Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
2790 vulnerabilities reference this CWE, most recent first.
CVE-2026-78064 (GCVE-0-2026-78064)
Vulnerability from cvelistv5 – Published: 2026-09-03 11:54 – Updated: 2026-09-03 12:36
VLAI
EPSS
VEX
Title
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
Summary
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml` grants the `carts` view's tasks a wildcard `true` ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. `J2StoreControllerCarts` already scoped `remove()` to the caller's own session, but never overrode the generic FOF `save` task, so it remained reachable to insert new cart rows with an attacker-chosen `user_id`/`session_id`, or overwrite an existing row by id.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 12:26 UTC
CWE
- CWE-639 - (Authorization Bypass Through User-Controlled Key)
Assigner
Joomla
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.j2commerce.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| j2commerce.com | J2Store extension for Joomla |
Affected:
1.0.0-3.3.21
Affected: 4.0.0-4.0.21 Affected: 4.1.0-4.1.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78064",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T12:26:12.633521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T12:26:19.853Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "J2Store extension for Joomla",
"vendor": "j2commerce.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-3.3.21"
},
{
"status": "affected",
"version": "4.0.0-4.0.21"
},
{
"status": "affected",
"version": "4.1.0-4.1.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor, mysites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml` grants the `carts` view\u0027s tasks a wildcard `true` ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. `J2StoreControllerCarts` already scoped `remove()` to the caller\u0027s own session, but never overrode the generic FOF `save` task, so it remained reachable to insert new cart rows with an attacker-chosen `user_id`/`session_id`, or overwrite an existing row by id."
}
],
"value": "Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml` grants the `carts` view\u0027s tasks a wildcard `true` ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end `format=raw` requests. `J2StoreControllerCarts` already scoped `remove()` to the caller\u0027s own session, but never overrode the generic FOF `save` task, so it remained reachable to insert new cart rows with an attacker-chosen `user_id`/`session_id`, or overwrite an existing row by id."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 (Authorization Bypass Through User-Controlled Key)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T12:36:17.415Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.j2commerce.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-78064",
"datePublished": "2026-09-03T11:54:08.376Z",
"dateReserved": "2026-08-22T11:33:08.526Z",
"dateUpdated": "2026-09-03T12:36:17.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78026 (GCVE-0-2026-78026)
Vulnerability from cvelistv5 – Published: 2026-10-09 09:21 – Updated: 2026-10-10 12:16
VLAI
EPSS
VEX
Summary
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 03:55 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
dell
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.dell.com/support/kbdoc/en-ca/00050359… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dell | Secure Connect Gateway (SCG) Policy Manager |
Affected:
0 , < 5.36.00.16 or later
(semver)
|
Date Public
2026-08-31 06:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78026",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T03:55:38.665477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T12:16:43.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Connect Gateway (SCG) Policy Manager",
"vendor": "Dell",
"versions": [
{
"lessThan": "5.36.00.16 or later",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-08-31T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."
}
],
"value": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T09:21:05.227Z",
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"assignerShortName": "dell",
"cveId": "CVE-2026-78026",
"datePublished": "2026-10-09T09:21:05.227Z",
"dateReserved": "2026-08-21T23:04:41.426Z",
"dateUpdated": "2026-10-10T12:16:43.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78023 (GCVE-0-2026-78023)
Vulnerability from cvelistv5 – Published: 2026-10-09 09:06 – Updated: 2026-10-10 12:12
VLAI
EPSS
VEX
Summary
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-10 03:55 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
dell
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.dell.com/support/kbdoc/en-ca/00050359… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dell | Secure Connect Gateway (SCG) Policy Manager |
Affected:
0 , < 5.36.00.16 or later
(semver)
|
Date Public
2026-08-31 06:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78023",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-10T03:55:40.063257Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T12:12:45.753Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Connect Gateway (SCG) Policy Manager",
"vendor": "Dell",
"versions": [
{
"lessThan": "5.36.00.16 or later",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-08-31T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."
