Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
9048 vulnerabilities reference this CWE, most recent first.
CVE-2026-111764 (GCVE-0-2026-111764)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:05 – Updated: 2026-10-20 16:15
VLAI
EPSS
VEX
Title
A2A Java SDK has a fail-open default task authorization
Summary
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String taskId) returns the stored task without checking the caller or owner. Authorization depends on supplying a TaskAuthorizationProvider and routing requests through AuthorizationRequestHandlerDecorator, whether installed through CDI or explicitly by the application. Default store wiring and manually constructed DefaultRequestHandler.builder().build() handlers, including integrations such as Spring, leave task reads unprotected when no effective authorization-provider and decorator check is installed. In a multi-caller deployment using the default configuration, a caller who knows or guesses another caller's task ID can retrieve the task status, context ID, message history, and artifacts. The default/reference transport endpoints do not enforce authentication, so the task-read disclosure is reachable by an unauthenticated caller rather than requiring a privileged account. This issue is fixed in version 1.3.0.Final.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:15 UTC
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/a2aproject/a2a-java/security/a… | x_refsource_CONFIRM |
| https://github.com/a2aproject/a2a-java/pull/1095 | x_refsource_MISC |
| https://github.com/a2aproject/a2a-java/commit/efb… | x_refsource_MISC |
| https://github.com/a2aproject/a2a-java/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-java |
Affected:
< 1.3.0.Final
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111764",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:15:13.020004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:15:50.172Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/a2aproject/a2a-java/security/advisories/GHSA-qw47-mcm5-934w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "a2a-java",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.0.Final"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String taskId) returns the stored task without checking the caller or owner. Authorization depends on supplying a TaskAuthorizationProvider and routing requests through AuthorizationRequestHandlerDecorator, whether installed through CDI or explicitly by the application. Default store wiring and manually constructed DefaultRequestHandler.builder().build() handlers, including integrations such as Spring, leave task reads unprotected when no effective authorization-provider and decorator check is installed. In a multi-caller deployment using the default configuration, a caller who knows or guesses another caller\u0027s task ID can retrieve the task status, context ID, message history, and artifacts. The default/reference transport endpoints do not enforce authentication, so the task-read disclosure is reachable by an unauthenticated caller rather than requiring a privileged account. This issue is fixed in version 1.3.0.Final."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188: Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:05:26.905Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/a2aproject/a2a-java/security/advisories/GHSA-qw47-mcm5-934w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/a2aproject/a2a-java/security/advisories/GHSA-qw47-mcm5-934w"
},
{
"name": "https://github.com/a2aproject/a2a-java/pull/1095",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/a2aproject/a2a-java/pull/1095"
},
{
"name": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"
},
{
"name": "https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"
}
],
"source": {
"advisory": "GHSA-qw47-mcm5-934w",
"discovery": "UNKNOWN"
},
"title": "A2A Java SDK has a fail-open default task authorization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-111764",
"datePublished": "2026-10-20T15:05:26.905Z",
"dateReserved": "2026-10-16T17:52:09.082Z",
"dateUpdated": "2026-10-20T16:15:50.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111723 (GCVE-0-2026-111723)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:40 – Updated: 2026-10-20 15:10
VLAI
EPSS
VEX
Title
LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API
Summary
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:10 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/lingguo-drama-br… | third-party-advisory |
| https://github.com/LingGuoAI/LingGuo-Drama/blob/8… | technical-description |
| https://github.com/LingGuoAI/LingGuo-Drama/blob/8… | technical-description |
| https://github.com/LingGuoAI/LingGuo-Drama/blob/8… | technical-description |
| https://www.vulncheck.com/advisories/lingguo-dram… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| LingGuoAI | LingGuo-Drama |
Affected:
0 , ≤ 8a6924adf8142678919b4d9a08b9d60c49dcfbed
(git)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111723",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:10:43.446928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:10:52.945Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/lingguo-drama-broken-access-control"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/LingGuoAI/LingGuo-Drama",
"product": "LingGuo-Drama",
"repo": "https://github.com/LingGuoAI/LingGuo-Drama",
"vendor": "LingGuoAI",
"versions": [
{
