Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
2944 vulnerabilities reference this CWE, most recent first.
CVE-2026-123803 (GCVE-0-2026-123803)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:48 – Updated: 2026-11-09 23:01
VLAI
EPSS
VEX
Title
SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries
Summary
SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant's sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 23:00 UTC
Assigner
GitHub_M
CNA
References
18 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 10.1.0, < 11.0.0
Affected: >= 11.0.0, < 11.0.9 Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T23:00:35.473876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T23:01:11.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 10.1.0, \u003c 11.0.0"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform application-scoped WebAuthn lookups without constraining them to the requested tenant, and WebAuthN.signIn does not verify tenant membership. In a multi-tenant deployment using WebAuthn with a shared user pool, an ordinary user who possesses their own valid passkey in one tenant can submit its assertion to another tenant\u0027s sign-in endpoint in the same application and be authenticated there despite having no membership in the target tenant. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:48:51.355Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-6v34-w48w-44rc"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/01ca34a06baa0d22db008f38c8eabd1f6695d9a6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/030643edea5d69e0009ceeecbc5dd70be5c66186"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1e3e4d9b25237a9c8fd77cbe0d4d0ecb360d8cd6"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/84492e38f9eb6db0cc338674ce5e94d1603bef08"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/982d420a5ac29d5e362eaf39169a7a9f5339abeb"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/a3d033022effb00ccf0c4ec6ca77c36eb1a24617"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/ad768c1925e245930e5fbf9441452d85564de91d"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b933b6c9b4495e47a8b3efeb5a70e9d014777320"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/e19d173f47658d036685d3020e18819c5f3690b7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-6v34-w48w-44rc",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: WebAuthn sign-in accepts a passkey across tenant boundaries"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123803",
"datePublished": "2026-11-09T18:48:51.355Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T23:01:11.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123800 (GCVE-0-2026-123800)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:16 – Updated: 2026-11-09 18:16
VLAI
EPSS
VEX
Title
SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications
Summary
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application's valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application's own key. In the advisory's v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
9.9 (Critical)
Assigner
GitHub_M
CNA
References
37 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 6.0.0, < 6.0.24
Affected: >= 7.0.0, < 7.0.23 Affected: >= 8.0.0, < 8.0.7 Affected: >= 9.0.0, < 9.0.6 Affected: >= 9.1.0, < 9.1.6 Affected: >= 9.2.0, < 9.2.7 Affected: >= 9.3.0, < 9.3.5 Affected: >= 10.0.0, < 10.0.8 Affected: >= 10.1.0, < 10.1.9 Affected: >= 11.0.0, < 11.0.9 Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.0.0, \u003c 6.0.24"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.0.23"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.7"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.0.6"
},
{
"status": "affected",
"version": "\u003e= 9.1.0, \u003c 9.1.6"
},
{
"status": "affected",
"version": "\u003e= 9.2.0, \u003c 9.2.7"
},
{
"status": "affected",
"version": "\u003e= 9.3.0, \u003c 9.3.5"
},
{
"status": "affected",
"version": "\u003e= 10.0.0, \u003c 10.0.8"
},
{
"status": "affected",
"version": "\u003e= 10.1.0, \u003c 10.1.9"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrUpdate in src/main/java/io/supertokens/multitenancy/Multitenancy.java does not adequately authorize updates to a parent connection URI domain or the base tenant. In a licensed multi-tenant deployment with multiple applications under one non-default connection URI domain and separate api_keys, an attacker holding one application\u0027s valid API key can update the parent domain because the CUD-target branch checks the domain without requiring the source application and tenant to be public. Because api_keys is not protected, the attacker can replace the parent key and then sibling application keys, read or modify sibling users, obtain sessions as those users, establish persistence through a sibling dashboard user, and lock out the sibling application\u0027s own key. In the advisory\u0027s v2 create or update handlers, omitting the optional identifier produces a base-tenant target that skips the permission branches and enterprise-feature gate, allowing changes to firstFactors, required secondary factors, and recipe-enabled flags that affect login integrity and availability. The base-target variant still rejects coreConfig and does not establish key theft. This issue is fixed in versions 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:16:08.303Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xqvf-8rcx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-4rf2-xqvf-8rcx"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd2bded0948476a42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/13c3de170dd40dd217db0f6bd2bded0948476a42"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b9e85795fdc6a7e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1cc02b971f064c2fa2d9bc74b9e85795fdc6a7e5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f86cc2729a6008cb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/1d9dcb03ce0691d9b8abee48f86cc2729a6008cb"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d57854701820a0580b6050",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/337bb3eba812a5ee52d57854701820a0580b6050"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d10b6185f0e85201",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/4902b713f31306ca41148070d10b6185f0e85201"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a25a17d224effe115",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/4d1ef0e177681f4f74995e4a25a17d224effe115"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee884fa15e288aad51",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/61bfd3ebde1cf4b092da85ee884fa15e288aad51"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5c2fad45548a6475",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/64dfa92c50a2ec288fe787ee5c2fad45548a6475"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e116821434d4eb3c907faccf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