}
],
"value": "Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T09:06:35.949Z",
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"assignerShortName": "dell",
"cveId": "CVE-2026-78023",
"datePublished": "2026-10-09T09:06:35.949Z",
"dateReserved": "2026-08-21T23:04:41.426Z",
"dateUpdated": "2026-10-10T12:12:45.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77998 (GCVE-0-2026-77998)
Vulnerability from cvelistv5 – Published: 2026-08-25 12:50 – Updated: 2026-09-08 10:38
VLAI
EPSS
VEX
Title
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4
Summary
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:38 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Joomla
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.miniorange.com/ | product |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| miniorange.com | SAML SSO Free for Joomla extension for Joomla |
Affected:
1.0.0-11.0.1
|
|
| miniorange.com | SAML SSO Basic for Joomla extension for Joomla |
Affected:
1.0.0-13.1.0
|
|
| miniorange.com | SAML SSO Standard for Joomla extension for Joomla |
Affected:
1.0.0-24.1.0
|
|
| miniorange.com | SAML SSO Premium for Joomla extension for Joomla |
Affected:
1.0.0-34.1.0
|
|
| miniorange.com | SAML SSO Enterprise for Joomla extension for Joomla |
Affected:
1.0.0-44.1.0
|
|
| miniorange.com | SAML SP Single Sign On – Login with ADFS extension for Joomla |
Affected:
1.0.0-6.3.0
|
|
| miniorange.com | SAML SSO login with Google Apps extension for Joomla |
Affected:
1.0.0-6.3.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T14:38:55.305998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T14:51:54.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAML SSO Free for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.0.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Basic for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Standard for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-24.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Premium for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-34.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Enterprise for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-44.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SP Single Sign On \u2013 Login with ADFS extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO login with Google Apps extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
},
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor, mysites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO \u003c 11.0.2, SAML SP Single Sign On \u2013 Login with ADFS \u003c 6.4, SAML SP Single Sign On \u2013 SAML SSO login with Google Apps \u003c 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP\u0027s openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error \u2014 bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account."
}
],
"value": "Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO \u003c 11.0.2, SAML SP Single Sign On \u2013 Login with ADFS \u003c 6.4, SAML SP Single Sign On \u2013 SAML SSO login with Google Apps \u003c 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP\u0027s openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error \u2014 bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T10:38:41.779Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.miniorange.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO \u003c 11.0.2, SAML SP Single Sign On \u2013 Login with ADFS \u003c 6.4, SAML SP Single Sign On \u2013 SAML SSO login with Google Apps \u003c 6.4",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-77998",
"datePublished": "2026-08-25T12:50:46.506Z",
"dateReserved": "2026-08-21T19:23:55.924Z",
"dateUpdated": "2026-09-08T10:38:41.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77995 (GCVE-0-2026-77995)
Vulnerability from cvelistv5 – Published: 2026-08-24 13:05 – Updated: 2026-09-08 10:32
VLAI
EPSS
VEX
Title
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2
Summary
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 17:25 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Joomla
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.miniorange.com/ | product |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| miniorange.com | miniOrange OAuth Client (free) extension for Joomla |
Affected:
1.0.0-3.1.9
|
|
| miniorange.com | OAuth Single Sign-On – OIDC SSO | Login with Azure AD (free) extension for Joomla |
Affected:
1.0.0-1.2.1
|
|
| miniorange.com | Login with Keycloak OAuth Single Sign-On (SSO) (free) extension for Joomla |
Affected:
1.0.0-1.2.1
|
|
| miniorange.com | Single Sign-On for Educational Institutes (free) extension for Joomla |
Affected:
1.0.0-1.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T17:25:41.162522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:26:02.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "miniOrange OAuth Client (free) extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-3.1.9"
}
]
},
{
"defaultStatus": "unaffected",
"product": "OAuth Single Sign-On \u2013 OIDC SSO | Login with Azure AD (free) extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Login with Keycloak OAuth Single Sign-On (SSO) (free) extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single Sign-On for Educational Institutes (free) extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c, CERT PL"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client \u003c 3.2.0, OAuth Single Sign-On \u2013 OIDC SSO \u003c 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) \u003c 1.2.2, Single Sign-On for Educational Institutes \u003c 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins."
}
],
"value": "Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client \u003c 3.2.0, OAuth Single Sign-On \u2013 OIDC SSO \u003c 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) \u003c 1.2.2, Single Sign-On for Educational Institutes \u003c 1.2.2 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T10:32:27.629Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.miniorange.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client \u003c 3.2.0, OAuth Single Sign-On \u2013 OIDC SSO \u003c 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) \u003c 1.2.2, Single Sign-On for Educational Institutes \u003c 1.2.2",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-77995",
"datePublished": "2026-08-24T13:05:26.952Z",
"dateReserved": "2026-08-21T19:23:55.924Z",
"dateUpdated": "2026-09-08T10:32:27.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77990 (GCVE-0-2026-77990)
Vulnerability from cvelistv5 – Published: 2026-08-27 05:47 – Updated: 2026-08-28 07:45
VLAI
EPSS
VEX
Title
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1
Summary
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:03 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Joomla
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.joomlaeventmanager.net/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| joomlaeventmanager.net | JEM - Joomla Event Manager extension for Joomla |
Affected:
1.0.0-5.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77990",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:03:40.941720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:05:32.010Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "JEM - Joomla Event Manager extension for Joomla",
"vendor": "joomlaeventmanager.net",
"versions": [
{
"status": "affected",
"version": "1.0.0-5.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor, mysites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager \u003c 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events."
