPSS
VEX
Title
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user authored the targeted message. A channel member could use the chat completions endpoint to replace another member's message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. This issue is fixed in version 0.11.1.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 15:59 UTC
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | x_refsource_CONFIRM |
| https://github.com/open-webui/open-webui/pull/28631 | x_refsource_MISC |
| https://github.com/open-webui/open-webui/commit/7… | x_refsource_MISC |
| https://github.com/open-webui/open-webui/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
>= 0.9.5, < 0.11.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87994",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T15:59:49.963213Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T15:59:55.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fmqh-xp37-5hr8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.9.5, \u003c 0.11.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend/open_webui/main.py checked channel write access and channel membership for a supplied message_id but did not verify that the calling user authored the targeted message. A channel member could use the chat completions endpoint to replace another member\u0027s message while preserving the victim as the stored author, altering the conversation record without gaining access to other channels. This issue is fixed in version 0.11.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T21:24:55.896Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fmqh-xp37-5hr8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fmqh-xp37-5hr8"
},
{
"name": "https://github.com/open-webui/open-webui/pull/28631",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/pull/28631"
},
{
"name": "https://github.com/open-webui/open-webui/commit/7d392bedc9c1aaecc94509a58e59186b614433dc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/commit/7d392bedc9c1aaecc94509a58e59186b614433dc"
},
{
"name": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.1"
}
],
"source": {
"advisory": "GHSA-fmqh-xp37-5hr8",
"discovery": "UNKNOWN"
},
"title": "Open WebUI: Channel members can overwrite another member\u0027s message via the chat completions endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-87994",
"datePublished": "2026-09-09T21:24:55.896Z",
"dateReserved": "2026-09-09T19:19:27.405Z",
"dateUpdated": "2026-09-10T15:59:55.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87975 (GCVE-0-2026-87975)
Vulnerability from cvelistv5 – Published: 2026-10-06 13:35 – Updated: 2026-10-06 13:53
VLAI
EPSS
VEX
Title
Privilege abuse in model formsets with editable primary keys
Summary
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model's primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset's model, or a natural or UUID primary key included in the form's fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Seonggwon Yoon for reporting this issue.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 13:51 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
DSF
CNA
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| djangoproject | Django |
Affected:
6.1 , < 6.1.2
(python)
Unaffected: 6.1.2 (python) Affected: 6.0 , < 6.0.9 (python) Unaffected: 6.0.9 (python) Affected: 5.2 , < 5.2.18 (python) Unaffected: 5.2.18 (python) |
Date Public
2026-10-06 08:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87975",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T13:51:18.609494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:53:32.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org/project/Django/",
"defaultStatus": "unaffected",
"packageName": "django",
"product": "Django",
"repo": "https://github.com/django/django/",
"vendor": "djangoproject",
"versions": [
{
"lessThan": "6.1.2",
"status": "affected",
"version": "6.1",
"versionType": "python"
},
{
"status": "unaffected",
"version": "6.1.2",
"versionType": "python"
},
{
"lessThan": "6.0.9",
"status": "affected",
"version": "6.0",
"versionType": "python"
},
{
"status": "unaffected",
"version": "6.0.9",
"versionType": "python"
},
{
"lessThan": "5.2.18",
"status": "affected",
"version": "5.2",
"versionType": "python"
},
{
"status": "unaffected",
"version": "5.2.18",
"versionType": "python"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Seonggwon Yoon"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jacob Walls"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Natalia Bidart"
},
{
"lang": "en",
"type": "coordinator",
"value": "Sarah Boyce"
}
],
"datePublic": "2026-10-06T08:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\u003c/p\u003e\u003cp\u003e\u003ccode\u003edjango.forms.models.BaseModelFormSet.save_existing_objects()\u003c/code\u003e used the presence of a primary key on a submitted form\u0026#x27;s instance as evidence that the instance belonged to the formset\u0026#x27;s limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model\u0026#x27;s primary key is a field accepted by the form, such as a \u003ccode\u003eOneToOneField\u003c/code\u003e or parent link used as the primary key of an inline formset\u0026#x27;s model, or a natural or UUID primary key included in the form\u0026#x27;s fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected.\u003c/p\u003e\u003cp\u003eEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\u003c/p\u003e\u003cp\u003eDjango would like to thank Seonggwon Yoon for reporting this issue.\u003c/p\u003e"
}
],
