Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
2945 vulnerabilities reference this CWE, most recent first.
CVE-2026-110806 (GCVE-0-2026-110806)
Vulnerability from cvelistv5 – Published: 2026-10-16 13:44 – Updated: 2026-10-16 15:09
VLAI
EPSS
VEX
Summary
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:09 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
DEVOLUTIONS
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Devolutions | Server |
Affected:
0 , < 2026.3.10
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110806",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:09:28.202535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:31.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Devolutions",
"versions": [
{
"lessThan": "2026.3.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data."
}
],
"value": "Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T13:44:20.481Z",
"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"shortName": "DEVOLUTIONS"
},
"references": [
{
"url": "https://devolutions.net/security/advisories/DEVO-2026-0036/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"assignerShortName": "DEVOLUTIONS",
"cveId": "CVE-2026-110806",
"datePublished": "2026-10-16T13:44:20.481Z",
"dateReserved": "2026-10-14T18:06:43.626Z",
"dateUpdated": "2026-10-16T15:09:31.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110762 (GCVE-0-2026-110762)
Vulnerability from cvelistv5 – Published: 2026-10-14 18:47 – Updated: 2026-10-14 20:23
VLAI
EPSS
VEX
Title
bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream
Summary
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 20:23 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/ | release-notes |
| https://github.com/bbpress/bbPress/commit/5dce23a… | patch |
| https://github.com/bbpress/bbPress/blob/04c6f1513… | technical-description |
| https://wordpress.org/plugins/bbpress/ | product |
| https://www.vulncheck.com/advisories/bbpress-befo… | third-party-advisory |
Impacted products
Date Public
2026-09-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110762",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T20:23:50.067307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T20:23:55.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/bbpress/bbPress",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/bbpress/bbPress",
"product": "bbPress",
"repo": "https://github.com/bbpress/bbPress",
"vendor": "bbPress",
"versions": [
{
"lessThan": "2.6.19",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bbpress:bbpress:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Truong Nguyen Long (thewindghost)"
},
{
"lang": "en",
"type": "finder",
"value": "Nguyen Minh Tuan (m3mories)"
}
],
"datePublic": "2026-09-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:47:38.054Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"release-notes"
],
"url": "https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bbpress/bbPress/commit/5dce23a0b23a22d32c45b96fd44588952b16fe8a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e849ca16015b7a08b3c15e753/src/includes/extend/buddypress/activity.php#L431"
},
{
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/bbpress/"
},
{
"name": "VulnCheck Advisory: bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bbpress-before-2.6.19-information-disclosure-via-buddypress-activity-stream"
}
],
"title": "bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110762",
"datePublished": "2026-10-14T18:47:38.054Z",
"dateReserved": "2026-10-14T17:27:30.918Z",
"dateUpdated": "2026-10-14T20:23:55.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110724 (GCVE-0-2026-110724)
Vulnerability from cvelistv5 – Published: 2026-10-15 12:11 – Updated: 2026-10-16 18:43
VLAI
EPSS
VEX
Summary
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 18:43 UTC
Assigner
eclipse
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Eclipse Foundation | Eclipse Connected Services Platform |
Affected:
1.1.1 , ≤ 1.7.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110724",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T18:43:48.772546Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T18:43:57.741Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eclipse Connected Services Platform",
"vendor": "Eclipse Foundation",
"versions": [
{
"lessThanOrEqual": "1.7.3",
"status": "affected",
"version": "1.1.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eclipse Foundation Security Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets \u2014 one per unique header value \u2014 and completely bypass the gateway\u0027s request-rate limiting on every route that uses the shipped default configuration.\u003c/p\u003e"
}
],
"value": "In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets \u2014 one per unique header value \u2014 and completely bypass the gateway\u0027s request-rate limiting on every route that uses the shipped default configuration."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T12:11:37.639Z",
"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"shortName": "eclipse"
},
"references": [
{