8db9b0c39f97f240e116821434d4eb3c907faccf"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c915be1d7ce279416b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/8e48ef856becbaaeb50ad4c915be1d7ce279416b"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520075bbefbae3cf9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/9b0d3a9fdbdcb48dd7dd9d520075bbefbae3cf9b"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/a186f1013c784de8a796a732e925e1870fec0f40",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/a186f1013c784de8a796a732e925e1870fec0f40"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b58bc3d03549d20495df71c03ef5478799c184db",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b58bc3d03549d20495df71c03ef5478799c184db"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/bf6184f027a99bd1b3b1df3d20e376dda6521399",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/bf6184f027a99bd1b3b1df3d20e376dda6521399"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c6d7dc7d73b9bb3075b3f7a1a0c0c5780430c292",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c6d7dc7d73b9bb3075b3f7a1a0c0c5780430c292"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/df79f3b4399ef31aea4cb44cc7b65761a2cb94a7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/df79f3b4399ef31aea4cb44cc7b65761a2cb94a7"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/e616f4002c31d256f9ff6cb3d3685b924ef53a6d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/e616f4002c31d256f9ff6cb3d3685b924ef53a6d"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/ff9ca3ec53861a91996c4e9581fa6f2e01331736",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/ff9ca3ec53861a91996c4e9581fa6f2e01331736"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v10.0.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v10.0.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v10.1.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v10.1.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v6.0.24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v6.0.24"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v7.0.23",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v7.0.23"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v8.0.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v8.0.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.0.6"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.1.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.1.6"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.2.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.2.7"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v9.3.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v9.3.5"
}
],
"source": {
"advisory": "GHSA-4rf2-xqvf-8rcx",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain\u0027s credentials and take over sibling applications"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123800",
"datePublished": "2026-11-09T18:16:08.303Z",
"dateReserved": "2026-11-06T15:27:56.225Z",
"dateUpdated": "2026-11-09T18:16:08.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123527 (GCVE-0-2026-123527)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass
Summary
Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.
Severity
5.4 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-2.4.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
2.4.0 , < 2.7.1
(semver)
Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dylanzonix"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:36.283Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j5v7-qcwp-5g32)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-j5v7-qcwp-5g32"
},
{
"name": "VulnCheck Advisory: Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-2.4.0-before-2.7.1-api-token-scope-collision-authorization-bypass"
}
],
"title": "Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123527",
"datePublished": "2026-11-08T01:37:36.283Z",
"dateReserved": "2026-11-06T00:48:01.381Z",
"dateUpdated": "2026-11-08T01:37:36.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123524 (GCVE-0-2026-123524)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-08 01:37
VLAI
EPSS
VEX
Title
Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload
Summary
Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.
Severity
5.7 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-0.23… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
0.23.0 , < 2.7.1
(semver)
Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "0.23.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"versionStartIncluding": "0.23.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lissy93"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user\u0027s permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:34.226Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-66cq-j6rw-pjch)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-66cq-j6rw-pjch"
},
{
"name": "VulnCheck Advisory: Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-0.23.0-before-2.7.1-information-disclosure-via-webhook-related-tasks-payload"
}
],
"title": "Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123524",
"datePublished": "2026-11-08T01:37:34.226Z",
"dateReserved": "2026-11-06T00:47:14.650Z",
"dateUpdated": "2026-11-08T01:37:34.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123506 (GCVE-0-2026-123506)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-09 14:02
VLAI
EPSS
VEX
Title
Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints
Summary
Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:01 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-2.2.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
2.2.0 , < 2.7.1
(semver)
Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123506",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:01:57.626847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:02:13.680Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "2.2.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"versionStartIncluding": "2.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner\u0027s user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:21.107Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-5f6v-j6xm-wwj9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5f6v-j6xm-wwj9"
},
{
"name": "VulnCheck Advisory: Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-2.2.0-before-2.7.1-token-scope-bypass-via-project-webhook-endpoints"
}
],
"title": "Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123506",
"datePublished": "2026-11-08T01:37:21.107Z",
"dateReserved": "2026-11-06T00:46:28.480Z",
"dateUpdated": "2026-11-09T14:02:13.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123218 (GCVE-0-2026-123218)
Vulnerability from cvelistv5 – Published: 2026-11-07 03:47 – Updated: 2026-11-09 20:58
VLAI
EPSS
VEX
Title
IBM Aspera Faspex Authorization Bypass
Summary
IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.
