Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
9049 vulnerabilities reference this CWE, most recent first.
CVE-2026-109611 (GCVE-0-2026-109611)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:21 – Updated: 2026-10-13 13:36
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints
Summary
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:36 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109611",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:36:00.546598Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:36:22.264Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.121.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.34.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.121.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.34.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.121.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.34.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "diptanilsaha"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:21:59.119Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p4jx-mqwq-66cj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-p4jx-mqwq-66cj"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-certain-endpoints"
}
],
"title": "Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109611",
"datePublished": "2026-10-12T22:21:59.119Z",
"dateReserved": "2026-10-12T21:03:50.774Z",
"dateUpdated": "2026-10-13T13:36:22.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109610 (GCVE-0-2026-109610)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:21 – Updated: 2026-10-13 16:45
VLAI
EPSS
VEX
Title
Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
Summary
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:48 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-erpne… | third-party-advisory |
Impacted products
Date Public
2026-09-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109610",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:48:29.545173Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:45:51.673Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.119.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.32.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.119.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.119.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.32.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "alaeddine03"
},
{
"lang": "en",
"type": "reporter",
"value": "schorro"
},
{
"lang": "en",
"type": "finder",
"value": "diptanilsaha"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:21:58.500Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pg3r-7236-pg74)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-pg3r-7236-pg74"
},
{
"name": "VulnCheck Advisory: Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-missing-authorization-allows-unauthorized-document-modification"
}
],
"title": "Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109610",
"datePublished": "2026-10-12T22:21:58.500Z",
"dateReserved": "2026-10-12T21:03:50.774Z",
"dateUpdated": "2026-10-13T16:45:51.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109600 (GCVE-0-2026-109600)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:21 – Updated: 2026-10-15 14:07
VLAI
EPSS
VEX
Title
Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Summary
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:07 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:07:16.658449Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T14:07:32.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.118.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.31.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.118.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.31.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.31.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.118.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "robinroy03"
},
{
"lang": "en",
"type": "finder",
"value": "AarDG10"
}
],
"datePublic": "2026-09-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:21:53.808Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-55m4-gj6h-q6rc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-55m4-gj6h-q6rc"
},
{
"name": "VulnCheck Advisory: Frappe before 16.31.0 Improper Access Control in Document Follow Notifications",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-before-16.31.0-improper-access-control-in-document-follow-notifications"
}
],
"title": "Frappe before 16.31.0 Improper Access Control in Document Follow Notifications",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109600",
"datePublished": "2026-10-12T22:21:53.808Z",
"dateReserved": "2026-10-12T20:59:18.909Z",
"dateUpdated": "2026-10-15T14:07:32.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109599 (GCVE-0-2026-109599)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:21 – Updated: 2026-10-18 12:13
VLAI
EPSS
VEX
Title
Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
Summary
Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:56 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-befor… | third-party-advisory |
Impacted products
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:56:20.788114Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:13:29.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.113.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.25.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.113.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.25.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.113.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.25.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "diptanilsaha"
},
{
"lang": "en",
"type": "reporter",
"value": "SankalpaBaral"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:21:53.213Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-22v9-hw3x-x59w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-22v9-hw3x-x59w"
},
{
"name": "VulnCheck Advisory: Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-before-15.113.3-missing-authorization-allows-unauthorized-record-modification"
}
],
"title": "Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109599",
"datePublished": "2026-10-12T22:21:53.213Z",
"dateReserved": "2026-10-12T20:59:18.909Z",
"dateUpdated": "2026-10-18T12:13:29.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109598 (GCVE-0-2026-109598)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:21 – Updated: 2026-10-13 13:34
VLAI
EPSS
VEX
Title
Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
Summary
Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:34 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/frappe-befor… | third-party-advisory |
Impacted products
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:34:32.726365Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:34:45.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/frappe",