"lessThanOrEqual": "8a6924adf8142678919b4d9a08b9d60c49dcfbed",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account\u0027s bcrypt hash, reset the bootstrap administrator\u0027s password via PUT, raise their authority_id, and delete accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:40:09.757Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/lingguo-drama-broken-access-control"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/routes/admin.go#L244-L255"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/http/controllers/admin/v1/admins_controller.go#L166-L198"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/LingGuoAI/LingGuo-Drama/blob/8a6924adf8142678919b4d9a08b9d60c49dcfbed/server/app/models/admins/admins.go#L14"
},
{
"name": "VulnCheck Advisory: LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lingguo-drama-through-commit-8a6924a-broken-access-control-via-admin-v1-admins-api"
}
],
"title": "LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111723",
"datePublished": "2026-10-16T17:40:09.757Z",
"dateReserved": "2026-10-16T14:33:31.388Z",
"dateUpdated": "2026-10-20T15:10:52.945Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111683 (GCVE-0-2026-111683)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-23 13:59
VLAI
EPSS
VEX
Title
Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API
Summary
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 13:59 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/ralph-dc-view-ra… | third-party-advisory |
| https://github.com/allegro/ralph/blob/20260902.1/… | technical-description |
| https://github.com/allegro/ralph/blob/20260902.1/… | technical-description |
| https://github.com/allegro/ralph | product |
| https://www.vulncheck.com/advisories/allegro-ralp… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111683",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T13:59:35.298003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:59:41.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/allegro/ralph",
"product": "ralph",
"repo": "https://github.com/allegro/ralph",
"vendor": "allegro",
"versions": [
{
"lessThanOrEqual": "20260902.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/\u003cid\u003e and /api/server_room/\u003cid\u003e to read asset hostnames, serials and management IPs, and to modify, move or create racks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:40.888Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/ralph-dc-view-rack-api-missing-authorization"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/allegro/ralph/blob/20260902.1/src/ralph/dc_view/views/api.py#L17-L96"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/allegro/ralph/blob/20260902.1/src/ralph/lib/permissions/api.py#L194-L209"
},
{
"tags": [
"product"
],
"url": "https://github.com/allegro/ralph"
},
{
"name": "VulnCheck Advisory: Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/allegro-ralph-through-20260902.1-missing-authorization-in-data-center-rack-api"
}
],
"title": "Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111683",
"datePublished": "2026-10-16T17:39:40.888Z",
"dateReserved": "2026-10-16T14:31:19.375Z",
"dateUpdated": "2026-10-23T13:59:41.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111682 (GCVE-0-2026-111682)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 19:04
VLAI
EPSS
VEX
Title
EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys
Summary
EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/efak-missing-adm… | third-party-advisory |
| https://github.com/smartloli/EFAK/blob/v5.1.0/efa… | technical-description |
| https://github.com/smartloli/EFAK/blob/v5.1.0/efa… | technical-description |
| https://github.com/smartloli/EFAK | product |
| https://www.vulncheck.com/advisories/efak-5.0.0-t… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111682",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:03:31.508837Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:04:04.560Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/smartloli/EFAK",
"product": "EFAK",
"repo": "https://github.com/smartloli/EFAK",
"vendor": "smartloli",
"versions": [
{
"lessThanOrEqual": "5.1.0",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:40.095Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/controller/ModelConfigController.java#L34-L56"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/security/config/WebSecurityConfig.java#L89-L93"
},
{
"tags": [
"product"
],
"url": "https://github.com/smartloli/EFAK"
},
{
"name": "VulnCheck Advisory: EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/efak-5.0.0-through-5.1.0-missing-authorization-via-api-model-config-exposes-api-keys"
}
],
"title": "EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111682",
"datePublished": "2026-10-16T17:39:40.095Z",
"dateReserved": "2026-10-16T14:31:19.231Z",
"dateUpdated": "2026-10-16T19:04:04.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111681 (GCVE-0-2026-111681)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 21:17
VLAI
EPSS
VEX
Title
EFAK through 5.1.0 Privilege Escalation via /api/users REST API
Summary
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 20:51 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/efak-missing-adm… | third-party-advisory |
| https://github.com/smartloli/EFAK/blob/v5.1.0/efa… | technical-description |
| https://github.com/smartloli/EFAK/blob/v5.1.0/efa… | technical-description |
| https://github.com/smartloli/EFAK | product |
| https://www.vulncheck.com/advisories/efak-through… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T20:51:54.682916Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T21:17:35.235Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/smartloli/EFAK",
"product": "EFAK",
"repo": "https://github.com/smartloli/EFAK",
"vendor": "smartloli",
"versions": [
{
