Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2790 vulnerabilities reference this CWE, most recent first.
CVE-2026-82869 (GCVE-0-2026-82869)
Vulnerability from cvelistv5 – Published: 2026-08-31 08:46 – Updated: 2026-08-31 18:51
VLAI
EPSS
VEX
Title
ToolJet Database before v3.16.44 Privilege Escalation via join_tables
Summary
ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:23 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ToolJet/ToolJet/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/tooljet-data… | third-party-advisory |
Impacted products
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:23:08.155732Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:51:42.638Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ToolJet",
"vendor": "ToolJet",
"versions": [
{
"lessThan": "3.16.44",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.16.44",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "geo-chen"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T08:46:38.842Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7vj5-wxfm-gmfq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ToolJet/ToolJet/security/advisories/GHSA-7vj5-wxfm-gmfq"
},
{
"name": "VulnCheck Advisory: ToolJet Database before v3.16.44 Privilege Escalation via join_tables",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tooljet-database-before-3.16.44-privilege-escalation-via-join-tables"
}
],
"title": "ToolJet Database before v3.16.44 Privilege Escalation via join_tables",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82869",
"datePublished": "2026-08-31T08:46:38.842Z",
"dateReserved": "2026-08-31T08:37:53.170Z",
"dateUpdated": "2026-08-31T18:51:42.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82816 (GCVE-0-2026-82816)
Vulnerability from cvelistv5 – Published: 2026-08-31 17:45 – Updated: 2026-08-31 18:41
VLAI
EPSS
VEX
Title
dibo-software diboot AI Session Endpoint ai-session authorization
Summary
A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:41 UTC
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397233 | vdb-entry |
| https://vuldb.com/vuln/397233/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82816 | third-party-advisory |
| https://vuldb.com/submit/876017 | third-party-advisory |
| https://drive.google.com/file/d/1-q66DxWFxQNmYF-1… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dibo-software | diboot |
Affected:
3.8.0
cpe:2.3:a:dibo-software:diboot:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82816",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:41:17.682905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:41:30.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dibo-software:diboot:*:*:*:*:*:*:*:*"
],
"modules": [
"AI Session Endpoint"
],
"product": "diboot",
"vendor": "dibo-software",
"versions": [
{
"status": "affected",
"version": "3.8.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Stephen Lin (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T17:45:09.357Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397233 | dibo-software diboot AI Session Endpoint ai-session authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/397233"
},
{
"name": "VDB-397233 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397233/cti"
},
{
"name": "CVE-2026-82816 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82816"
},
{
"name": "Submit #876017 | dibo-software diboot v3.8.0 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/876017"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1-q66DxWFxQNmYF-1lzkHOodibWmZlGA0/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-31T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-31T07:38:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "dibo-software diboot AI Session Endpoint ai-session authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82816",
"datePublished": "2026-08-31T17:45:09.357Z",
"dateReserved": "2026-08-31T05:33:07.233Z",
"dateUpdated": "2026-08-31T18:41:30.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82725 (GCVE-0-2026-82725)
Vulnerability from cvelistv5 – Published: 2026-08-31 03:09 – Updated: 2026-08-31 15:49
VLAI
EPSS
VEX
Title
AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.
AshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.
This issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
EEF
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_phoenix/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82725.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82725 | related |
| https://github.com/ash-project/ash_phoenix/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_phoenix |
Affected:
0.6.0-rc.1 , < 2.3.25
(semver)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|
| ash-project | ash_phoenix |
Affected:
06875682999938f607c970e71b6a80af90e18b3d , < a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b
(git)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:49:19.535082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:49:46.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-7xhg-xphm-f458"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.FilterForm\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/filter_form/filter_form.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "0.6.0-rc.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.FilterForm\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/filter_form/filter_form.ex"
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b",
"status": "affected",
"version": "06875682999938f607c970e71b6a80af90e18b3d",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe resource exposes an \u003ccode\u003eAshPhoenix.FilterForm\u003c/code\u003e whose params the attacker controls, and has a non-public relationship to data that should not be filterable.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The resource exposes an `AshPhoenix.FilterForm` whose params the attacker controls, and has a non-public relationship to data that should not be filterable."