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"lessThan": "15.120.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "16.33.0",
"status": "affected",
"version": "16.0.0-beta.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "15.120.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "16.33.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "16.33.0",
"versionStartIncluding": "16.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:frappe:*:*:*:*:*:*:*:*",
"versionEndExcluding": "15.120.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Darshan060224"
},
{
"lang": "en",
"type": "finder",
"value": "AarDG10"
},
{
"lang": "en",
"type": "reporter",
"value": "kartiks914"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T22:21:52.587Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wrh5-p77r-jpvq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-wrh5-p77r-jpvq"
},
{
"name": "VulnCheck Advisory: Frappe before 16.33.0 Broken Authorization via send_sms Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/frappe-before-16.33.0-broken-authorization-via-send-sms-endpoint"
}
],
"title": "Frappe before 16.33.0 Broken Authorization via send_sms Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109598",
"datePublished": "2026-10-12T22:21:52.587Z",
"dateReserved": "2026-10-12T20:59:18.909Z",
"dateUpdated": "2026-10-13T13:34:45.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109592 (GCVE-0-2026-109592)
Vulnerability from cvelistv5 – Published: 2026-10-30 17:15 – Updated: 2026-10-30 18:08
VLAI
EPSS
VEX
Title
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements
Summary
The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary other users' placement rows (position, sort order, parent folder, and meta) and read serialized metadata — including title, permalink, and post status — of the entities those orphaned placements reference. Exploitation requires at least one orphaned placement to exist — a state produced naturally by the plugin's own trash cascade, which marks a parent folder as trashed while leaving child placements' parent_id intact — and the attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the 'read' capability held by every default WordPress role. This was also independently found by the OpenStation team.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:33 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
Wordfence
CNA
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wordpressdotorg | OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA |
Affected:
0 , ≤ 1.1.16
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:33:21.282381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T18:08:58.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenStation \u2013 Admin Dashboard Notes, Custom Dashboard, AI Assistant \u0026 PWA",
"vendor": "wordpressdotorg",
"versions": [
{
"lessThanOrEqual": "1.1.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
},
{
"lang": "en",
"type": "finder",
"value": "OpenStation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "The OpenStation: Desktop Windows, Dock \u0026 Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary other users\u0027 placement rows (position, sort order, parent folder, and meta) and read serialized metadata \u2014 including title, permalink, and post status \u2014 of the entities those orphaned placements reference. Exploitation requires at least one orphaned placement to exist \u2014 a state produced naturally by the plugin\u0027s own trash cascade, which marks a parent folder as trashed while leaving child placements\u0027 parent_id intact \u2014 and the attacker must first self-enable OpenStation via the save-openstation AJAX endpoint, which requires only the \u0027read\u0027 capability held by every default WordPress role. This was also independently found by the OpenStation team."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:15:30.070Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a62e499d-6520-4bad-963a-ff7619daa5f8?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.1.13/includes/desktop-files/store.php#L254"
},
{
"url": "https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.1.13/includes/desktop-files/rest.php#L517"
},
{
"url": "https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.1.13/includes/desktop-files/folders-store.php#L618"
},
{
"url": "https://plugins.trac.wordpress.org/browser/desktop-mode/tags/1.1.13/includes/desktop-files/rest.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3761843%40desktop-mode\u0026new=3761843%40desktop-mode"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-30T14:45:40.000Z",
"value": "Disclosed"
}
],
"title": "OpenStation: Desktop Windows, Dock \u0026 Virtual Desktops for WP Admin \u003c= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/\u003cid\u003e on orphaned placements"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109592",
"datePublished": "2026-10-30T17:15:30.070Z",
"dateReserved": "2026-10-12T20:47:25.771Z",
"dateUpdated": "2026-10-30T18:08:58.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109572 (GCVE-0-2026-109572)
Vulnerability from cvelistv5 – Published: 2026-10-12 22:21 – Updated: 2026-10-23 21:58
VLAI
EPSS
VEX
Title
Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy
Summary
Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:48 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | vendor-advisory |
| https://github.com/open-webui/open-webui/commit/5… | patch |
| https://www.vulncheck.com/advisories/open-webui-0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-webui | open-webui |
Affected:
0.8.6 , < 0.11.4
(semver)
Unaffected: 0.11.4 (semver) cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* |
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:48:38.972002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:46:13.259Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/open-webui",
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"lessThan": "0.11.4",
"status": "affected",
"version": "0.8.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.11.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.11.4",
"versionStartIncluding": "0.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dhlife09"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Classic298"
},
{
"lang": "en",
"type": "reporter",
"value": "ye11oc4t"
},
{
"lang": "en",
"type": "reporter",
"value": "jiwhan8655"
},
{
"lang": "en",
"type": "reporter",
"value": "Dog-Parka"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users\u0027 terminals and modify terminal policies, injecting environment variables into other users\u0027 terminals."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:58:00.807Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q46m-r89w-j74p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-q46m-r89w-j74p"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/open-webui/open-webui/commit/51bb8cb142f72503e861eeee25ae4dc73c26c36b"
},
{
