Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
2945 vulnerabilities reference this CWE, most recent first.
CVE-2026-113607 (GCVE-0-2026-113607)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:40 – Updated: 2026-10-20 16:28
VLAI
EPSS
VEX
Title
Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
Summary
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:28 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/jleyva/moodle-block_configurab… | patch |
| https://github.com/jleyva/moodle-block_configurab… | release-notes |
| https://github.com/jleyva/moodle-block_configurab… | technical-description |
| https://www.vulncheck.com/advisories/configurable… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jleyva | moodle-block_configurablereports |
Affected:
0 , < 5.3.0
(semver)
|
Date Public
2026-10-07 07:30
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:28:04.591066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:28:22.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "moodle-block_configurablereports",
"repo": "https://github.com/jleyva/moodle-block_configurablereports",
"vendor": "jleyva",
"versions": [
{
"lessThan": "5.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tr\u1ea7n V\u0103n Ho\u00e0ng"
}
],
"datePublic": "2026-10-07T07:30:25.000Z",
"descriptions": [
{
"lang": "en",
"value": "Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_permissions fails, the function only adds a warning and still returns the full report table, letting any logged-in user supply arbitrary report ids to read SQL reports over user and grade data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:40:33.391Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/jleyva/moodle-block_configurablereports/commit/4a0e6eadf7bdb6fa52ef71141bdf120cd68e6abc"
},
{
"name": "moodle-block_configurablereports 5.3.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/jleyva/moodle-block_configurablereports/releases/tag/5.3.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jleyva/moodle-block_configurablereports/blob/5.2.0/classes/external.php#L95-L99"
},
{
"name": "VulnCheck Advisory: Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/configurable-reports-block-for-moodle-before-5.3.0-authorization-bypass-via-get-report-data"
}
],
"title": "Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113607",
"datePublished": "2026-10-20T15:40:33.391Z",
"dateReserved": "2026-10-20T11:48:58.612Z",
"dateUpdated": "2026-10-20T16:28:22.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113357 (GCVE-0-2026-113357)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 13:42
VLAI
EPSS
VEX
Title
@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker
Summary
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 13:42 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tester-army/e2e/pull/1161 | patchissue-tracking |
| https://github.com/tester-army/e2e/commit/ce4dac3… | patch |
| https://github.com/tester-army/e2e/releases/tag/%… | release-notes |
| https://github.com/tester-army/e2e/blob/37e946907… | technical-description |
| https://www.vulncheck.com/advisories/e2e-dev-gith… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tester-army | @e2e-dev/github |
Affected:
0 , < 0.4.1
(semver)
|
Date Public
2026-10-15 09:58
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113357",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T13:42:40.490113Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T13:42:52.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40e2e-dev/github",
"product": "@e2e-dev/github",
"repo": "https://github.com/tester-army/e2e",
"vendor": "tester-army",
"versions": [
{
"lessThan": "0.4.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brandon Tarr"
}
],
"datePublic": "2026-10-15T09:58:23.000Z",
"descriptions": [
{
"lang": "en",
"value": "@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive results in their own comment and edit failures to passes, or suppress genuine reports entirely."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:41:41.607Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/tester-army/e2e/pull/1161"
},
{
"tags": [
"patch"
],
"url": "https://github.com/tester-army/e2e/commit/ce4dac373784f87fade6808119ba537a0b4965fc"
},
{
"name": "@e2e-dev/github %40e2e-dev%2Fgithub%400.4.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/tester-army/e2e/releases/tag/%40e2e-dev%2Fgithub%400.4.1"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/tester-army/e2e/blob/37e946907bc26743d68861b97127271143441eb3/packages/github/src/post.ts"
},
{
"name": "VulnCheck Advisory: @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/e2e-dev-github-before-0.4.1-ci-report-hijacking-via-predictable-comment-marker"
}
],
"title": "@e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113357",
"datePublished": "2026-10-20T10:41:41.607Z",
"dateReserved": "2026-10-20T01:07:47.767Z",
"dateUpdated": "2026-10-20T13:42:52.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113354 (GCVE-0-2026-113354)
Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-22 21:19
VLAI
EPSS
VEX
Title
Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
Summary
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 21:19 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Finsys/dockhand/security/advis… | vendor-advisory |