}
],
"value": "The resource exposes an AshPhoenix.FilterForm whose params the attacker controls, and has a non-public relationship to data that should not be filterable."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "0.6.0-rc.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshPhoenix.FilterForm\u003c/code\u003e resolved every relationship hop in the user-supplied \u003ccode\u003epath\u003c/code\u003e with \u003ccode\u003eAsh.Resource.Info.related/2\u003c/code\u003e, which traverses private relationships, and only checked the terminal field for publicity. \u003ccode\u003eparse_path_and_field/2\u003c/code\u003e also rewrote a \u003ccode\u003efield\u003c/code\u003e naming a relationship into an extra path segment, so \u003ccode\u003efield=some_private_rel\u003c/code\u003e was accepted too. Both \u003ccode\u003epath\u003c/code\u003e and \u003ccode\u003efield\u003c/code\u003e come straight from form params, and the resulting ref went to \u003ccode\u003eAsh.Query.do_filter/2\u003c/code\u003e without the public-only enforcement of \u003ccode\u003eAsh.Filter.parse_input/2\u003c/code\u003e. The fix resolves each hop with \u003ccode\u003eAsh.Resource.Info.public_relationship/2\u003c/code\u003e, rejecting the first non-public hop, and requires the terminal field to be public.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.\n\n`AshPhoenix.FilterForm` resolved every relationship hop in the user-supplied `path` with `Ash.Resource.Info.related/2`, which traverses private relationships, and only checked the terminal field for publicity. `parse_path_and_field/2` also rewrote a `field` naming a relationship into an extra path segment, so `field=some_private_rel` was accepted too. Both `path` and `field` come straight from form params, and the resulting ref went to `Ash.Query.do_filter/2` without the public-only enforcement of `Ash.Filter.parse_input/2`. The fix resolves each hop with `Ash.Resource.Info.public_relationship/2`, rejecting the first non-public hop, and requires the terminal field to be public.\n\nThis issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data.\n\nAshPhoenix.FilterForm resolved every relationship hop in the user-supplied path with Ash.Resource.Info.related/2, which traverses private relationships, and only checked the terminal field for publicity. parse_path_and_field/2 also rewrote a field naming a relationship into an extra path segment, so field=some_private_rel was accepted too. Both path and field come straight from form params, and the resulting ref went to Ash.Query.do_filter/2 without the public-only enforcement of Ash.Filter.parse_input/2. The fix resolves each hop with Ash.Resource.Info.public_relationship/2, rejecting the first non-public hop, and requires the terminal field to be public.\n\nThis issue affects ash_phoenix: from 0.6.0-rc.1 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:09:25.850Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-7xhg-xphm-f458"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82725.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82725"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/a3691a3cb0947e8f2dc2c3cbff138a3e6197a15b"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82725",
"datePublished": "2026-08-31T03:09:25.850Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T15:49:46.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82685 (GCVE-0-2026-82685)
Vulnerability from cvelistv5 – Published: 2026-09-17 13:08 – Updated: 2026-09-17 18:23
VLAI
EPSS
VEX
Title
Confirmation token accepted on any record in AshAuthentication
Summary
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is accepted on any other user's record.
AshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token's signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim's record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library's own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record.
This issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:23 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
EEF
CNA
References
6 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| team-alembic | ash_authentication |
Affected:
0.5.0 , < 4.15.0
(semver)
Affected: 5.0.0-rc.0 , < 5.0.0-rc.14 (semver) cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* |
|
| team-alembic | ash_authentication |
Affected:
1d4bb00617aecae85c33f2ff5bc7e094c6449a6e , < *
(git)
cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82685",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:23:08.889793Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:23:51.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.AddOn.Confirmation.ConfirmChange\u0027"
],
"packageName": "ash_authentication",
"packageURL": "pkg:hex/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/add_ons/confirmation/confirm_change.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.AddOn.Confirmation.ConfirmChange\u0027:change/3"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"lessThan": "4.15.0",
"status": "affected",
"version": "0.5.0",
"versionType": "semver"
},
{
"lessThan": "5.0.0-rc.14",
"status": "affected",
"version": "5.0.0-rc.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAuthentication.AddOn.Confirmation.ConfirmChange\u0027"
],
"packageName": "team-alembic/ash_authentication",
"packageURL": "pkg:github/team-alembic/ash_authentication",
"product": "ash_authentication",
"programFiles": [
"lib/ash_authentication/add_ons/confirmation/confirm_change.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAuthentication.AddOn.Confirmation.ConfirmChange\u0027:change/3"
}
],
"repo": "https://github.com/team-alembic/ash_authentication",
"vendor": "team-alembic",
"versions": [
{
"changes": [
{
"at": "d7c15c21d39c009206e010cd67e2d86370fe7a28",
"status": "unaffected"
},
{
"at": "2a2396af131ab67e2f445b805fecce8e6ca86c0e",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "1d4bb00617aecae85c33f2ff5bc7e094c6449a6e",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.15.0",
"versionStartIncluding": "0.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:team-alembic:ash_authentication:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.0.0-rc.14",
"versionStartIncluding": "5.0.0-rc.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "James Harton"
},
{
"lang": "en",
"type": "analyst",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-09-11T17:35:42.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user\u0027s email address, and so take over that account. A confirmation token issued to one user is accepted on any other user\u0027s record.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAuthentication.AddOn.Confirmation.ConfirmChange\u003c/code\u003e verifies the token\u0027s signature and its \u003ccode\u003eact\u003c/code\u003e claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the \u003ccode\u003esub\u003c/code\u003e claim against \u003ccode\u003echangeset.data\u003c/code\u003e. An attacker who registers an account and changes their own email replays the resulting token against a victim\u0027s record id, writing in their own address with \u003ccode\u003eforce_change_attributes/2\u003c/code\u003e and stamping \u003ccode\u003econfirmed_at\u003c/code\u003e, after which an ordinary password reset yields the account. The library\u0027s own confirmation flow is unaffected, because \u003ccode\u003eAshAuthentication.AddOn.Confirmation.Actions.confirm/3\u003c/code\u003e resolves \u003ccode\u003esub\u003c/code\u003e to a user and targets that record.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user\u0027s email address, and so take over that account. A confirmation token issued to one user is accepted on any other user\u0027s record.\n\n`AshAuthentication.AddOn.Confirmation.ConfirmChange` verifies the token\u0027s signature and its `act` claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the `sub` claim against `changeset.data`. An attacker who registers an account and changes their own email replays the resulting token against a victim\u0027s record id, writing in their own address with `force_change_attributes/2` and stamping `confirmed_at`, after which an ordinary password reset yields the account. The library\u0027s own confirmation flow is unaffected, because `AshAuthentication.AddOn.Confirmation.Actions.confirm/3` resolves `sub` to a user and targets that record.\n\nThis issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user\u0027s email address, and so take over that account. A confirmation token issued to one user is accepted on any other user\u0027s record.\n\nAshAuthentication.AddOn.Confirmation.ConfirmChange verifies the token\u0027s signature and its act claim, then applies the changes stored against that token to whichever record the changeset targets, never comparing the sub claim against changeset.data. An attacker who registers an account and changes their own email replays the resulting token against a victim\u0027s record id, writing in their own address with force_change_attributes/2 and stamping confirmed_at, after which an ordinary password reset yields the account. The library\u0027s own confirmation flow is unaffected, because AshAuthentication.AddOn.Confirmation.Actions.confirm/3 resolves sub to a user and targets that record.\n\nThis issue affects ash_authentication: from 0.5.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T13:08:56.491Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/team-alembic/ash_authentication/security/advisories/GHSA-g636-26vf-2w63"
