Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
9048 vulnerabilities reference this CWE, most recent first.
CVE-2026-119707 (GCVE-0-2026-119707)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-11-04 22:52
VLAI
EPSS
VEX
Title
SonicJS through 3.0.0 Missing Authorization in Content Write API
Summary
SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:52 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/SonicJs-Org/sonicjs/issues/1125 | issue-tracking |
| https://github.com/SonicJs-Org/sonicjs | product |
| https://github.com/SonicJs-Org/sonicjs/blob/v3.0.… | technical-description |
| https://github.com/SonicJs-Org/sonicjs/pull/1147 | patchissue-tracking |
| https://hackmd.io/@hieuPenguinnn/sonicjs-content-… | third-party-advisory |
| https://www.vulncheck.com/advisories/sonicjs-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SonicJs-Org | sonicjs |
Affected:
0 , ≤ 3.0.0
(semver)
cpe:2.3:a:sonicjs:sonicjs:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119707",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:52:34.362357Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:52:57.695Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40sonicjs-cms/core",
"product": "sonicjs",
"vendor": "SonicJs-Org",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sonicjs:sonicjs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users\u0027 documents, bypassing document ACLs and administrator deny overrides."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:16:08.044Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1125",
"tags": [
"issue-tracking"
],
"url": "https://github.com/SonicJs-Org/sonicjs/issues/1125"
},
{
"tags": [
"product"
],
"url": "https://github.com/SonicJs-Org/sonicjs"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/SonicJs-Org/sonicjs/blob/v3.0.0/packages/core/src/routes/api.ts#L1296"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/SonicJs-Org/sonicjs/pull/1147"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/sonicjs-content-api-write-acl-bypass"
},
{
"name": "VulnCheck Advisory: SonicJS through 3.0.0 Missing Authorization in Content Write API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sonicjs-through-3.0.0-missing-authorization-in-content-write-api"
}
],
"title": "SonicJS through 3.0.0 Missing Authorization in Content Write API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119707",
"datePublished": "2026-10-30T15:16:08.044Z",
"dateReserved": "2026-10-30T14:49:23.747Z",
"dateUpdated": "2026-11-04T22:52:57.695Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119702 (GCVE-0-2026-119702)
Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:39
VLAI
EPSS
VEX
Title
WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
Summary
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:34 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/wp-graphql/wp-graphql/security… | vendor-advisory |
| https://github.com/wp-graphql/wp-graphql/commit/b… | patch |
| https://github.com/wp-graphql/wp-graphql/blob/wp-… | technical-description |
| https://github.com/wp-graphql/wp-graphql/releases… | release-notes |
| https://github.com/wp-graphql/wp-graphql | product |
| https://www.vulncheck.com/advisories/wpgraphql-be… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119702",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:34:09.637411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:39:13.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPGraphQL",
"vendor": "WPGraphQL",
"versions": [
{
"lessThan": "2.24.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "pnn219"
},
{
"lang": "en",
"type": "finder",
"value": "Ryuuzen1011"
},
{
"lang": "en",
"type": "finder",
"value": "Zyy0530"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to draft, private, trashed, or password-protected posts to leak hidden titles via moderator notifications, enumerate post IDs, and backdate comments or mark them as pingbacks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:19:19.586Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4vgv-vvxr-9fh9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-4vgv-vvxr-9fh9"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-graphql/wp-graphql/commit/b9da32bd8e6025e19a9b04acaa129978eba71177"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/wp-graphql/wp-graphql/blob/wp-graphql/v2.24.0/plugins/wp-graphql/src/Mutation/CommentCreate.php"
},
{
"name": "WPGraphQL wp-graphql/v2.24.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.24.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/wp-graphql/wp-graphql"
},
{
"name": "VulnCheck Advisory: WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wpgraphql-before-2.24.1-missing-authorization-via-createcomment-mutation"
}
],
"title": "WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119702",
"datePublished": "2026-10-30T15:16:03.297Z",
"dateReserved": "2026-10-30T14:49:21.859Z",
"dateUpdated": "2026-10-30T15:39:13.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119682 (GCVE-0-2026-119682)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:21 – Updated: 2026-11-06 16:25
VLAI
EPSS
VEX
Title
Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus
Summary
An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507. The reproduction explicitly uses build 4506.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 16:24 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
CIRCL
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://pitstop.manageengine.com/portal/en/commun… | release-notes |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ManageEngine | SharePoint Manager Plus |
Affected:
450 , < 4507
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119682",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T16:24:50.328785Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:25:08.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SharePoint Manager Plus",