}
],
"value": "Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager \u003c 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T07:45:30.323Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.joomlaeventmanager.net/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager \u003c 5.0.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-77990",
"datePublished": "2026-08-27T05:47:51.963Z",
"dateReserved": "2026-08-21T19:05:09.013Z",
"dateUpdated": "2026-08-28T07:45:30.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77937 (GCVE-0-2026-77937)
Vulnerability from cvelistv5 – Published: 2026-10-20 00:46 – Updated: 2026-10-20 13:48 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header
Summary
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 13:48 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://www.lasso.security/vulnerability-database… | technical-descriptionexploit |
| https://github.com/letta-ai/letta/blob/1131535716… | technical-description |
| https://www.vulncheck.com/advisories/letta-throug… | third-party-advisory |
Impacted products
Date Public
2026-10-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77937",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T13:48:24.242241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:48:37.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/letta",
"product": "letta",
"repo": "https://github.com/letta-ai/letta",
"vendor": "letta-ai",
"versions": [
{
"lessThanOrEqual": "0.16.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:letta:letta:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.16.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Noy Pearl"
},
{
"lang": "en",
"type": "finder",
"value": "Michael Sromin"
},
{
"lang": "en",
"type": "finder",
"value": "Ophir Dror"
}
],
"datePublic": "2026-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant\u0027s ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user\u0027s agents, memory and configuration."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T00:46:14.829Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Lasso.security Advisory",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.lasso.security/vulnerability-database/cve-2026-77937"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/letta-ai/letta/blob/1131535716e8a31c9a437f8695e25ac98f203a24/letta/server/rest_api/dependencies.py#L39"
},
{
"name": "VulnCheck Advisory: Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/letta-through-0.16.8-cross-tenant-impersonation-via-user-id-header"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-77937",
"datePublished": "2026-10-20T00:46:14.829Z",
"dateReserved": "2026-08-21T17:52:36.080Z",
"dateUpdated": "2026-10-20T13:48:37.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77935 (GCVE-0-2026-77935)
Vulnerability from cvelistv5 – Published: 2026-10-20 00:46 – Updated: 2026-10-20 13:29
VLAI
EPSS
VEX
Title
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
Summary
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 13:29 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://www.lasso.security/vulnerability-database… | technical-descriptionexploit |
| https://github.com/coze-dev/coze-studio/blob/72ce… | technical-description |
| https://www.vulncheck.com/advisories/coze-studio-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| coze-dev | coze-studio |
Affected:
0 , ≤ 0.5.1
(semver)
cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:* |
Date Public
2026-10-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77935",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T13:29:34.650817Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:29:43.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/coze-dev/coze-studio",
"product": "coze-studio",
"repo": "https://github.com/coze-dev/coze-studio",
"vendor": "coze-dev",
"versions": [
{
"lessThanOrEqual": "0.5.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coze:coze_studio:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Noy Pearl"
},
{
"lang": "en",
"type": "finder",
"value": "Michael Sromin"
},
{
"lang": "en",
"type": "finder",
"value": "Ophir Dror"
}
],
"datePublic": "2026-10-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces\u0027 workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant\u0027s workflowID in save, update_meta, batch_delete, canvas, test_run and nodeDebug routes to read, run, overwrite or delete workflows."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T00:46:13.474Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Lasso.security Advisory",
"tags": [
"technical-description",
"exploit"
],
"url": "https://www.lasso.security/vulnerability-database/cve-2026-77935"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/coze-dev/coze-studio/blob/72cecff858a5a18662c5d9d1a4764c53ebc98317/backend/application/workflow/workflow.go#L303"
},
{
"name": "VulnCheck Advisory: Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-cross-space-workflow-idor-via-workflow-api-handlers"
}
],
"title": "Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-77935",
"datePublished": "2026-10-20T00:46:13.474Z",
"dateReserved": "2026-08-21T17:52:36.080Z",
"dateUpdated": "2026-10-20T13:29:43.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77780 (GCVE-0-2026-77780)
Vulnerability from cvelistv5 – Published: 2026-08-21 12:12 – Updated: 2026-08-21 16:12 X_Open Source
VLAI
EPSS
VEX
Title
Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers
Summary
Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus
Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting
creation permissions to disclose another company's bank account name, bank name and card
last four digits via a bank_account_id or bank_card_id belonging to that company in POST
/transaction/save, which is persisted and rendered without any company ownership check.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 15:56 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Secur0
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Roskus/prospero-flow-crm/commi… | patch |
| https://github.com/Roskus/prospero-flow-crm/pull/261 | issue-tracking |
| https://secur0.com/en/cna/cve-list/cve-2026-77780… | technical-descriptionthird-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Roskus | Prospero Flow CRM |
Affected:
4.9.1 , < 5.14.2
(semver)
cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:* |
Date Public
2026-08-21 12:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77780",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T15:56:49.202825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T16:12:40.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Transaction (Accounting) save path",
"Accounting listing"
],
"product": "Prospero Flow CRM",
"programFiles": [
"app/Http/Controllers/Transaction/TransactionSaveController.php",
"app/Http/Requests/TransactionSaveRequest.php"
],
"repo": "https://github.com/Roskus/prospero-flow-crm",
"vendor": "Roskus",
"versions": [
{
"lessThan": "5.14.2",
"status": "affected",
"version": "4.9.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.2",
"versionStartIncluding": "4.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adri\u00e1n Garc\u00eda L\u00f3pez"
},
{
"lang": "en",
"type": "analyst",
"value": "Xo\u00e1n M. Otero Jorge"
},
{
"lang": "en",
"type": "analyst",
"value": "Dar\u00edo Rivas Quero"
},
{
"lang": "en",
"type": "coordinator",
"value": "Secur0 CNA"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Gustavo Novaro"
}
],
"datePublic": "2026-08-21T12:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company\u0027s bank account name, bank name and card\nlast four digits via a bank_account_id or bank_card_id belonging to that company in POST\n/transaction/save, which is persisted and rendered without any company ownership check."