Severity
9.8 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:40 UTC
CWE
Assigner
ibm
CNA
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295921 | vendor-advisorypatch |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Aspera Faspex |
Affected:
5.0.0 , ≤ 5.0.19
(semver)
cpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123218",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:40:42.498022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-11-09",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123218"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:58:24.700Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-123218"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "CVE-2026-123218 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aspera Faspex",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "5.0.19",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ibm:aspera_faspex:*:*:*:*:*:*:*:*",
"versionEndIncluding": "5.0.19",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.\u003cbr\u003e"
}
],
"value": "IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:47:19.566Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295921"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading:\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003ePlatform\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Aspera Faspex\u003c/td\u003e\u003ctd\u003e5.0.19 PL1\u003c/td\u003e\u003ctd\u003eLinux\u003c/td\u003e\u003ctd\u003e\u003cp\u003ePlease follow the instructions\u0026nbsp;\u003ca href=\"https://www.ibm.com/docs/en/aspera-faspex/5.0.x?topic=upgrades-patching-container-images\" rel=\"nofollow\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eValidate that the faspex-core container image is\u0026nbsp;5.0.19 (1ce4b13, Fix Pack: 1)\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading:\n\nProductVersionPlatformFix InstructionsIBM Aspera Faspex5.0.19 PL1Linux\n\nPlease follow the instructions\u00a0 here https://www.ibm.com/docs/en/aspera-faspex/5.0.x .\n\n\n\nValidate that the faspex-core container image is\u00a05.0.19 (1ce4b13, Fix Pack: 1)"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM Aspera Faspex Authorization Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-123218",
"datePublished": "2026-11-07T03:47:19.566Z",
"dateReserved": "2026-11-05T18:08:35.127Z",
"dateUpdated": "2026-11-09T20:58:24.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123184 (GCVE-0-2026-123184)
Vulnerability from cvelistv5 – Published: 2026-11-05 17:41 – Updated: 2026-11-05 20:02 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
Summary
An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project's git repository.
Read access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 20:02 UTC
Assigner
Altium
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Altium | Altium 365 |
Affected:
unspecified
|
Date Public
2026-11-05 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-123184",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T20:02:13.994643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T20:02:29.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"modules": [
"Git Service (repository push permission check)"
],
"platforms": [
"Web"
],
"product": "Altium 365",
"vendor": "Altium",
"versions": [
{
"status": "affected",
"version": "unspecified"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEG Automotive Germany GmbH"
}
],
"datePublic": "2026-11-05T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project\u0027s git repository.\u003c/p\u003e\n\u003cp\u003eRead access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected.\u003c/p\u003e"
}
],
"value": "An incorrect authorization vulnerability exists in the Altium 365 Git Service. The permission check performed when a user pushes to a project repository did not correctly evaluate the required access level, so the check passed for any user holding any level of access to the project. As a result, an authenticated user with view-only access to a project could write to that project\u0027s git repository.\n\n\n\n\nRead access was evaluated correctly and was not affected, and exploitation requires an authenticated account with existing access to the target project. The issue has been remediated in Altium 365 at the service level and no customer action is required. On-premise Altium Enterprise Server is not affected."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
},
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T17:41:09.327Z",
"orgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79",
"shortName": "Altium"
},
"references": [
{
"url": "https://www.altium.com/platform/security-compliance/security-advisories"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"exclusively-hosted-service"
],
"title": "Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "4760f414-e1ae-4ff1-bdad-c7a9c3538b79",
"assignerShortName": "Altium",
"cveId": "CVE-2026-123184",
"datePublished": "2026-11-05T17:41:09.327Z",
"dateReserved": "2026-11-05T17:35:51.419Z",
"dateUpdated": "2026-11-05T20:02:29.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123023 (GCVE-0-2026-123023)
Vulnerability from cvelistv5 – Published: 2026-11-05 13:30 – Updated: 2026-11-05 16:28 X_Open Source
VLAI
EPSS
VEX
Title
agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization
Summary
A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 16:27 UTC