"vendor": "ManageEngine",
"versions": [
{
"lessThan": "4507",
"status": "affected",
"version": "450",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Anas LAABAB with IMRIM (https://imrim.lu)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507.\u0026nbsp;The reproduction explicitly uses build 4506.\u003c/p\u003e"
}
],
"value": "An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify MFA configuration settings, enable or disable MFA for the application, enumerate MFA-enrolled users, and delete MFA-enrolled accounts. Successful exploitation could allow an attacker to weaken authentication protections or cause a denial of service by configuring invalid MFA settings, potentially locking legitimate users out of the application. This vulnerability was fixed in build 4507.\u00a0The reproduction explicitly uses build 4506."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:21:21.154Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4507-released"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus",
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "gcve-1-2026-20186"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-119682",
"datePublished": "2026-10-30T14:21:21.154Z",
"dateReserved": "2026-10-30T14:18:42.530Z",
"dateUpdated": "2026-11-06T16:25:08.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119665 (GCVE-0-2026-119665)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 15:52
VLAI
EPSS
VEX
Title
WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs
Summary
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project's sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/MGdaasLab/WHartTest/issues/166 | issue-tracking |
| https://github.com/MGdaasLab/WHartTest/blob/v2.8.… | technical-description |
| https://github.com/MGdaasLab/WHartTest/blob/v2.8.… | technical-description |
| https://hackmd.io/@hieuPenguinnn/wharttest-schedu… | third-party-advisory |
| https://github.com/MGdaasLab/WHartTest | product |
| https://www.vulncheck.com/advisories/wharttest-2.… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119665",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:27.447168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:52:24.404Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WHartTest",
"repo": "https://github.com/MGdaasLab/WHartTest",
"vendor": "MGdaasLab",
"versions": [
{
"lessThanOrEqual": "2.8.1",
"status": "affected",
"version": "2.2.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects\u0027 tasks. Attackers can set project_pk to another project\u0027s sequential ID to modify, delete, or trigger scheduled tasks via run-now and read execution logs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:24.683Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/MGdaasLab/WHartTest/issues/166"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py#L19-L104"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/MGdaasLab/WHartTest/blob/v2.8.1/WHartTest_Django/task_center/views.py#L107-L133"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/wharttest-scheduled-task-cross-project-missing-authz-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/MGdaasLab/WHartTest"
},
{
"name": "VulnCheck Advisory: WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wharttest-2.2.0-through-2.8.1-missing-authorization-via-task-center-scheduled-task-apis"
}
],
"title": "WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119665",
"datePublished": "2026-10-30T14:16:24.683Z",
"dateReserved": "2026-10-30T13:43:51.001Z",
"dateUpdated": "2026-10-30T15:52:24.404Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119654 (GCVE-0-2026-119654)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 16:16
VLAI
EPSS
VEX
Title
DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization
Summary
DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/devlive-community/metaforge/is… | issue-tracking |
| https://github.com/devlive-community/metaforge/bl… | technical-description |
| https://github.com/devlive-community/metaforge/bl… | technical-description |
| https://github.com/devlive-community/metaforge/bl… | technical-description |
| https://github.com/devlive-community/metaforge/bl… | technical-description |
| https://hackmd.io/@hieuPenguinnn/metaforge-dataca… | third-party-advisory |
| https://github.com/devlive-community/metaforge | product |
| https://www.vulncheck.com/advisories/datacap-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| devlive-community | DataCap |
Affected:
0 , ≤ 2025.1.1
(custom)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119654",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:16:29.429788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:16:54.207Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/metaforge-datacap-allocation-role-missing-authz-privilege-escalation"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DataCap",
"repo": "https://github.com/devlive-community/metaforge",
"vendor": "devlive-community",
"versions": [
{
"lessThanOrEqual": "2025.1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can send PUT requests to /api/v1/user/allocationRole to assign themselves the administrator role and gain full control of the instance."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:16.982Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/devlive-community/metaforge/issues/969"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/user/UserController.java#L97-L108"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-service/src/main/java/io/edurt/datacap/service/service/impl/UserServiceImpl.java#L104-L137"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-server/src/main/java/io/edurt/datacap/server/controller/admin/RoleController.java#L34-L52"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/devlive-community/metaforge/blob/2025.1.1/core/datacap-security/src/main/java/io/edurt/datacap/security/SecurityConfigure.java#L63-L78"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/metaforge-datacap-allocation-role-missing-authz-privilege-escalation"