| https://github.com/Finsys/dockhand/commit/5af4e69… | patch |
| https://github.com/Finsys/dockhand/releases/tag/v1.0.46 | release-notes |
| https://github.com/Finsys/dockhand/blob/5adb374c0… | technical-description |
| https://www.vulncheck.com/advisories/dockhand-bef… | third-party-advisory |
Date Public
2026-10-15 10:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113354",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T21:19:39.480265Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T21:19:59.100Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-433w-5hff-22h6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Finsys/dockhand",
"product": "dockhand",
"repo": "https://github.com/Finsys/dockhand",
"vendor": "Finsys",
"versions": [
{
"lessThan": "1.0.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Allan Victor"
},
{
"lang": "en",
"type": "finder",
"value": "Bruno Alvarenga"
}
],
"datePublic": "2026-10-15T10:26:21.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T10:41:39.517Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-433w-5hff-22h6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-433w-5hff-22h6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Finsys/dockhand/commit/5af4e69eb20bde4b84756eb600bd521c8d300fb5"
},
{
"name": "dockhand v1.0.46 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/Finsys/dockhand/releases/tag/v1.0.46"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Finsys/dockhand/blob/5adb374c0d79c8df0f8524f6c7fe27bbc493a1dc/src/routes/api/system/files/content/%2Bserver.ts"
},
{
"name": "VulnCheck Advisory: Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.46-arbitrary-file-read-via-api-system-files-content"
}
],
"title": "Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-113354",
"datePublished": "2026-10-20T10:41:39.517Z",
"dateReserved": "2026-10-20T01:07:46.735Z",
"dateUpdated": "2026-10-22T21:19:59.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112956 (GCVE-0-2026-112956)
Vulnerability from cvelistv5 – Published: 2026-10-20 15:57 – Updated: 2026-10-20 16:15
VLAI
EPSS
VEX
Title
ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
Summary
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 16:14 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/apostrophecms/apostrophe/secur… | x_refsource_CONFIRM |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/commi… | x_refsource_MISC |
| https://github.com/apostrophecms/apostrophe/relea… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| apostrophecms | apostrophe |
Affected:
< 4.34.0
|
|
| @apostrophecms | mport-export |
Affected:
< 3.7.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112956",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T16:14:45.468268Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T16:15:02.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "apostrophe",
"vendor": "apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 4.34.0"
}
]
},
{
"product": "mport-export",
"vendor": "@apostrophecms",
"versions": [
{
"status": "affected",
"version": "\u003c 3.7.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:57:27.287Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jf5h-36mg-rp6x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jf5h-36mg-rp6x"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498"
},
{
"name": "https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea"
},
{
"name": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1"
}
],
"source": {
"advisory": "GHSA-jf5h-36mg-rp6x",
"discovery": "UNKNOWN"
},
"title": "ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112956",
"datePublished": "2026-10-20T15:57:27.287Z",
"dateReserved": "2026-10-19T21:30:47.246Z",
"dateUpdated": "2026-10-20T16:15:02.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112776 (GCVE-0-2026-112776)
Vulnerability from cvelistv5 – Published: 2026-10-19 19:10 – Updated: 2026-10-20 15:09
VLAI
EPSS
VEX
Title
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations
Summary
Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites' content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:08 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/craftcms/cms/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/craft-cms-5.… | third-party-advisory |
Impacted products
Date Public
2026-10-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:08:38.181488Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:09:02.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.11.0",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.11.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sites\u0027 content because requireAllowedSite() is not enforced. Attackers holding a site-A token can create entries in site B via supplied siteId and delete entries, categories, tags, and assets shared across sites."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:10:53.896Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7rr3-4jcm-x526)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-7rr3-4jcm-x526"
},
{
"name": "VulnCheck Advisory: Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.0-graphql-site-scope-bypass-via-mutations"
}
],
