Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

9116 vulnerabilities reference this CWE, most recent first.

CVE-2026-56828 (GCVE-0-2026-56828)

Vulnerability from cvelistv5 – Published: 2026-10-28 15:40 – Updated: 2026-11-03 13:06
VLAI
Title
Shopper: read-only team permissions allow administrator creation and permission escalation
Summary
Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker's own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 13:06 UTC
CWE
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
shopperlabs shopper Affected: >= 2.8.0, < 2.8.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56828",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T13:06:00.958748Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T13:06:24.272Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.8.0, \u003c 2.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate permissions, create an administrator, or delete roles. In `packages/admin/src/Livewire/Components/Settings/Team/Permissions.php`, `togglePermission` and `removePermission` authorize `view_users` rather than the stronger `access_setting` permission; `packages/admin/resources/views/livewire/components/settings/team/permissions.blade.php` exposes permission IDs in `wire:click` handlers. The attacker can grant arbitrary permissions to the bound role, including `access_setting` on the attacker\u0027s own role, or delete permission definitions. In `packages/admin/src/Livewire/SlideOvers/CreateTeamMember.php`, `mount()` and `store()` also accept `view_users`, and the client-selected `role_id` can identify the admin role, allowing creation of a pre-verified administrator with an attacker-chosen password. In `packages/admin/src/Livewire/Pages/Settings/Team/RolePermission.php`, `deleteAction` has no action authorization and is only conditioned on `can_be_removed`, while page access requires `view_users`. Deleting a removable role removes access for assigned users, enabling RBAC denial of service as well as privilege escalation. This issue is fixed in version 2.8.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T15:40:39.294Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-j328-xmgp-j4q3"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/514",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/514"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/ac9a76044a8e4a2b570b438d66cf3007f3dc479e"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/compare/v2.8.1...v2.9.2"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.8.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.8.1"
        }
      ],
      "source": {
        "advisory": "GHSA-j328-xmgp-j4q3",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: read-only team permissions allow administrator creation and permission escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56828",
    "datePublished": "2026-10-28T15:40:39.294Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-11-03T13:06:24.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56827 (GCVE-0-2026-56827)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:41 – Updated: 2026-09-15 18:38
VLAI
Title
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Summary
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 18:34 UTC
CWE
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
shopperlabs shopper Affected: < 2.9.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56827",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:34:31.625515Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T18:38:02.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make(\u0027enabled\u0027) or BulkAction::make(\u0027disabled\u0027) to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:41:15.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-243p-f3cv-c5wh",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56827",
    "datePublished": "2026-09-15T17:41:15.126Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-09-15T18:38:02.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56826 (GCVE-0-2026-56826)

Vulnerability from cvelistv5 – Published: 2026-10-13 19:11 – Updated: 2026-10-17 00:41
VLAI
Title
Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration
Summary
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-17 00:40 UTC
CWE
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
shopperlabs shopper Affected: >= 2.0.0, < 2.9.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56826",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-17T00:40:47.210725Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-17T00:41:10.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T19:11:55.629Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-f7h9-qv4x-9x57",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56826",
    "datePublished": "2026-10-13T19:11:55.629Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-10-17T00:41:10.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56825 (GCVE-0-2026-56825)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:38 – Updated: 2026-09-16 14:40
VLAI
Title
Shopper: Missing authorization on product removal actions in CollectionProducts component
Summary
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:40 UTC
CWE
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
shopperlabs shopper Affected: < 2.9.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56825",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:40:08.824151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:40:15.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make(\u0027delete\u0027) and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:38:42.928Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2cg9-97gq-9mqp",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing authorization on product removal actions in CollectionProducts component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56825",
    "datePublished": "2026-09-15T17:38:42.928Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-09-16T14:40:15.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56773 (GCVE-0-2026-56773)

Vulnerability from cvelistv5 – Published: 2026-06-26 14:38 – Updated: 2026-11-08 14:06 X_Open Source
VLAI
Title
Teable - Missing Authorization in v2 REST API
Summary
Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-27 02:37 UTC
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
teableio teable Affected: 0 , < 2026-06-15T04-43-24Z.1912 (custom)
Create a notification for this product.
Date Public
2026-06-04 00:00
Credits
George Chen
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-27T02:37:18.419553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-27T02:37:44.123Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/teableio/teable",
          "product": "teable",
          "repo": "https://github.com/teableio/teable",
          "vendor": "teableio",
          "versions": [
            {
              "lessThan": "2026-06-15T04-43-24Z.1912",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-06-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Teable\u0027s v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and tables via endpoints like GET /api/v2/tables/get and POST /api/v2/tables/updateRecords."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T14:06:20.523Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "teable release.2026-06-15T04-43-24Z.1912 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/teableio/teable/releases/tag/release.2026-06-15T04-43-24Z.1912"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/teableio/teable/pull/3285"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/teable-missing-authorization-in-v2-rest-api"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Teable - Missing Authorization in v2 REST API",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56773",
    "datePublished": "2026-06-26T14:38:32.177Z",
    "dateReserved": "2026-06-23T01:22:22.571Z",
    "dateUpdated": "2026-11-08T14:06:20.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56768 (GCVE-0-2026-56768)