},
{
"name": "EEF CNA record for CVE-2026-82685",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82685.html"
},
{
"name": "OSV record EEF-CVE-2026-82685",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82685"
},
{
"name": "Introducing commit 1d4bb00 in team-alembic/ash_authentication",
"tags": [
"related"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/1d4bb00617aecae85c33f2ff5bc7e094c6449a6e"
},
{
"name": "Fix commit d7c15c2 in team-alembic/ash_authentication",
"tags": [
"patch"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/d7c15c21d39c009206e010cd67e2d86370fe7a28"
},
{
"name": "Fix commit 2a2396a in team-alembic/ash_authentication",
"tags": [
"patch"
],
"url": "https://github.com/team-alembic/ash_authentication/commit/2a2396af131ab67e2f445b805fecce8e6ca86c0e"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Confirmation token accepted on any record in AshAuthentication"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82685",
"datePublished": "2026-09-17T13:08:56.491Z",
"dateReserved": "2026-08-31T00:45:02.436Z",
"dateUpdated": "2026-09-17T18:23:51.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82621 (GCVE-0-2026-82621)
Vulnerability from cvelistv5 – Published: 2026-08-31 05:45 – Updated: 2026-08-31 14:32
VLAI
EPSS
VEX
Title
Soarkey StudentManagement/学生信息管理系统 Administrative Servlet AdminDao.java AdminDao.doGet authorization
Summary
A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:32 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397121 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/397121/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82621 | third-party-advisory |
| https://vuldb.com/submit/893104 | third-party-advisory |
| https://github.com/Soarkey/StudentManagement/issues/32 | exploitissue-tracking |
| https://github.com/Soarkey/StudentManagement/ | product |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Soarkey | StudentManagement |
Affected:
e08f7f1d5015af407aa4cca0ada3dea189b4937e
cpe:2.3:a:soarkey:studentmanagement:*:*:*:*:*:*:*:* |
|
| Soarkey | 学生信息管理系统 |
Affected:
e08f7f1d5015af407aa4cca0ada3dea189b4937e
cpe:2.3:a:soarkey:_:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82621",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:32:22.171781Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:32:31.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:soarkey:studentmanagement:*:*:*:*:*:*:*:*"
],
"modules": [
"Administrative Servlet"
],
"product": "StudentManagement",
"vendor": "Soarkey",
"versions": [
{
"status": "affected",
"version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"
}
]
},
{
"cpes": [
"cpe:2.3:a:soarkey:_:*:*:*:*:*:*:*:*"
],
"modules": [
"Administrative Servlet"
],
"product": "\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf",
"vendor": "Soarkey",
"versions": [
{
"status": "affected",
"version": "e08f7f1d5015af407aa4cca0ada3dea189b4937e"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "soulinda (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Soarkey StudentManagement and \u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T05:45:09.136Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397121 | Soarkey StudentManagement/\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf Administrative Servlet AdminDao.java AdminDao.doGet authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/397121"
},
{
"name": "VDB-397121 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397121/cti"
},
{
"name": "CVE-2026-82621 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82621"
},
{
"name": "Submit #893104 | Soarkey StudentManagement e08f7f1d5015af407aa4cca0ada3dea189b4937e Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/893104"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Soarkey/StudentManagement/issues/32"
},
{
"tags": [
"product"
],
"url": "https://github.com/Soarkey/StudentManagement/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T10:05:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "Soarkey StudentManagement/\u5b66\u751f\u4fe1\u606f\u7ba1\u7406\u7cfb\u7edf Administrative Servlet AdminDao.java AdminDao.doGet authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82621",
"datePublished": "2026-08-31T05:45:09.136Z",
"dateReserved": "2026-08-30T08:00:04.628Z",
"dateUpdated": "2026-08-31T14:32:31.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82602 (GCVE-0-2026-82602)
Vulnerability from cvelistv5 – Published: 2026-08-31 01:30 – Updated: 2026-08-31 16:14 X_Freeware
VLAI
EPSS
VEX
Title
SeaCMS ass.php authorization
Summary
A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:13 UTC
Assigner
VulDB
CNA
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/397104 | vdb-entry |
| https://vuldb.com/vuln/397104/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-82602 | third-party-advisory |