"url": "https://github.com/eclipse-ecsp/api-gateway/pull/330"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/405"
},
{
"url": "https://github.com/eclipse-ecsp/api-gateway/security/advisories/GHSA-4j9j-mx7g-p9p6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"assignerShortName": "eclipse",
"cveId": "CVE-2026-110724",
"datePublished": "2026-10-15T12:11:22.470Z",
"dateReserved": "2026-10-14T14:53:22.659Z",
"dateUpdated": "2026-10-16T18:43:57.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110720 (GCVE-0-2026-110720)
Vulnerability from cvelistv5 – Published: 2026-10-26 18:38 – Updated: 2026-10-26 19:38
VLAI
EPSS
VEX
Title
Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Summary
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 19:06 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
HashiCorp
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T19:06:05.963836Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:38:28.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"64 bit",
"32 bit",
"x86",
"ARM",
"MacOS",
"Windows",
"Linux"
],
"product": "Tooling",
"repo": "https://github.com/hashicorp/consul-k8s",
"vendor": "HashiCorp",
"versions": [
{
"changes": [
{
"at": "1.8.18",
"status": "unaffected"
}
],
"lessThan": "2.0.4",
"status": "affected",
"version": "0.42.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was reported to HashiCorp by Elias Hasas (GitHub: zer0d4y5)."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eConsul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.\u003c/p\u003e\u003cbr/\u003e"
}
],
"value": "Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T18:38:14.209Z",
"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"shortName": "HashiCorp"
},
"references": [
{
"url": "https://discuss.hashicorp.com/t/hcsec-2026-50-consul-k8s-vulnerable-to-a-cross-namespace-authorization-bypass-in-component-acl-binding-rules/77915"
}
],
"source": {
"advisory": "HCSEC-2026-50",
"discovery": "EXTERNAL"
},
"title": "Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules"
}
},
"cveMetadata": {
"assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
"assignerShortName": "HashiCorp",
"cveId": "CVE-2026-110720",
"datePublished": "2026-10-26T18:38:14.209Z",
"dateReserved": "2026-10-14T14:44:47.621Z",
"dateUpdated": "2026-10-26T19:38:28.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110630 (GCVE-0-2026-110630)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:17 – Updated: 2026-10-14 20:20
VLAI
EPSS
VEX
Title
VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment
Summary
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 20:20 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/venturedrake/laravel-crm/issues/79 | issue-tracking |
| https://github.com/venturedrake/laravel-crm/blob/… | technical-description |
| https://github.com/venturedrake/laravel-crm/blob/… | technical-description |
| https://github.com/venturedrake/laravel-crm/commi… | patch |
| https://github.com/venturedrake/laravel-crm/commi… | patch |
| https://github.com/venturedrake/laravel-crm/relea… | release-notes |
| https://github.com/venturedrake/laravel-crm | product |
| https://www.vulncheck.com/advisories/venturedrake… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| venturedrake | laravel-crm |
Affected:
0 , < 2.4.0
(semver)
|
Date Public
2026-03-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110630",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T20:20:04.862530Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T20:20:11.778Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/venturedrake/laravel-crm",
"product": "laravel-crm",
"repo": "https://github.com/venturedrake/laravel-crm",
"vendor": "venturedrake",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-03-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams\u0027 roles and delete cross-team users through the unscoped UserIndex delete() method."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:17:04.557Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/venturedrake/laravel-crm/issues/79"
},
{
"name": "Role::find on the submitted role at 2.3.0",
"tags": [
"technical-description"
],
"url": "https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/Controllers/UserController.php#L87-L94"
},
{
"name": "unscoped, unauthorized UserIndex::delete at 2.3.0",
"tags": [
"technical-description"
],
"url": "https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Users/UserIndex.php#L83-L90"
},
{
"tags": [
"patch"
],
"url": "https://github.com/venturedrake/laravel-crm/commit/d64b59fb9f7355e1be9951fbcc5f54ed715dc212"
},
{
"tags": [
"patch"
],
"url": "https://github.com/venturedrake/laravel-crm/commit/27bd5081004913660ccb3e0181b351a2e4ded104"
},
{
"name": "laravel-crm 2.4.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/venturedrake/laravel-crm"
},
{
"name": "VulnCheck Advisory: VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-privilege-escalation-via-unscoped-role-assignment"
}
],
"title": "VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110630",
"datePublished": "2026-10-14T14:17:04.557Z",
"dateReserved": "2026-10-14T13:07:30.102Z",