Vulnerability from cvelistv5 – Published: 2026-06-25 18:05 – Updated: 2026-07-14 21:34 X_Open Source
VLAI
Title
Seahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method
Summary
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-30 03:25 UTC
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
haiwen seahub Affected: 0 , < 13.0.23 (semver)
Create a notification for this product.
Date Public
2026-05-29 00:00
Credits
George Chen
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T03:25:21.936486Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T03:25:34.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/haiwen/seahub",
          "product": "seahub",
          "repo": "https://github.com/haiwen/seahub",
          "vendor": "haiwen",
          "versions": [
            {
              "lessThan": "13.0.23",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-05-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T21:34:20.107Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://plus.seafile.com/wiki/publish/seafile-wiki/v5D5/"
        },
        {
          "name": "GitHub Issue",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/haiwen/seahub/issues/9050"
        },
        {
          "name": "Patch Commit (1)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/haiwen/seahub/commit/b609949cf64ed6a15708d0fb5ea9c179962e23cc"
        },
        {
          "name": "Patch Commit (2)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/haiwen/seahub/commit/162cddae0831188d02bb8d451dc2193e197dcc57"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/seahub-authentication-bypass-in-sharelinkziptaskview-get-method"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Seahub \u003c 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56768",
    "datePublished": "2026-06-25T18:05:06.817Z",
    "dateReserved": "2026-06-22T21:55:17.942Z",
    "dateUpdated": "2026-07-14T21:34:20.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56767 (GCVE-0-2026-56767)

Vulnerability from cvelistv5 – Published: 2026-06-25 18:03 – Updated: 2026-11-08 14:06 X_Open Source
VLAI
Title
Maxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers
Summary
Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users' robots by bypassing ownership checks in API endpoints.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-25 20:27 UTC
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
getmaxun maxun Affected: 0 , < 0.0.42 (semver)
Unaffected: 0.0.42 (semver)
    cpe:2.3:a:maxun:maxun:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-06-04 00:00
Credits
George Chen
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56767",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T20:27:10.895773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T20:28:18.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/getmaxun/maxun",
          "product": "maxun",
          "repo": "https://github.com/getmaxun/maxun",
          "vendor": "getmaxun",
          "versions": [
            {
              "lessThan": "0.0.42",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.0.42",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:maxun:maxun:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.0.42",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-06-04T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users\u0027 robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users\u0027 robots by bypassing ownership checks in API endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T14:06:16.955Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue",
          "tags": [
            "technical-description",
            "issue-tracking"
          ],
          "url": "https://github.com/getmaxun/maxun/issues/1079"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/getmaxun/maxun/pull/1088"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/getmaxun/maxun/commit/11db0257531f1c23dec94727793c9444ee2873cf"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maxun-cross-tenant-idor-in-storage-and-webhook-api-handlers"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "Maxun \u003c 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56767",
    "datePublished": "2026-06-25T18:03:33.720Z",
    "dateReserved": "2026-06-22T21:55:17.942Z",
    "dateUpdated": "2026-11-08T14:06:16.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56742 (GCVE-0-2026-56742)