| https://vuldb.com/submit/892789 | third-party-advisory |
| https://github.com/T-Chachamaru/seacms-13.6-secur… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82602",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:13:36.227900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:14:05.509Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:seacms:seacms:*:*:*:*:*:*:*:*"
],
"product": "SeaCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "13.0"
},
{
"status": "affected",
"version": "13.1"
},
{
"status": "affected",
"version": "13.2"
},
{
"status": "affected",
"version": "13.3"
},
{
"status": "affected",
"version": "13.4"
},
{
"status": "affected",
"version": "13.5"
},
{
"status": "affected",
"version": "13.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "T-Chachamaru (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T01:30:09.315Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-397104 | SeaCMS ass.php authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/397104"
},
{
"name": "VDB-397104 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/397104/cti"
},
{
"name": "CVE-2026-82602 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-82602"
},
{
"name": "Submit #892789 | SeaCMS 13.6 Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/892789"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/T-Chachamaru/seacms-13.6-security-advisories/blob/a084a3e573240d54860153321df271280daec262/c-011-ass-paywall-url-disclosure.md"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-30T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-30T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-30T08:47:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "SeaCMS ass.php authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-82602",
"datePublished": "2026-08-31T01:30:09.315Z",
"dateReserved": "2026-08-30T06:42:39.909Z",
"dateUpdated": "2026-08-31T16:14:05.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82582 (GCVE-0-2026-82582)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:09 – Updated: 2026-09-10 12:58
VLAI
EPSS
VEX
Summary
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 12:58 UTC
CWE
- CWE-639 - Authorization bypass through user-controlled key
Assigner
jpcert
CNA
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SHIRASAGI Project | SHIRASAGI |
Affected:
0 , ≤ v1.20.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T12:58:39.791596Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T12:58:59.489Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SHIRASAGI",
"vendor": "SHIRASAGI Project",
"versions": [
{
"lessThanOrEqual": "v1.20.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware\u0027s shared file feature."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization bypass through user-controlled key",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:09:30.059Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://jvn.jp/en/jp/JVN37476837/"
},
{
"url": "https://www.ss-proj.org/support/1710.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2026-82582",
"datePublished": "2026-09-10T06:09:30.059Z",
"dateReserved": "2026-09-04T00:27:37.395Z",
"dateUpdated": "2026-09-10T12:58:59.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82564 (GCVE-0-2026-82564)
Vulnerability from cvelistv5 – Published: 2026-08-31 01:06 – Updated: 2026-09-01 17:18
VLAI
EPSS
VEX
Title
Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table.
In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {"public_ref": {"not_eq": "<own-ref>"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs.
This issue affects ash_ai: from 0.6.0 before 1.0.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:04 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
EEF
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_ai/security/ad… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82564.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82564 | related |
| https://github.com/ash-project/ash_ai/commit/87f6… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_ai |
Affected:
0.6.0 , < 1.0.0
(semver)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
|
| ash-project | ash_ai |
Affected:
bc2122f78fca6c11d8ec2b9ac53148ec17476460 , < 87f616d5bfbf7af43346f0701ae17f853789a602
(git)
cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82564",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:04:09.440960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T16:05:10.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-jg86-xh36-h5xc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash_ai",
"packageURL": "pkg:hex/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:identity_filter/3"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.0.0",
"status": "affected",
"version": "0.6.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAi.Tool.Execution\u0027"
],
"packageName": "ash-project/ash_ai",
"packageURL": "pkg:github/ash-project/ash_ai",
"product": "ash_ai",
"programFiles": [
"lib/ash_ai/tool/execution.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAi.Tool.Execution\u0027:identity_filter/3"
}
],