"dateUpdated": "2026-10-14T20:20:11.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110453 (GCVE-0-2026-110453)
Vulnerability from cvelistv5 – Published: 2026-10-14 04:15 – Updated: 2026-10-19 18:42
VLAI
EPSS
VEX
Summary
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:33 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
mitre
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NixOS | Nix |
Affected:
0 , < 2.28.8
(semver)
Affected: 2.29.0 , < 2.30.6 (semver) Affected: 2.31.0 , < 2.31.6 (semver) Affected: 2.32.0 , < 2.34.9 (semver) Affected: 2.35.0 , < 2.35.3 (semver) cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:33:23.046919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:42:54.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Nix",
"vendor": "NixOS",
"versions": [
{
"lessThan": "2.28.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.30.6",
"status": "affected",
"version": "2.29.0",
"versionType": "semver"
},
{
"lessThan": "2.31.6",
"status": "affected",
"version": "2.31.0",
"versionType": "semver"
},
{
"lessThan": "2.34.9",
"status": "affected",
"version": "2.32.0",
"versionType": "semver"
},
{
"lessThan": "2.35.3",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.28.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.30.6",
"versionStartIncluding": "2.29.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.31.6",
"versionStartIncluding": "2.31.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.9",
"versionStartIncluding": "2.32.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.35.3",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T04:15:47.269Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-110453",
"datePublished": "2026-10-14T04:15:47.269Z",
"dateReserved": "2026-10-14T04:15:46.477Z",
"dateUpdated": "2026-10-19T18:42:54.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110451 (GCVE-0-2026-110451)
Vulnerability from cvelistv5 – Published: 2026-10-14 04:08 – Updated: 2026-10-14 14:54
VLAI
EPSS
VEX
Summary
Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:54 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
mitre
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NixOS | Nix |
Affected:
0 , < 2.28.8
(semver)
Affected: 2.29.0 , < 2.30.6 (semver) Affected: 2.31.0 , < 2.31.6 (semver) Affected: 2.32.0 , < 2.34.9 (semver) Affected: 2.35.0 , < 2.35.3 (semver) cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:54:20.682665Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:54:42.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Nix",
"vendor": "NixOS",
"versions": [
{
"lessThan": "2.28.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.30.6",
"status": "affected",
"version": "2.29.0",
"versionType": "semver"
},
{
"lessThan": "2.31.6",
"status": "affected",
"version": "2.31.0",
"versionType": "semver"
},
{
"lessThan": "2.34.9",
"status": "affected",
"version": "2.32.0",
"versionType": "semver"
},
{
"lessThan": "2.35.3",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.28.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.30.6",
"versionStartIncluding": "2.29.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.31.6",
"versionStartIncluding": "2.31.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.9",
"versionStartIncluding": "2.32.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.35.3",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T04:08:10.471Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-110451",
"datePublished": "2026-10-14T04:08:10.471Z",
"dateReserved": "2026-10-14T04:08:09.697Z",
"dateUpdated": "2026-10-14T14:54:42.999Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110287 (GCVE-0-2026-110287)
Vulnerability from cvelistv5 – Published: 2026-10-16 13:43 – Updated: 2026-10-16 15:10
VLAI
EPSS
VEX
Summary
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:10 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
DEVOLUTIONS
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Devolutions | Server |
Affected:
0 , < 2026.3.10
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110287",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:10:03.798886Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:10:08.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Devolutions",
"versions": [
{
"lessThan": "2026.3.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint."
}
],
"value": "Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T13:43:25.516Z",
"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"shortName": "DEVOLUTIONS"
},
"references": [
{
"url": "https://devolutions.net/security/advisories/DEVO-2026-0036/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"assignerShortName": "DEVOLUTIONS",
"cveId": "CVE-2026-110287",
"datePublished": "2026-10-16T13:43:25.516Z",
"dateReserved": "2026-10-13T19:35:53.329Z",
"dateUpdated": "2026-10-16T15:10:08.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110176 (GCVE-0-2026-110176)
Vulnerability from cvelistv5 – Published: 2026-10-31 00:01 – Updated: 2026-11-06 15:55
VLAI
EPSS
VEX
Title
File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
Summary
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.