"title": "Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112776",
"datePublished": "2026-10-19T19:10:53.896Z",
"dateReserved": "2026-10-19T18:10:49.940Z",
"dateUpdated": "2026-10-20T15:09:02.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112769 (GCVE-0-2026-112769)
Vulnerability from cvelistv5 – Published: 2026-10-19 19:10 – Updated: 2026-10-20 15:35
VLAI
EPSS
VEX
Title
Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass
Summary
Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user's session token, can send POST requests to /sessions or /classes/_Session to create additional sessions for that user and add fields to _Session; these sessions are not revoked when the original session is logged out.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:35 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/parse-community/parse-server/s… | vendor-advisory |
| https://www.vulncheck.com/advisories/parse-server… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| parse-community | parse-server |
Affected:
9.0.0 , < 9.10.3-alpha.1
(semver)
Unaffected: 9.10.3-alpha.1 (semver) |
|
| parse-community | parse-server |
Affected:
0 , < 8.6.98
(semver)
Unaffected: 8.6.98 (semver) |
Date Public
2026-10-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112769",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:35:10.692894Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:35:25.264Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "9.10.3-alpha.1",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.10.3-alpha.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "8.6.98",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.6.98",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "9.10.3-alpha.1",
"versionStartIncluding": "9.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "8.6.98",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "mtrezza"
}
],
"datePublic": "2026-10-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session class when creating sessions. An authenticated user, or anyone holding that user\u0027s session token, can send POST requests to /sessions or /classes/_Session to create additional sessions for that user and add fields to _Session; these sessions are not revoked when the original session is logged out."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:10:49.061Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-gj37-5hg5-p729)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-gj37-5hg5-p729"
},
{
"name": "VulnCheck Advisory: Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/parse-server-before-8.6.98-and-9-x-before-9.10.3-alpha.1-session-class-level-permission-bypass"
}
],
"title": "Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112769",
"datePublished": "2026-10-19T19:10:49.061Z",
"dateReserved": "2026-10-19T18:10:49.940Z",
"dateUpdated": "2026-10-20T15:35:25.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112768 (GCVE-0-2026-112768)
Vulnerability from cvelistv5 – Published: 2026-10-19 19:10 – Updated: 2026-10-19 21:24
VLAI
EPSS
VEX
Title
Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update
Summary
Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:24 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/parse-community/parse-server/s… | vendor-advisory |
| https://www.vulncheck.com/advisories/parse-server… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| parse-community | parse-server |
Affected:
9.0.0 , < 9.10.3-alpha.2
(semver)
Unaffected: 9.10.3-alpha.2 (semver) |
|
| parse-community | parse-server |
Affected:
0 , < 8.6.99
(semver)
Unaffected: 8.6.99 (semver) |
Date Public
2026-10-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:24:04.328659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:24:16.538Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "9.10.3-alpha.2",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.10.3-alpha.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "8.6.99",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.6.99",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "9.10.3-alpha.2",
"versionStartIncluding": "9.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "8.6.99",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "mtrezza"
}
],
"datePublic": "2026-10-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is set, guessed current or previous passwords, bypassing account lockout."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:10:48.394Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p49q-9w65-f9p7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-p49q-9w65-f9p7"
},
{
"name": "VulnCheck Advisory: Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/parse-server-before-8.6.99-and-9-x-before-9.10.3-alpha.2-information-disclosure-via-user-update"
}
],
"title": "Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112768",
"datePublished": "2026-10-19T19:10:48.394Z",
"dateReserved": "2026-10-19T18:10:49.940Z",
"dateUpdated": "2026-10-19T21:24:16.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112380 (GCVE-0-2026-112380)
Vulnerability from cvelistv5 – Published: 2026-10-20 20:05 – Updated: 2026-10-29 18:48
VLAI
EPSS
VEX
Title
Missing authorization in the WhatsApp channel in Kiro Crew
Summary
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.