"repo": "https://github.com/ash-project/ash_ai",
"vendor": "ash-project",
"versions": [
{
"lessThan": "87f616d5bfbf7af43346f0701ae17f853789a602",
"status": "affected",
"version": "bc2122f78fca6c11d8ec2b9ac53148ec17476460",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_ai:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.0",
"versionStartIncluding": "0.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an \u003ccode\u003eidentity\u003c/code\u003e-configured tool to update or destroy records it never identified, including every row in the table.\u003c/p\u003e\n\u003cp\u003eIn \u003ccode\u003eAshAi.Tool.Execution\u003c/code\u003e, \u003ccode\u003eidentity_filter/3\u003c/code\u003e built the update/destroy filter directly from the raw tool arguments as \u003ccode\u003e[{key, Map.get(arguments, to_string(key))}]\u003c/code\u003e and passed it to \u003ccode\u003eAsh.Query.do_filter/2\u003c/code\u003e. A map value is parsed as a predicate expression rather than a literal, so a caller can send \u003ccode\u003e{\"public_ref\": {\"not_eq\": \"\u0026lt;own-ref\u0026gt;\"}}\u003c/code\u003e and, combined with \u003ccode\u003eAsh.Query.limit(1)\u003c/code\u003e and \u003ccode\u003eAsh.bulk_update!\u003c/code\u003e/\u003ccode\u003eAsh.bulk_destroy!\u003c/code\u003e, retarget the write at a record it never identified; an omitted key yields an \u003ccode\u003eIS NULL\u003c/code\u003e filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_ai: from 0.6.0 before 1.0.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an `identity`-configured tool to update or destroy records it never identified, including every row in the table.\n\nIn `AshAi.Tool.Execution`, `identity_filter/3` built the update/destroy filter directly from the raw tool arguments as `[{key, Map.get(arguments, to_string(key))}]` and passed it to `Ash.Query.do_filter/2`. A map value is parsed as a predicate expression rather than a literal, so a caller can send `{\"public_ref\": {\"not_eq\": \"\u003cown-ref\u003e\"}}` and, combined with `Ash.Query.limit(1)` and `Ash.bulk_update!`/`Ash.bulk_destroy!`, retarget the write at a record it never identified; an omitted key yields an `IS NULL` filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs.\n\nThis issue affects ash_ai: from 0.6.0 before 1.0.0."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table.\n\nIn AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression rather than a literal, so a caller can send {\"public_ref\": {\"not_eq\": \"\u003cown-ref\u003e\"}} and, combined with Ash.Query.limit(1) and Ash.bulk_update!/Ash.bulk_destroy!, retarget the write at a record it never identified; an omitted key yields an IS NULL filter that matches an arbitrary row. The fix casts each identity value to the field type, rejecting non-scalar inputs.\n\nThis issue affects ash_ai: from 0.6.0 before 1.0.0."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T17:18:18.459Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_ai/security/advisories/GHSA-jg86-xh36-h5xc"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82564.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82564"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_ai/commit/87f616d5bfbf7af43346f0701ae17f853789a602"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82564",
"datePublished": "2026-08-31T01:06:00.526Z",
"dateReserved": "2026-08-30T20:00:01.856Z",
"dateUpdated": "2026-09-01T17:18:18.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82441 (GCVE-0-2026-82441)
Vulnerability from cvelistv5 – Published: 2026-09-14 13:58 – Updated: 2026-09-14 19:44
VLAI
EPSS
VEX
Title
Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
Summary
Description
A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`,
which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their
contents on the submission path, yet acts on them in two places.
During cleanup of a finished topology, Nimbus deletes the keys named in those lists, and the deletion is
performed as the Nimbus subject, for which the blobstore short-circuits its ACL check. A submitter who
listed a key belonging to another topology, such as its `-stormjar.jar`, could therefore cause
that blob to be deleted when their own topology was cleaned up.
Separately, on acquiring leadership a Nimbus compares the dependency keys of all active topologies against
the blobstore contents and surrenders leadership if any is missing. A single key that does not exist, on a
single active topology, therefore causes every Nimbus to acquire leadership, surrender it and requeue
indefinitely, leaving the cluster without a leader and unable to schedule, clean up or accept submissions.
Mitigation
Upgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key
and exists in the blobstore.
Note that this validates new submissions only; a topology stored by an affected version with an invalid list
is unaffected by the upgrade. An operator whose cluster is failing to retain a leader should inspect the
Nimbus log for the dependency keys reported as missing and remove or resubmit the topology naming them.
Users who cannot upgrade immediately should restrict topology submission to trusted principals.