"value": "An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.\n`django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form\u0027s instance as evidence that the instance belonged to the formset\u0027s limiting queryset. An object outside that queryset is represented by a newly constructed instance whose primary key can still be populated from submitted data when the model\u0027s primary key is a field accepted by the form, such as a `OneToOneField` or parent link used as the primary key of an inline formset\u0027s model, or a natural or UUID primary key included in the form\u0027s fields. This allows an authenticated user permitted to submit such a formset to delete rows outside the limiting queryset, without any permission on the targeted object, via forged management-form data marking an out-of-queryset object for deletion. Models using the default AutoField primary key are not affected.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Seonggwon Yoon for reporting this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122: Privilege Abuse"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels",
"value": "moderate"
},
"type": "Django severity rating"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T13:35:59.505Z",
"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
"shortName": "DSF"
},
"references": [
{
"name": "Django security archive",
"tags": [
"vendor-advisory"
],
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"name": "Django releases announcements",
"tags": [
"mailing-list"
],
"url": "https://groups.google.com/g/django-announce"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/83cbd21be57483e6b3eb6e4688a561c841aff75e"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/cce6c57ed30ea83725f9d6abb2fe5ee932bab107"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/b83ab92bc5474558b083a840ea4628b3261b2cfe"
},
{
"tags": [
"patch"
],
"url": "https://github.com/django/django/commit/ff27883ca055aa9ab23015b50674a5b10dfe5a41"
},
{
"name": "Django security releases issued: 6.1.2, 6.0.9, and 5.2.18",
"tags": [
"vendor-advisory"
],
"url": "https://www.djangoproject.com/weblog/2026/oct/06/security-releases/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-02T00:00:00.000Z",
"value": "Initial report received."
},
{
"lang": "en",
"time": "2026-09-16T00:00:00.000Z",
"value": "Vulnerability confirmed."
},
{
"lang": "en",
"time": "2026-10-06T08:00:00.000Z",
"value": "Security release issued."
}
],
"title": "Privilege abuse in model formsets with editable primary keys",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92",
"assignerShortName": "DSF",
"cveId": "CVE-2026-87975",
"datePublished": "2026-10-06T13:35:59.505Z",
"dateReserved": "2026-09-09T18:18:45.075Z",
"dateUpdated": "2026-10-06T13:53:32.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87857 (GCVE-0-2026-87857)
Vulnerability from cvelistv5 – Published: 2026-11-09 19:45 – Updated: 2026-11-09 19:45
VLAI
EPSS
VEX
Title
Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow
Summary
Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading "Pagination branch token is not the execution's current branch token" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.
Severity
Assigner
Temporal
CNA
References
12 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server |
Unknown:
0.0.0 , < 1.0.0
(semver)
Affected: 1.0.0 , ≤ 1.29.7 (semver) Affected: 1.30.0 , < 1.30.7 (semver) Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Frontend",
"History"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"proto/internal/temporal/server/api/token/v1/message.proto",
"service/history/api/token.go",
"service/history/api/get_history_util.go",
"service/history/api/getworkflowexecutionhistory/api.go",
"service/history/api/getworkflowexecutionhistoryreverse/api.go"
],
"programRoutines": [
{
"name": "getworkflowexecutionhistory.Invoke"
},
{
"name": "getworkflowexecutionhistoryreverse.Invoke"
},
{
"name": "api.DeserializeHistoryToken"
},
{
"name": "api.GetHistory"
},
{
"name": "api.GetHistoryReverse"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThan": "1.0.0",
"status": "unknown",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExploitation requires a genuine non-final history continuation previously issued for a workflow in the target namespace, obtained through the caller\u0027s own earlier authorized access or through another disclosure of that token. A continuation cannot be constructed from a namespace, workflow, and run identifier alone, because the branch token carries randomly assigned persisted tree and branch identity. Aligning the request\u0027s workflow identifier with the continuation\u0027s History shard is caller-controlled and can be retried until it succeeds, and no workflow with that identifier need exist, so shard alignment is not an attack requirement.\u003c/p\u003e"
}
],
"value": "Exploitation requires a genuine non-final history continuation previously issued for a workflow in the target namespace, obtained through the caller\u0027s own earlier authorized access or through another disclosure of that token. A continuation cannot be constructed from a namespace, workflow, and run identifier alone, because the branch token carries randomly assigned persisted tree and branch identity. Aligning the request\u0027s workflow identifier with the continuation\u0027s History shard is caller-controlled and can be retried until it succeeds, and no workflow with that identifier need exist, so shard alignment is not an attack requirement."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe CVSS Base score describes a deployment that configures authentication and authorization, which is the supported secure self-hosted posture. In self-hosted Temporal Server these are operator-configured rather than enabled by default; a deployment that configures no Authorizer already permits every namespace read, and this is not the boundary that fails there. The privileges-required assessment reflects a caller holding read permission on one namespace under a configured Authorizer. Namespaces are an isolation boundary in single-organization deployments as well as multi-organization ones, commonly separating environments such as production from staging or one team\u0027s workloads from another\u0027s, and the Base score reflects the loss of that boundary without assuming multiple tenants.\u003c/p\u003e"
}
],