Vulnerability from cvelistv5 – Published: 2026-07-15 19:14 – Updated: 2026-07-16 12:57
VLAI
Title
Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces
Summary
Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5.
Severity
5.9 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-16 12:56 UTC
CWE
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
cilium cilium Affected: < 1.17.17
Affected: >= 1.18.0, < 1.18.11
Affected: >= 1.19.0, < 1.19.5
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T12:56:22.128191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T12:57:08.040Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cilium",
          "vendor": "cilium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.17.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.18.0, \u003c 1.18.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.19.0, \u003c 1.19.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default. This issue is fixed in versions 1.17.17, 1.18.11, and 1.19.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T19:14:07.617Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cilium/cilium/security/advisories/GHSA-w7c2-w76w-5hmj"
        },
        {
          "name": "https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/commit/7422068aff67ac77c7dcc57aa5b9240c91333deb"
        },
        {
          "name": "https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/commit/e0b1cef513ff910323f3743e9f3e3d86721e4857"
        },
        {
          "name": "https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/commit/f23929cff682d6ed0dc158070812cb302fc0032b"
        },
        {
          "name": "https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/commit/fd47963ea394d5e8fa4a88c40a79063430c512ca"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.17.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.17.17"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.18.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.18.11"
        },
        {
          "name": "https://github.com/cilium/cilium/releases/tag/v1.19.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cilium/cilium/releases/tag/v1.19.5"
        }
      ],
      "source": {
        "advisory": "GHSA-w7c2-w76w-5hmj",
        "discovery": "UNKNOWN"
      },
      "title": "Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56742",
    "datePublished": "2026-07-15T19:14:07.617Z",
    "dateReserved": "2026-06-22T19:17:28.959Z",
    "dateUpdated": "2026-07-16T12:57:08.040Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56730 (GCVE-0-2026-56730)

Vulnerability from cvelistv5 – Published: 2026-09-25 17:07 – Updated: 2026-09-29 19:35
VLAI
Title
Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers
Summary
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a knowledge base answer suggestion so it can be inserted into the ticket editor, but it only checks if the user has the ticket.agent permission. Checking the authorization to the knowledge base answer itself is missing. This vulnerability is fixed in 7.0.2.
Severity
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 19:35 UTC
CWE
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
zammad zammad Affected: < 7.0.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56730",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T19:35:45.655850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T19:35:59.021Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zammad",
          "vendor": "zammad",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, an authorization bypass vulnerability was found that allows an authenticated agent to read knowledge base answer content they should not be able to access. The vulnerable GraphQL mutation is meant to transform a knowledge base answer suggestion so it can be inserted into the ticket editor, but it only checks if the user has the ticket.agent permission. Checking the authorization to the knowledge base answer itself is missing. This vulnerability is fixed in 7.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T17:07:02.910Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zammad/zammad/security/advisories/GHSA-pf47-8964-pp23",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zammad/zammad/security/advisories/GHSA-pf47-8964-pp23"
        },
        {
          "name": "https://github.com/zammad/zammad/commit/b059bd1cac36b1eab04cfc0783799e38b8072da7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zammad/zammad/commit/b059bd1cac36b1eab04cfc0783799e38b8072da7"
        },
        {
          "name": "https://github.com/zammad/zammad/releases/tag/7.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zammad/zammad/releases/tag/7.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-pf47-8964-pp23",
        "discovery": "UNKNOWN"
      },
      "title": "Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56730",
    "datePublished": "2026-09-25T17:07:02.910Z",
    "dateReserved": "2026-06-22T19:17:28.959Z",
    "dateUpdated": "2026-09-29T19:35:59.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56726 (GCVE-0-2026-56726)

Vulnerability from cvelistv5 – Published: 2026-09-25 17:01 – Updated: 2026-09-25 19:44
VLAI
Title
Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak
Summary
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 19:43 UTC
CWE
Assigner
GitHub_M CNA
References
Impacted products
Vendor Product Version
zammad zammad Affected: < 7.0.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T19:43:58.380438Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T19:44:08.495Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zammad",
          "vendor": "zammad",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of GitHub/GitLab issues attached to any ticket in the system. This allows an internal user to systematically view GitHub/GitLab issue data linked by other agents or administrators across the organization by simply querying random or sequential ticket IDs. This vulnerability is fixed in 7.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T17:01:00.957Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zammad/zammad/security/advisories/GHSA-96hh-fmj3-h4hp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zammad/zammad/security/advisories/GHSA-96hh-fmj3-h4hp"
        },
        {
          "name": "https://github.com/zammad/zammad/commit/c767f32c006ff9842152f78e12f355f7f485304f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zammad/zammad/commit/c767f32c006ff9842152f78e12f355f7f485304f"
        },
        {
          "name": "https://github.com/zammad/zammad/commit/e50ef69beab897317caa5e9490edba33aa1ac978",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zammad/zammad/commit/e50ef69beab897317caa5e9490edba33aa1ac978"
        },
        {
          "name": "https://github.com/zammad/zammad/releases/tag/7.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zammad/zammad/releases/tag/7.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-96hh-fmj3-h4hp",
        "discovery": "UNKNOWN"
      },
      "title": "Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56726",
    "datePublished": "2026-09-25T17:01:00.957Z",
    "dateReserved": "2026-06-22T19:17:28.958Z",
    "dateUpdated": "2026-09-25T19:44:08.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list