}
],
"value": "Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company\u0027s bank account name, bank name and card\nlast four digits via a bank_account_id or bank_card_id belonging to that company in POST\n/transaction/save, which is persisted and rendered without any company ownership check."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:12:59.160Z",
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/Roskus/prospero-flow-crm/commit/5fd1fe862bbdcbacf5d7e05c1c123981d8809674"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Roskus/prospero-flow-crm/pull/261"
},
{
"tags": [
"technical-description",
"third-party-advisory"
],
"url": "https://secur0.com/en/cna/cve-list/cve-2026-77780-idor-unvalidated-bank-foreign-keys-prospero-transaction-save"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to 5.14.2 or later. No tagged release carries the fix; the newest tag \u003ccode\u003ev5.14.0\u003c/code\u003e is\naffected. Rows already written are not corrected by the patch."
}
],
"value": "Upgrade to 5.14.2 or later. No tagged release carries the fix; the newest tag v5.14.0 is\naffected. Rows already written are not corrected by the patch."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"assignerShortName": "Secur0",
"cveId": "CVE-2026-77780",
"datePublished": "2026-08-21T12:12:59.160Z",
"dateReserved": "2026-08-21T11:30:36.990Z",
"dateUpdated": "2026-08-21T16:12:40.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77776 (GCVE-0-2026-77776)
Vulnerability from cvelistv5 – Published: 2026-08-21 11:22 – Updated: 2026-11-08 14:09
VLAI
EPSS
VEX
Title
Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity
Summary
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:18 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/headroomlabs-ai/headroom/pull/2207 | issue-trackingpatch |
| https://github.com/headroomlabs-ai/headroom/blob/… | technical-description |
| https://github.com/headroomlabs-ai/headroom/blob/… | technical-description |
| https://github.com/headroomlabs-ai/headroom | product |
| https://www.vulncheck.com/advisories/headroom-pro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Headroom Labs | Headroom |
Affected:
0 , < 0.36.1
(semver)
Unaffected: 0.36.1 (semver) |
Date Public
2026-08-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:18:54.351966Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:44:30.707Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"packageName": "headroom-ai",
"packageURL": "pkg:pypi/headroom-ai",
"product": "Headroom",
"programFiles": [
"headroom/proxy/handlers/openai.py",
"headroom/proxy/memory_handler.py",
"headroom/memory/easy.py"
],
"repo": "https://github.com/headroomlabs-ai/headroom",
"vendor": "Headroom Labs",
"versions": [
{
"lessThan": "0.36.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.36.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gregory Tan (Grg0rry)"
}
],
"datePublic": "2026-08-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Headroom\u0027s LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user\u0027s identifier and read or write that user\u0027s stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T14:09:01.029Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #2207 addressing the assessment findings",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/headroomlabs-ai/headroom/pull/2207"
},
{
"name": "Header handling in the OpenAI proxy handler at v0.29.0",
"tags": [
"technical-description"
],
"url": "https://github.com/headroomlabs-ai/headroom/blob/v0.29.0/headroom/proxy/handlers/openai.py"
},
{
"name": "resolve_memory_identity seam introduced by the fix",
"tags": [
"technical-description"
],
"url": "https://github.com/headroomlabs-ai/headroom/blob/v0.36.1/headroom/proxy/identity.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/headroomlabs-ai/headroom"
},
{
"name": "VulnCheck Advisory: Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/headroom-proxy-treats-the-client-supplied-x-headroom-user-id-header-as-an-authenticated-identity"
}
],
"title": "Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity"
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-77776",
"datePublished": "2026-08-21T11:22:51.779Z",
"dateReserved": "2026-08-21T11:09:25.553Z",
"dateUpdated": "2026-11-08T14:09:01.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.