In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 15:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
drupal
CNA
References
2 references
| URL | Tags |
|---|---|
| https://www.herodevs.com/vulnerability-directory/… | third-party-advisory |
| https://d7es.tag1.com/security-advisories/file-fo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | File Force Download |
Affected:
7.1.0 , < 7.1.3
(semver)
|
Date Public
2026-09-02 06:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110176",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T15:55:06.414594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:55:18.851Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/file_force",
"defaultStatus": "unaffected",
"packageName": "file_force",
"platforms": [
"Drupal 7"
],
"product": "File Force Download",
"repo": "https://git.drupalcode.org/project/file_force",
"vendor": "Drupal",
"versions": [
{
"lessThan": "7.1.3",
"status": "affected",
"version": "7.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ra M\u00e4nd (ram4nd)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ra M\u00e4nd (ram4nd)"
}
],
"datePublic": "2026-09-02T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe File Force Download module for Drupal 7 implements \u003ccode\u003ehook_file_download()\u003c/code\u003e to add a \u003ccode\u003eContent-Disposition\u003c/code\u003e header when a file URL carries the \u003ccode\u003edownload\u003c/code\u003e query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\u003c/p\u003e\u003cp\u003eIn versions 7.1.0 through 7.1.2, the module only delegated to other modules\u0027 \u003ccode\u003ehook_file_download()\u003c/code\u003e implementations when the file was in the \u003ccode\u003eprivate\u003c/code\u003e scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended \u003ccode\u003edownload=1\u003c/code\u003e to the URL of a file in the \u003ccode\u003etemporary://\u003c/code\u003e scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.\u003c/p\u003e"
}
],
"value": "The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file.\n\n\n\nIn versions 7.1.0 through 7.1.2, the module only delegated to other modules\u0027 hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T00:01:51.979Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"name": "HeroDevs vulnerability directory: CVE-2026-110176",
"tags": [
"third-party-advisory"
],
"url": "https://www.herodevs.com/vulnerability-directory/cve-2026-110176"
},
{
"name": "Tag1 D7ES advisory: File Force Download - Critical - Access Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://d7es.tag1.com/security-advisories/file-force-download-critical-access-bypass"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable the File Force Download module, avoid keeping sensitive files in the temporary:// scheme or in stream wrappers provided by contributed modules, or block anonymous requests that carry a download parameter at the web server or WAF.\u003c/p\u003e"
}
],
"value": "Disable the File Force Download module, avoid keeping sensitive files in the temporary:// scheme or in stream wrappers provided by contributed modules, or block anonymous requests that carry a download parameter at the web server or WAF."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-110176",
"datePublished": "2026-10-31T00:01:51.979Z",
"dateReserved": "2026-10-13T17:02:57.071Z",
"dateUpdated": "2026-11-06T15:55:18.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110112 (GCVE-0-2026-110112)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:05 – Updated: 2026-10-17 00:40
VLAI
EPSS
VEX
Title
Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation
Summary
Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-17 00:40 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Finsys/dockhand/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/dockhand-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110112",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-17T00:40:11.889327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T00:40:21.467Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Finsys/dockhand",
"product": "dockhand",
"repo": "https://github.com/Finsys/dockhand",
"vendor": "Finsys",
"versions": [
{
"lessThan": "1.0.50",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.0.50",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Leseratte10"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:05:27.234Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h4vc-h76x-c279)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/Finsys/dockhand/security/advisories/GHSA-h4vc-h76x-c279"
},
{
"name": "VulnCheck Advisory: Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dockhand-before-1.0.50-oidc-privilege-escalation-via-missing-token-claim-validation"
}
],
"title": "Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110112",
"datePublished": "2026-10-13T19:05:27.234Z",
"dateReserved": "2026-10-13T16:22:43.401Z",
"dateUpdated": "2026-10-17T00:40:21.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.