"name": "VulnCheck Advisory: Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-webui-0.8.6-before-0.11.4-privilege-escalation-via-terminal-proxy"
}
],
"title": "Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109572",
"datePublished": "2026-10-12T22:21:48.699Z",
"dateReserved": "2026-10-12T19:27:55.342Z",
"dateUpdated": "2026-10-23T21:58:00.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109564 (GCVE-0-2026-109564)
Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-27 01:30
VLAI
EPSS
VEX
Title
LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
Summary
LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:48 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/learnhouse/learnhouse/pull/1120 | issue-trackingpatch |
| https://github.com/learnhouse/learnhouse/commit/9… | patch |
| https://github.com/learnhouse/learnhouse | product |
| https://www.vulncheck.com/advisories/learnhouse-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| learnhouse | LearnHouse |
Affected:
0 , < 1.4.0
(custom)
Unaffected: 1.4.0 (custom) cpe:2.3:a:learnhouse:learnhouse:*:*:*:*:*:*:*:* |
Date Public
2026-10-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109564",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:48:40.620253Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:46:42.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/learnhouse/learnhouse",
"product": "LearnHouse",
"repo": "https://github.com/learnhouse/learnhouse",
"vendor": "learnhouse",
"versions": [
{
"lessThan": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "1.4.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:learnhouse:learnhouse:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mansurzhan Mavlankulov"
}
],
"datePublic": "2026-10-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html_content and republish it publicly."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T01:30:43.708Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Pull Request #1120",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/learnhouse/learnhouse/pull/1120"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/learnhouse/learnhouse/commit/9a1319185a596ea9b40651dbfd96f05195c0be37"
},
{
"tags": [
"product"
],
"url": "https://github.com/learnhouse/learnhouse"
},
{
"name": "VulnCheck Advisory: LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/learnhouse-before-1.4.0-missing-authorization-via-playground-duplicate-endpoint"
}
],
"title": "LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109564",
"datePublished": "2026-10-12T20:55:17.509Z",
"dateReserved": "2026-10-12T19:27:52.842Z",
"dateUpdated": "2026-10-27T01:30:43.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109562 (GCVE-0-2026-109562)
Vulnerability from cvelistv5 – Published: 2026-10-12 20:55 – Updated: 2026-10-15 13:53
VLAI
EPSS
VEX
Title
SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API
Summary
SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:53 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/snapotter-hq/SnapOtter/commit/… | patch |
| https://github.com/snapotter-hq/SnapOtter/blob/v2… | technical-description |
| https://github.com/snapotter-hq/SnapOtter | product |
| https://www.vulncheck.com/advisories/snapotter-1.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| snapotter-hq | SnapOtter |
Affected:
1.15.10 , ≤ 2.2.0
(custom)
|
Date Public
2026-08-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T13:53:48.317704Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T13:53:59.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SnapOtter",
"repo": "https://github.com/snapotter-hq/SnapOtter",
"vendor": "snapotter-hq",
"versions": [
{
"lessThanOrEqual": "2.2.0",
"status": "affected",
"version": "1.15.10",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilshod Gofurov"
}
],
"datePublic": "2026-08-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T20:55:16.236Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/snapotter-hq/SnapOtter/commit/1544966b52b8f2b40ef3794e43ffd4f0214550ba"
},
{
"name": "Vulnerable code in files.ts",
"tags": [
"technical-description"
],
"url": "https://github.com/snapotter-hq/SnapOtter/blob/v2.2.0/apps/api/src/routes/files.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/snapotter-hq/SnapOtter"
},
{
"name": "VulnCheck Advisory: SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snapotter-1.15.10-through-2.2.0-missing-authorization-via-upload-and-preview-api"
}
],
"title": "SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109562",
"datePublished": "2026-10-12T20:55:16.236Z",
"dateReserved": "2026-10-12T19:27:52.288Z",
"dateUpdated": "2026-10-15T13:53:59.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109525 (GCVE-0-2026-109525)
Vulnerability from cvelistv5 – Published: 2026-10-13 15:15 – Updated: 2026-10-13 15:24
VLAI
EPSS
VEX
Title
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
Summary
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 15:24 UTC
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/417189 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/417189/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109525 | third-party-advisory |
| https://vuldb.com/submit/984343 | third-party-advisory |
| https://github.com/girishsaraf/Online-Appointment… | exploitissue-tracking |
| https://github.com/girishsaraf/Online-Appointment… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| girishsaraf | Online-Appointment-Booking-System |
Affected:
f427b4757128ca253d33d0cc4e87bbb9c999a4d5
cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109525",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T15:24:06.182543Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:24:17.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:girishsaraf:online-appointment-booking-system:*:*:*:*:*:*:*:*"
],
"modules": [
"submit2 Handler"
],
"product": "Online-Appointment-Booking-System",
"vendor": "girishsaraf",
"versions": [
{
"status": "affected",
"version": "f427b4757128ca253d33d0cc4e87bbb9c999a4d5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "huimouwaner (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T15:15:17.321Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-417189 | girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/417189"
},
{
"name": "VDB-417189 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/417189/cti"
},
{
"name": "CVE-2026-109525 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109525"
},
{
"name": "Submit #984343 | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/984343"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/15"
},
{
"tags": [
"product"
],
"url": "https://github.com/girishsaraf/Online-Appointment-Booking-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T21:09:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109525",
"datePublished": "2026-10-13T15:15:17.321Z",
"dateReserved": "2026-10-12T19:04:30.719Z",
"dateUpdated": "2026-10-13T15:24:17.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.