"value": "The CVSS Base score describes a deployment that configures authentication and authorization, which is the supported secure self-hosted posture. In self-hosted Temporal Server these are operator-configured rather than enabled by default; a deployment that configures no Authorizer already permits every namespace read, and this is not the boundary that fails there. The privileges-required assessment reflects a caller holding read permission on one namespace under a configured Authorizer. Namespaces are an isolation boundary in single-organization deployments as well as multi-organization ones, commonly separating environments such as production from staging or one team\u0027s workloads from another\u0027s, and the Base score reflects the loss of that boundary without assuming multiple tenants."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe confidentiality assessment reflects a bounded loss rather than a total one. A caller reaches only those workflows for which they hold a genuine non-final continuation, and cannot enumerate other workflows in the disclosed namespace. Within a reachable workflow the disclosure is not bounded to the page already seen, because the token\u0027s event range can be advanced. Whether the disclosed history is itself gravely sensitive depends on the application: without a Payload Codec, workflow arguments, signal payloads, and results may be readable in full, and where a Codec is correctly deployed the covered payload bodies remain ciphertext while history metadata such as event types and timing, workflow and signal type names, task queues, retry and timeout configuration, identities, search attributes, and default failure messages and stack traces are still disclosed. Deployments should apply Environmental metrics, in particular a Confidentiality Requirement, to reflect the sensitivity of the workflow data they run.\u003c/p\u003e"
}
],
"value": "The confidentiality assessment reflects a bounded loss rather than a total one. A caller reaches only those workflows for which they hold a genuine non-final continuation, and cannot enumerate other workflows in the disclosed namespace. Within a reachable workflow the disclosure is not bounded to the page already seen, because the token\u0027s event range can be advanced. Whether the disclosed history is itself gravely sensitive depends on the application: without a Payload Codec, workflow arguments, signal payloads, and results may be readable in full, and where a Codec is correctly deployed the covered payload bodies remain ciphertext while history metadata such as event types and timing, workflow and signal type names, task queues, retry and timeout configuration, identities, search attributes, and default failure messages and stack traces are still disclosed. Deployments should apply Environmental metrics, in particular a Confidentiality Requirement, to reflect the sensitivity of the workflow data they run."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFixed releases gate the check on two dynamic configuration settings. history.enablePaginationTokenBranchValidation defaults to true and history.enablePaginationTokenBranchValidationShadowMode defaults to false, so a fixed release enforces the check without operator action. Two operator changes restore the vulnerable behavior, by different routes: setting history.enablePaginationTokenBranchValidationShadowMode to true keeps the check running and keeps recording the mismatch, but serves the read anyway, while setting history.enablePaginationTokenBranchValidation to false skips the check entirely and records nothing. Rejection of a page token that carries no branch token at all is not gated by shadow mode. Enforcement rejects a page token whose branch token is a retained but non-current branch of the requested execution, reported as reason=non_current_branch, which can interrupt legitimate in-flight pagination after conflict resolution or failover; operators who encounter that condition should treat the settings as a temporary measure and accept the disclosure risk for its duration.\u003c/p\u003e"
}
],
"value": "Fixed releases gate the check on two dynamic configuration settings. history.enablePaginationTokenBranchValidation defaults to true and history.enablePaginationTokenBranchValidationShadowMode defaults to false, so a fixed release enforces the check without operator action. Two operator changes restore the vulnerable behavior, by different routes: setting history.enablePaginationTokenBranchValidationShadowMode to true keeps the check running and keeps recording the mismatch, but serves the read anyway, while setting history.enablePaginationTokenBranchValidation to false skips the check entirely and records nothing. Rejection of a page token that carries no branch token at all is not gated by shadow mode. Enforcement rejects a page token whose branch token is a retained but non-current branch of the requested execution, reported as reason=non_current_branch, which can interrupt legitimate in-flight pagination after conflict resolution or failover; operators who encounter that condition should treat the settings as a temporary measure and accept the disclosure risk for its duration."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Reported internally at Temporal Technologies, Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTemporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace\u0027s workflow history, provided the supplied workflow identifier selects the same History shard as the continuation\u0027s branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller\u0027s current credential no longer granted access to the continuation\u0027s namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token\u0027s branch token is not the requested execution\u0027s current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading \"Pagination branch token is not the execution\u0027s current branch token\" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.\u003c/p\u003e"
}
],