"lessThanOrEqual": "5.1.0",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:39.410Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/security/config/WebSecurityConfig.java#L89-L93"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/controller/UserController.java#L218-L302"
},
{
"tags": [
"product"
],
"url": "https://github.com/smartloli/EFAK"
},
{
"name": "VulnCheck Advisory: EFAK through 5.1.0 Privilege Escalation via /api/users REST API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/efak-through-5.1.0-privilege-escalation-via-api-users-rest-api"
}
],
"title": "EFAK through 5.1.0 Privilege Escalation via /api/users REST API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111681",
"datePublished": "2026-10-16T17:39:39.410Z",
"dateReserved": "2026-10-16T14:31:19.095Z",
"dateUpdated": "2026-10-16T21:17:35.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111679 (GCVE-0-2026-111679)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-21 21:02
VLAI
EPSS
VEX
Title
Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips
Summary
Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 21:02 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/EKKOLearnAI/ekko-studio/issues/3057 | issue-tracking |
| https://github.com/EKKOLearnAI/ekko-studio/blob/v… | technical-description |
| https://github.com/EKKOLearnAI/ekko-studio/blob/v… | technical-description |
| https://github.com/EKKOLearnAI/ekko-studio/commit… | patch |
| https://www.vulncheck.com/advisories/ekko-studio-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EKKOLearnAI | ekko-studio |
Affected:
0 , ≤ 0.7.36
(custom)
|
Date Public
2026-09-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T21:02:00.683198Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:02:10.862Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/EKKOLearnAI/ekko-studio",
"product": "ekko-studio",
"repo": "https://github.com/EKKOLearnAI/ekko-studio",
"vendor": "EKKOLearnAI",
"versions": [
{
"lessThanOrEqual": "0.7.36",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:38.049Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/EKKOLearnAI/ekko-studio/issues/3057"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/routes/auth.ts#L26-L27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/EKKOLearnAI/ekko-studio/blob/v0.7.36/packages/server/src/modules/studio/controllers/auth.ts#L807-L822"
},
{
"tags": [
"patch"
],
"url": "https://github.com/EKKOLearnAI/ekko-studio/commit/e65030bf26d12e1a523e773c5738af9ff61377ef"
},
{
"name": "VulnCheck Advisory: Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ekko-studio-through-0.7.36-missing-authorization-via-api-auth-locked-ips"
}
],
"title": "Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111679",
"datePublished": "2026-10-16T17:39:38.049Z",
"dateReserved": "2026-10-16T14:31:18.825Z",
"dateUpdated": "2026-10-21T21:02:10.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111670 (GCVE-0-2026-111670)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-19 13:25
VLAI
EPSS
VEX
Title
ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module
Summary
ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 13:24 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/clickvisual-repo… | third-party-advisory |
| https://github.com/clickvisual/clickvisual/blob/v… | technical-description |
| https://github.com/clickvisual/clickvisual/blob/v… | technical-description |
| https://www.vulncheck.com/advisories/clickvisual-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| clickvisual | clickvisual |
Affected:
0 , ≤ 1.1.2
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111670",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T13:24:41.479759Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:25:08.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/clickvisual-report-module-missing-authz-cross-instance-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/clickvisual/clickvisual",
"product": "clickvisual",
"repo": "https://github.com/clickvisual/clickvisual",
"vendor": "clickvisual",
"versions": [
{
"lessThanOrEqual": "1.1.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:31.782Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/clickvisual-report-module-missing-authz-cross-instance-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/api/apiv2/report/report.go#L282-L343"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/clickvisual/clickvisual/blob/v1.1.2/api/internal/service/report/metadata.go#L136-L152"
},
{
"name": "VulnCheck Advisory: ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/clickvisual-through-1.1.2-missing-authorization-in-apiv2-report-module"
}
],
"title": "ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111670",
"datePublished": "2026-10-16T17:39:31.782Z",
"dateReserved": "2026-10-16T14:31:17.586Z",
"dateUpdated": "2026-10-19T13:25:08.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111668 (GCVE-0-2026-111668)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-23 14:07
VLAI
EPSS
VEX
Title
AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API
Summary
AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:06 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/aihelms-efficien… | third-party-advisory |
| https://github.com/beizhu-1209/AIHelms/blob/0.1.2… | technical-description |
| https://github.com/beizhu-1209/AIHelms/blob/0.1.2… | technical-description |
| https://www.vulncheck.com/advisories/aihelms-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| beizhu-1209 | AIHelms |
Affected:
0 , ≤ 0.1.25
(custom)
|
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111668",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T14:06:56.204311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T14:07:02.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/aihelms-efficiency-analytics-missing-authorization"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/beizhu-1209/AIHelms",