Credit
This issue was discovered by rzo1 while investigating an unrelated blobstore defect.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:44 UTC
Assigner
apache
CNA
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/qzh245bczoxw4mfny… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Storm Nimbus |
Affected:
3.0.0 , < 3.1.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-14T14:13:47.952Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/13/19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82441",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:44:09.400617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:44:33.448Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.storm:storm-server",
"product": "Apache Storm Nimbus",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.1.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "rzo1"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003eDescription\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eA submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`,\u003cbr\u003ewhich the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their\u003cbr\u003econtents on the submission path, yet acts on them in two places.\u003cbr\u003e\u003cbr\u003eDuring cleanup of a finished topology, Nimbus deletes the keys named in those lists, and the deletion is\u003cbr\u003eperformed as the Nimbus subject, for which the blobstore short-circuits its ACL check. A submitter who\u003cbr\u003elisted a key belonging to another topology, such as its `-stormjar.jar`, could therefore cause\u003cbr\u003ethat blob to be deleted when their own topology was cleaned up.\u003cbr\u003e\u003cbr\u003eSeparately, on acquiring leadership a Nimbus compares the dependency keys of all active topologies against\u003cbr\u003ethe blobstore contents and surrenders leadership if any is missing. A single key that does not exist, on a\u003cbr\u003esingle active topology, therefore causes every Nimbus to acquire leadership, surrender it and requeue\u003cbr\u003eindefinitely, leaving the cluster without a leader and unable to schedule, clean up or accept submissions.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eMitigation\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eUpgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key\u003cbr\u003eand exists in the blobstore.\u003cbr\u003e\u003cbr\u003eNote that this validates new submissions only; a topology stored by an affected version with an invalid list\u003cbr\u003eis unaffected by the upgrade. An operator whose cluster is failing to retain a leader should inspect the\u003cbr\u003eNimbus log for the dependency keys reported as missing and remove or resubmit the topology naming them.\u003cbr\u003e\u003cbr\u003eUsers who cannot upgrade immediately should restrict topology submission to trusted principals.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eCredit\u003c/b\u003e\u003cbr\u003e\u003cbr\u003eThis issue was discovered by rzo1 while investigating an unrelated blobstore defect.\u003cbr\u003e"
}
],
"value": "Description\n\nA submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`,\nwhich the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their\ncontents on the submission path, yet acts on them in two places.\n\nDuring cleanup of a finished topology, Nimbus deletes the keys named in those lists, and the deletion is\nperformed as the Nimbus subject, for which the blobstore short-circuits its ACL check. A submitter who\nlisted a key belonging to another topology, such as its `-stormjar.jar`, could therefore cause\nthat blob to be deleted when their own topology was cleaned up.\n\nSeparately, on acquiring leadership a Nimbus compares the dependency keys of all active topologies against\nthe blobstore contents and surrenders leadership if any is missing. A single key that does not exist, on a\nsingle active topology, therefore causes every Nimbus to acquire leadership, surrender it and requeue\nindefinitely, leaving the cluster without a leader and unable to schedule, clean up or accept submissions.\n\nMitigation\n\nUpgrade to 3.1.0, where a submission is refused unless every entry in both lists is a dependency blob key\nand exists in the blobstore.\n\nNote that this validates new submissions only; a topology stored by an affected version with an invalid list\nis unaffected by the upgrade. An operator whose cluster is failing to retain a leader should inspect the\nNimbus log for the dependency keys reported as missing and remove or resubmit the topology naming them.\n\nUsers who cannot upgrade immediately should restrict topology submission to trusted principals.\n\nCredit\n\nThis issue was discovered by rzo1 while investigating an unrelated blobstore defect."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:58:56.249Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/qzh245bczoxw4mfnyvrj3dj2crtzdso8"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-82441",
"datePublished": "2026-09-14T13:58:56.249Z",
"dateReserved": "2026-08-29T10:43:56.799Z",
"dateUpdated": "2026-09-14T19:44:33.448Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82411 (GCVE-0-2026-82411)
Vulnerability from cvelistv5 – Published: 2026-10-28 22:40 – Updated: 2026-10-29 17:20
VLAI
EPSS
VEX
Title
Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Summary