"value": "Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace\u0027s workflow history, provided the supplied workflow identifier selects the same History shard as the continuation\u0027s branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller\u0027s current credential no longer granted access to the continuation\u0027s namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token\u0027s branch token is not the requested execution\u0027s current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading \"Pagination branch token is not the execution\u0027s current branch token\" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Disclosure of workflow history across the namespace authorization boundary. The disclosure persists after the caller\u0027s credential stops granting access to that namespace and covers history events created after that point, so revoking the caller\u0027s access does not end it. No integrity or availability impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:45:14.927Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "Earliest source-confirmed affected release",
"tags": [
"product"
],
"url": "https://github.com/temporalio/temporal/blob/v1.0.0/service/frontend/workflowHandler.go#L602-L740"
},
{
"name": "Fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11723"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/commit/ceb1cc1071b1fd37f8a2cd8ef5ed3e4333245cc2"
},
{
"name": "Backport pull request for the 1.32 release line",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11919"
},
{
"name": "Backport commit on release/v1.32.x",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/commit/4b02728735450dd60eaff9a5d0dc8e11fc8a4b13"
},
{
"name": "Backport pull request for the 1.31 release line",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/12039"
},
{
"name": "Backport commit on release/v1.31.x",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/commit/c82a2d228e7287b1d283a55477f40a1a48481010"
},
{
"name": "Backport pull request for the 1.30 release line",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/12040"
},
{
"name": "Backport commit on release/v1.30.x",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/commit/690b53103e11982de5f9187f722a0e0d3780028d"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
},
{
"name": "Temporal Server 1.32.0",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.32.0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and leave history.enablePaginationTokenBranchValidation at its default of true and history.enablePaginationTokenBranchValidationShadowMode at its default of false. The fix loads mutable state for the namespace and workflow named in the authorized request together with the run identifier from the page token, requires the token\u0027s branch token to equal that execution\u0027s current branch token, and rejects the request before any history persistence read. It covers the forward decoded, forward raw, and reverse history paths; the forward long-poll refresh path independently replaces the caller\u0027s branch token with the authorized execution\u0027s current branch token before reading history. Temporal Server releases up to and including 1.29.7 are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line.\u003c/p\u003e"
}
],
"value": "Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and leave history.enablePaginationTokenBranchValidation at its default of true and history.enablePaginationTokenBranchValidationShadowMode at its default of false. The fix loads mutable state for the namespace and workflow named in the authorized request together with the run identifier from the page token, requires the token\u0027s branch token to equal that execution\u0027s current branch token, and rejects the request before any history persistence read. It covers the forward decoded, forward raw, and reverse history paths; the forward long-poll refresh path independently replaces the caller\u0027s branch token with the authorized execution\u0027s current branch token before reading history. Temporal Server releases up to and including 1.29.7 are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo setting in an affected release closes this issue, because the binding check does not exist there. Until upgrading, limit exposure by granting namespace read permission only to principals trusted with every namespace they can reach, revoking and reissuing credentials through a mechanism that does not leave prior pagination state usable, treating history page tokens as sensitive and keeping them out of application logs, traces, error reports, and shared storage, and reducing namespace retention so that a referenced history branch becomes unavailable sooner after a workflow closes. A Payload Codec reduces the sensitivity of disclosed payload bodies but does not prevent the unauthorized read or protect history metadata. A long-running open workflow can outlive its namespace\u0027s closed-execution retention duration, because that duration is measured from workflow closure.\u003c/p\u003e"
}
],
"value": "No setting in an affected release closes this issue, because the binding check does not exist there. Until upgrading, limit exposure by granting namespace read permission only to principals trusted with every namespace they can reach, revoking and reissuing credentials through a mechanism that does not leave prior pagination state usable, treating history page tokens as sensitive and keeping them out of application logs, traces, error reports, and shared storage, and reducing namespace retention so that a referenced history branch becomes unavailable sooner after a workflow closes. A Payload Codec reduces the sensitivity of disclosed payload bodies but does not prevent the unauthorized read or protect history metadata. A long-running open workflow can outlive its namespace\u0027s closed-execution retention duration, because that duration is measured from workflow closure."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-87857",
"datePublished": "2026-11-09T19:45:14.927Z",
"dateReserved": "2026-09-09T13:05:41.629Z",
"dateUpdated": "2026-11-09T19:45:14.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.