},
{
"tags": [
"product"
],
"url": "https://github.com/devlive-community/metaforge"
},
{
"name": "VulnCheck Advisory: DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/datacap-through-2025.1.1-privilege-escalation-via-allocationrole-missing-authorization"
}
],
"title": "DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119654",
"datePublished": "2026-10-30T14:16:16.982Z",
"dateReserved": "2026-10-30T13:43:44.783Z",
"dateUpdated": "2026-10-30T16:16:54.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119653 (GCVE-0-2026-119653)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-10-30 15:52
VLAI
EPSS
VEX
Title
Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path
Summary
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/admpub/nging/issues/831 | issue-tracking |
| https://github.com/admpub/nging/commit/6434d026f6… | patch |
| https://github.com/admpub/nging/blob/v5.3.5/appli… | technical-description |
| https://github.com/admpub/nging/blob/v5.3.5/appli… | technical-description |
| https://hackmd.io/@hieuPenguinnn/nging-user-autoc… | third-party-advisory |
| https://github.com/admpub/nging | product |
| https://www.vulncheck.com/advisories/nging-throug… | third-party-advisory |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119653",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:22.540329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:52:54.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "nging",
"repo": "https://github.com/admpub/nging",
"vendor": "admpub",
"versions": [
{
"lessThanOrEqual": "5.3.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "admpub"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:16.291Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/admpub/nging/issues/831"
},
{
"tags": [
"patch"
],
"url": "https://github.com/admpub/nging/commit/6434d026f668bdb5d59db658036fd6febbd29c0c"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/admpub/nging/blob/v5.3.5/application/handler/user/init.go#L28-L42"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/admpub/nging/blob/v5.3.5/application/handler/user/profile.go#L136-L157"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/nging-user-autocomplete-path-filesystem-disclosure"
},
{
"tags": [
"product"
],
"url": "https://github.com/admpub/nging"
},
{
"name": "VulnCheck Advisory: Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nging-through-5.3.5-directory-listing-disclosure-via-user-autocomplete-path"
}
],
"title": "Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119653",
"datePublished": "2026-10-30T14:16:16.291Z",
"dateReserved": "2026-10-30T13:43:44.151Z",
"dateUpdated": "2026-10-30T15:52:54.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119648 (GCVE-0-2026-119648)
Vulnerability from cvelistv5 – Published: 2026-10-30 14:16 – Updated: 2026-11-05 21:31
VLAI
EPSS
VEX
Title
BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
Summary
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:30 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/TencentBlueKing/bk-cmdb/issues/8709 | issue-tracking |
| https://github.com/TencentBlueKing/bk-cmdb/blob/r… | technical-description |
| https://github.com/TencentBlueKing/bk-cmdb/blob/r… | technical-description |
| https://github.com/TencentBlueKing/bk-cmdb/blob/r… | technical-description |
| https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-sea… | third-party-advisory |
| https://github.com/TencentBlueKing/bk-cmdb | product |
| https://www.vulncheck.com/advisories/blueking-cmd… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TencentBlueKing | bk-cmdb |
Affected:
0 , ≤ 3.14.6
(semver)
|
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119648",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:30:47.743805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:31:11.514Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-authz"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "bk-cmdb",
"repo": "https://github.com/TencentBlueKing/bk-cmdb",
"vendor": "TencentBlueKing",
"versions": [
{
"lessThanOrEqual": "3.14.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:16:12.678Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/TencentBlueKing/bk-cmdb/issues/8709"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/service/host.go#L605-L620"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/ac/parser/host.go#L797-L819"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/TencentBlueKing/bk-cmdb/blob/release-v3.14.6/src/scene_server/host_server/logics/hostsearch.go#L36-L72"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/bk-cmdb-host-search-asstdetail-cross-business-missing-authz"
},
{
"tags": [
"product"
],
"url": "https://github.com/TencentBlueKing/bk-cmdb"
},
{
"name": "VulnCheck Advisory: BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/blueking-cmdb-through-3.14.6-missing-authorization-via-api-v3-hosts-search-asstdetail"
}
],
"title": "BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119648",
"datePublished": "2026-10-30T14:16:12.678Z",
"dateReserved": "2026-10-30T13:43:42.242Z",
"dateUpdated": "2026-11-05T21:31:11.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119576 (GCVE-0-2026-119576)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-11-05 21:25
VLAI
EPSS
VEX
Title
ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
Summary
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:25 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ArcadeData/arcadedb/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/arcadedb-fro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ArcadeData | arcadedb |
Affected:
21.12.1 , < 26.10.2
(semver)
Unaffected: 26.10.2 (semver) |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119576",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:25:01.654871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:25:28.447Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-773f-9j7c-cr54"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/com.arcadedb/arcadedb-graphql",
"product": "arcadedb",
"vendor": "ArcadeData",
"versions": [
{
"lessThan": "26.10.2",
"status": "affected",
"version": "21.12.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "26.10.2",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T13:18:14.388Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-773f-9j7c-cr54)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-773f-9j7c-cr54"
},
{
"name": "VulnCheck Advisory: ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/arcadedb-from-21.12.1-before-26.10.2-graphql-schema-replacement-via-read-only-query-endpoint"
}
],
"title": "ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119576",
"datePublished": "2026-10-30T13:18:14.388Z",
"dateReserved": "2026-10-30T10:56:15.489Z",
"dateUpdated": "2026-11-05T21:25:28.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119556 (GCVE-0-2026-119556)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
Summary
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/moodle/moodle/blob/v5.3.0/publ… | technical-description |
| https://abraxaslabs.tech/research/moodle-grades-g… | third-party-advisory |
| https://github.com/moodle/moodle | product |
| https://www.vulncheck.com/advisories/moodle-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Moodle Project | moodle |
Affected:
5.3.0
(semver)
Affected: 5.2.0 , ≤ 5.2.4 (semver) Affected: 5.1.0 , ≤ 5.1.8 (semver) Affected: 5.0.0 , ≤ 5.0.11 (semver) Affected: 4.2.0 , ≤ 4.5.15 (semver) cpe:2.3:a:moodle:moodle:5.3.0:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
Date Public
2026-10-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:06.367380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:25.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://git.moodle.org",
"defaultStatus": "unaffected",
"packageName": "moodle",
"packageURL": "pkg:github/moodle/moodle",
"product": "moodle",
"repo": "https://github.com/moodle/moodle",
"vendor": "Moodle Project",
"versions": [
{
"status": "affected",
"version": "5.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.4",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.1.8",
"status": "affected",
"version": "5.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.0.11",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.5.15",
"status": "affected",
"version": "4.2.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:moodle:moodle:5.3.0:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.2.4",
"versionStartIncluding": "5.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.1.8",
"versionStartIncluding": "5.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.0.11",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.5.15",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:06.200Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/moodle/moodle/blob/v5.3.0/public/grade/classes/external/get_gradeitems.php#L74-L80"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/moodle-grades-gradeitems"
},
{
"tags": [
"product"
],
"url": "https://github.com/moodle/moodle"
},
{
"name": "VulnCheck Advisory: Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/moodle-through-5.3.0-5.2.4-5.1.8-5.0.11-and-4.5.15-missing-authorization-via-core-grades-get-gradeitems"
}
],
"title": "Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119556",
"datePublished": "2026-10-30T11:31:06.200Z",
"dateReserved": "2026-10-30T10:53:28.201Z",
"dateUpdated": "2026-10-30T15:54:25.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119551 (GCVE-0-2026-119551)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-11-04 11:40
VLAI
EPSS
VEX
Title
Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
Summary
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 11:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/jellyfin/jellyfin/blob/v12.4/J… | technical-description |
| https://github.com/jellyfin/jellyfin/security/adv… | relatedvendor-advisory |
| https://abraxaslabs.tech/research/jellyfin-sugges… | third-party-advisory |
| https://github.com/jellyfin/jellyfin | product |
| https://www.vulncheck.com/advisories/jellyfin-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119551",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T11:40:39.230146Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T11:40:48.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/jellyfin/jellyfin",
"product": "jellyfin",
"repo": "https://github.com/jellyfin/jellyfin",
"vendor": "jellyfin",
"versions": [
{
"lessThanOrEqual": "12.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without userId to enumerate restricted items, including IDs and server filesystem paths, and then stream them."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:02.744Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/SuggestionsController.cs#L70-L95"
},
{
"name": "GitHub Security Advisory (GHSA-9x85-gx46-6522)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9x85-gx46-6522"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/jellyfin-suggestions-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/jellyfin/jellyfin"
},
{
"name": "VulnCheck Advisory: Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jellyfin-through-12.4-authorization-bypass-via-get-items-suggestions"
}
],
"title": "Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119551",
"datePublished": "2026-10-30T11:31:02.744Z",
"dateReserved": "2026-10-30T10:53:26.311Z",
"dateUpdated": "2026-11-04T11:40:48.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.