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint `GET /api/v2/objects/{uuid}/{index}`. The `history_detail` action in `src/objects/api/v2/views.py` calls `self.get_queryset()` and `get_object_or_404` directly instead of `self.get_object()`, so `check_object_permissions` and the per-object check in `ObjectTypeBasedPermission.has_object_permission` are not invoked. The queryset's `filter_for_token` applies only to the list and search actions, while `ObjectTypeBasedPermission.has_permission` allows non-create actions, leaving neither check to constrain history-detail records to the token's permitted ObjectType. The normal retrieve endpoint returns 403 for the same unauthorized object, and the sibling history action enforces the grant. Any valid non-superuser API token with a read grant on at least one ObjectType can therefore disclose another ObjectType's complete versioned object `data`, which can include citizen or case records and sensitive identifiers in government deployments. This issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:30 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
GitHub_M
CNA
References
9 references
| URL | Tags |
|---|---|
| https://github.com/maykinmedia/open-object/securi… | x_refsource_CONFIRM |
| https://github.com/maykinmedia/open-object/commit… | x_refsource_MISC |
| https://github.com/maykinmedia/open-object/commit… | x_refsource_MISC |
| https://github.com/maykinmedia/open-object/commit… | x_refsource_MISC |
| https://github.com/maykinmedia/open-object/commit… | x_refsource_MISC |
| https://github.com/maykinmedia/open-object/tree/2.5.1 | x_refsource_MISC |
| https://github.com/maykinmedia/open-object/tree/3.6.2 | x_refsource_MISC |
| https://github.com/maykinmedia/open-object/tree/4.0.2 | x_refsource_MISC |
| https://github.com/maykinmedia/open-object/tree/4.1.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| maykinmedia | open-object |
Affected:
>= 2.4.3, < 2.5.1
Affected: >= 3.0.0, < 3.6.2 Affected: >= 4.0.0-rc.1, < 4.0.2 Affected: >= 4.1.0, < 4.1.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82411",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:30:00.984556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T17:20:57.039Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "open-object",
"vendor": "maykinmedia",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.4.3, \u003c 2.5.1"
},
{
"status": "affected",
"version": "\u003e= 3.0.0, \u003c 3.6.2"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-rc.1, \u003c 4.0.2"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint `GET /api/v2/objects/{uuid}/{index}`. The `history_detail` action in `src/objects/api/v2/views.py` calls `self.get_queryset()` and `get_object_or_404` directly instead of `self.get_object()`, so `check_object_permissions` and the per-object check in `ObjectTypeBasedPermission.has_object_permission` are not invoked. The queryset\u0027s `filter_for_token` applies only to the list and search actions, while `ObjectTypeBasedPermission.has_permission` allows non-create actions, leaving neither check to constrain history-detail records to the token\u0027s permitted ObjectType. The normal retrieve endpoint returns 403 for the same unauthorized object, and the sibling history action enforces the grant. Any valid non-superuser API token with a read grant on at least one ObjectType can therefore disclose another ObjectType\u0027s complete versioned object `data`, which can include citizen or case records and sensitive identifiers in government deployments. This issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T22:40:13.728Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/maykinmedia/open-object/security/advisories/GHSA-55w6-rqp5-j5wx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/maykinmedia/open-object/security/advisories/GHSA-55w6-rqp5-j5wx"
},
{
"name": "https://github.com/maykinmedia/open-object/commit/11c5b85ea5d1d80f940883f01b8b8ea80ccdd47c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/commit/11c5b85ea5d1d80f940883f01b8b8ea80ccdd47c"
},
{
"name": "https://github.com/maykinmedia/open-object/commit/27e806eff04c52ebe1e78126c288b63fc0308b52",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/commit/27e806eff04c52ebe1e78126c288b63fc0308b52"
},
{
"name": "https://github.com/maykinmedia/open-object/commit/6154d9c2ed8c162b61f2d42db2de4eda5081347f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/commit/6154d9c2ed8c162b61f2d42db2de4eda5081347f"
},
{
"name": "https://github.com/maykinmedia/open-object/commit/ce6b1820619c843748bc5231597aa7fc060d95fe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/commit/ce6b1820619c843748bc5231597aa7fc060d95fe"
},
{
"name": "https://github.com/maykinmedia/open-object/tree/2.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/tree/2.5.1"
},
{
"name": "https://github.com/maykinmedia/open-object/tree/3.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/tree/3.6.2"
},
{
"name": "https://github.com/maykinmedia/open-object/tree/4.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/tree/4.0.2"
},
{
"name": "https://github.com/maykinmedia/open-object/tree/4.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maykinmedia/open-object/tree/4.1.1"
}
],
"source": {
"advisory": "GHSA-55w6-rqp5-j5wx",
"discovery": "UNKNOWN"
},
"title": "Objects API: Cross-object-type authorization bypass on the object history-detail endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-82411",
"datePublished": "2026-10-28T22:40:13.728Z",
"dateReserved": "2026-08-28T22:00:43.514Z",
"dateUpdated": "2026-10-29T17:20:57.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.