To remediate this issue, users should upgrade to version 0.7.2.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 18:47 UTC
Assigner
AMZN
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kirodotdev/KiroCrew/releases/t… | release-notespatch |
| https://aws.amazon.com/security/security-bulletin… | vendor-advisory |
| https://github.com/kirodotdev/KiroCrew/security/a… | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T18:47:28.733642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T18:48:02.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kiro Crew",
"vendor": "Amazon",
"versions": [
{
"lessThanOrEqual": "0.7.1",
"status": "affected",
"version": "0.4.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:amazon:kiro_crew:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.7.1",
"versionStartIncluding": "0.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator\u0027s other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version 0.7.2.\u003c/p\u003e"
}
],
"value": "Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator\u0027s other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.\n\n\n\nTo remediate this issue, users should upgrade to version 0.7.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T20:10:09.088Z",
"orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"shortName": "AMZN"
},
"references": [
{
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/kirodotdev/KiroCrew/releases/tag/v0.7.2"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/2026-140-aws/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/kirodotdev/KiroCrew/security/advisories/GHSA-x4jf-p42g-q3hc"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing authorization in the WhatsApp channel in Kiro Crew",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
"assignerShortName": "AMZN",
"cveId": "CVE-2026-112380",
"datePublished": "2026-10-20T20:05:28.394Z",
"dateReserved": "2026-10-19T16:52:56.737Z",
"dateUpdated": "2026-10-29T18:48:02.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112342 (GCVE-0-2026-112342)
Vulnerability from cvelistv5 – Published: 2026-10-23 18:15 – Updated: 2026-11-08 14:00 X_Open Source
VLAI
EPSS
VEX
Title
Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
Summary
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 20:43 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/TandoorRecipes/recipes/securit… | vendor-advisory |
| https://github.com/TandoorRecipes/recipes/release… | release-notespatch |
| https://github.com/TandoorRecipes/recipes/commit/… | patch |
| https://www.vulncheck.com/advisories/tandoor-reci… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tandoor Recipes | Tandoor Recipes |
Affected:
0 , < 2.7.0
(semver)
cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:* |
Date Public
2026-10-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112342",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T20:43:50.317509Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:55:58.119Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/TandoorRecipes/recipes",
"product": "Tandoor Recipes",
"repo": "https://github.com/TandoorRecipes/recipes",
"vendor": "Tandoor Recipes",
"versions": [
{
"lessThan": "2.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tandoor:recipes:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "m0usem0use"
}
],
"datePublic": "2026-10-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry\u0027s TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T14:00:52.058Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-69q3-5q6x-7hmx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-69q3-5q6x-7hmx"
},
{
"name": "Tandoor Recipes 2.7.0 Release Notes",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/TandoorRecipes/recipes/releases/tag/2.7.0"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/TandoorRecipes/recipes/commit/1285f5009aa166c0d6f8658849eed5686294d5e9"
},
{
"name": "VulnCheck Advisory: Tandoor Recipes \u003c 2.7.0 Cross-Space Permission Cache Poisoning",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tandoor-recipes-cross-space-permission-cache-poisoning"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "Tandoor Recipes \u003c 2.7.0 Cross-Space Permission Cache Poisoning",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112342",
"datePublished": "2026-10-23T18:15:16.426Z",
"dateReserved": "2026-10-19T14:41:46.701Z",
"dateUpdated": "2026-11-08T14:00:52.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112340 (GCVE-0-2026-112340)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-06 17:24
VLAI
EPSS
VEX
Title
Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request
Summary
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:16 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/wazuh/wazuh/security/advisorie… | vendor-advisorythird-party-advisory |
| https://github.com/wazuh/wazuh/releases/tag/v4.14.9 | release-notes |
| https://www.vulncheck.com/advisories/wazuh-4.9.0-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wazuh | wazuh-dashboard-plugins |
Affected:
4.9.0 , < 4.14.9
(semver)
Unaffected: 4.14.9 (semver) cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* |
Date Public
2026-11-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112340",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:16:40.750134Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:24:00.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-7rvv-9467-96mc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wazuh/wazuh-dashboard-plugins",
"product": "wazuh-dashboard-plugins",
"repo": "https://github.com/wazuh/wazuh-dashboard-plugins",
"vendor": "wazuh",
"versions": [
{
"lessThan": "4.14.9",
"status": "affected",
"version": "4.9.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.14.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.9",
"versionStartIncluding": "4.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ShivarajRN"
}
],
"datePublic": "2026-11-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:00:46.603Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7rvv-9467-96mc)",
"tags": [
"vendor-advisory",
"third-party-advisory"
],
"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-7rvv-9467-96mc"
},
{
"name": "wazuh-dashboard-plugins v4.14.9 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.9"
},
{
"name": "VulnCheck Advisory: Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wazuh-4.9.0-before-4.14.9-authorization-header-override-via-api-request"
}
],
"title": "Wazuh 4.9.0 before 4.14.9 Authorization Header Override via /api/request",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112340",
"datePublished": "2026-11-06T15:00:46.603Z",
"dateReserved": "2026-10-19T14:41:46.701Z",
"dateUpdated": "2026-11-06T17:24:00.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.