"product": "AIHelms",
"repo": "https://github.com/beizhu-1209/AIHelms",
"vendor": "beizhu-1209",
"versions": [
{
"lessThanOrEqual": "0.1.25",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:30.328Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/aihelms-efficiency-analytics-missing-authorization"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/beizhu-1209/AIHelms/blob/0.1.25/apps/api/v1/efficiency.py#L284-L307"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/beizhu-1209/AIHelms/blob/0.1.25/apps/api/v1/efficiency.py#L436-L447"
},
{
"name": "VulnCheck Advisory: AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/aihelms-through-0.1.25-missing-authorization-in-efficiency-analytics-api"
}
],
"title": "AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111668",
"datePublished": "2026-10-16T17:39:30.328Z",
"dateReserved": "2026-10-16T14:31:17.326Z",
"dateUpdated": "2026-10-23T14:07:02.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111665 (GCVE-0-2026-111665)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-19 13:23
VLAI
EPSS
VEX
Title
Piranha CMS through 12.2 Missing Authorization in Manager Language API
Summary
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 13:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/piranha-cms-mana… | third-party-advisory |
| https://github.com/PiranhaCMS/piranha.core/blob/v… | technical-description |
| https://github.com/PiranhaCMS/piranha.core/blob/v… | technical-description |
| https://www.vulncheck.com/advisories/piranha-cms-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PiranhaCMS | Piranha CMS |
Affected:
0 , ≤ 12.2
(custom)
cpe:2.3:a:dotnetfoundation:piranha_cms:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111665",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T13:23:06.413995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:23:30.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/piranha-cms-manager-language-api-missing-permission"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/PiranhaCMS/piranha.core",
"product": "Piranha CMS",
"repo": "https://github.com/PiranhaCMS/piranha.core",
"vendor": "PiranhaCMS",
"versions": [
{
"lessThanOrEqual": "12.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dotnetfoundation:piranha_cms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:28.253Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/piranha-cms-manager-language-api-missing-permission"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/PiranhaCMS/piranha.core/blob/v12.2/core/Piranha.Manager/Controllers/LanguageApiController.cs#L21-L89"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/PiranhaCMS/piranha.core/blob/v12.2/core/Piranha.Manager/Services/LanguageService.cs#L84-L110"
},
{
"name": "VulnCheck Advisory: Piranha CMS through 12.2 Missing Authorization in Manager Language API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/piranha-cms-through-12.2-missing-authorization-in-manager-language-api"
}
],
"title": "Piranha CMS through 12.2 Missing Authorization in Manager Language API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111665",
"datePublished": "2026-10-16T17:39:28.253Z",
"dateReserved": "2026-10-16T14:31:16.910Z",
"dateUpdated": "2026-10-19T13:23:30.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111652 (GCVE-0-2026-111652)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 19:17
VLAI
EPSS
VEX
Title
Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment
Summary
Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/engineercms-atta… | third-party-advisory |
| https://github.com/3xxx/engineercms/blob/v2.0.5/c… | technical-description |
| https://github.com/3xxx/engineercms | product |
| https://www.vulncheck.com/advisories/engineercms-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 3xxx | engineercms |
Affected:
0 , ≤ 2.0.5
(custom)
cpe:2.3:a:engineercms_project:engineercms:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111652",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:16:54.874748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:17:31.852Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/engineercms-attachment-image-mp4-missing-authz"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/3xxx/engineercms",
"product": "engineercms",
"repo": "https://github.com/3xxx/engineercms",
"vendor": "3xxx",
"versions": [
{
"lessThanOrEqual": "2.0.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:engineercms_project:engineercms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.0.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to download project image and video attachments. Attackers can request known or derived /attachment/* paths for .jpg, .png, .bmp, or .mp4 files, which are served before casbin, owner, or admin checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:19.344Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/engineercms-attachment-image-mp4-missing-authz"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/3xxx/engineercms/blob/v2.0.5/controllers/attachment.go#L1705-L1706"
},
{
"tags": [
"product"
],
"url": "https://github.com/3xxx/engineercms"
},
{
"name": "VulnCheck Advisory: Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/engineercms-through-2.0.5-missing-authorization-via-attachcontroller-attachment"
}
],
"title": "Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111652",
"datePublished": "2026-10-16T17:39:19.344Z",
"dateReserved": "2026-10-16T14:31:15.147Z",
"dateUpdated": "2026-10-16T19:17:31.852Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.