Assigner
VulDB
CNA
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431396 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/431396/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123023 | third-party-advisory |
| https://vuldb.com/submit/1033131 | third-party-advisory |
| https://github.com/agentscope-ai/agentscope/issues/3313 | issue-tracking |
| https://github.com/agentscope-ai/agentscope/pull/2629 | issue-trackingpatch |
| https://github.com/ybyu-ieu/agent-security-adviso… | exploit |
| https://github.com/agentscope-ai/agentscope/commi… | patch |
| https://github.com/agentscope-ai/agentscope/relea… | patch |
| https://github.com/agentscope-ai/agentscope/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| agentscope-ai | AgentScope |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Unaffected: 2.0.9 cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123023",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T16:27:48.321233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T16:28:02.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:agentscope-ai:agentscope:*:*:*:*:*:*:*:*"
],
"modules": [
"Bash Tool"
],
"product": "AgentScope",
"vendor": "agentscope-ai",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "unaffected",
"version": "2.0.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ybyu (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in agentscope-ai AgentScope up to 2.0.8. This affects the function check_permissions of the file src/agentscope/tool/_builtin/_bash.py of the component Bash Tool. This manipulation causes incorrect authorization. Remote exploitation of the attack is possible. The exploit has been published and may be used. Upgrading to version 2.0.9 mitigates this issue. Patch name: 6b43b13a46401e86abd3defeed9a8bfe5b37bc6d. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T13:30:20.946Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431396 | agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/431396"
},
{
"name": "VDB-431396 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431396/cti"
},
{
"name": "CVE-2026-123023 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123023"
},
{
"name": "Submit #1033131 | agentscope-ai AgentScope 2.0.4 CWE-863 Incorrect Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033131"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/agentscope-ai/agentscope/issues/3313"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/agentscope-ai/agentscope/pull/2629"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ybyu-ieu/agent-security-advisories/blob/main/agentscope/agentscope-bash-tool-tee-misclassification-arbitrary-file-write.md"
},
{
"tags": [
"patch"
],
"url": "https://github.com/agentscope-ai/agentscope/commit/6b43b13a46401e86abd3defeed9a8bfe5b37bc6d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/agentscope-ai/agentscope/releases/tag/v2.0.9"
},
{
"tags": [
"product"
],
"url": "https://github.com/agentscope-ai/agentscope/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-05T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-05T07:31:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123023",
"datePublished": "2026-11-05T13:30:20.946Z",
"dateReserved": "2026-11-05T06:25:55.634Z",
"dateUpdated": "2026-11-05T16:28:02.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122307 (GCVE-0-2026-122307)
Vulnerability from cvelistv5 – Published: 2026-11-05 02:25 – Updated: 2026-11-09 16:54
VLAI
EPSS
VEX
Title
Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling
Summary
Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:09 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/kyverno/kyverno/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/kyverno-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122307",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:09:47.899476Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T16:54:43.380Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/kyverno/kyverno",
"product": "kyverno",
"vendor": "kyverno",
"versions": [
{
"lessThan": "1.19.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.19.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "1diot9"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create rights on PolicyExceptions can inject negated matchConditions into the generated policies to admit violating resources, bypassing cluster-wide enforcement."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T02:25:10.907Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qc9c-3fgf-cgq8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-qc9c-3fgf-cgq8"
},
{
"name": "VulnCheck Advisory: Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-policy-bypass-via-admissionpolicygenerator-policyexception-handling"
}
],
"title": "Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122307",
"datePublished": "2026-11-05T02:25:10.907Z",
"dateReserved": "2026-11-04T23:23:51.290Z",
"dateUpdated": "2026-11-09T16:54:43.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122304 (GCVE-0-2026-122304)
Vulnerability from cvelistv5 – Published: 2026-11-05 02:25 – Updated: 2026-11-09 16:55
VLAI
EPSS
VEX
Title
Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader
Summary
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller's ServiceAccount.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 16:11 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/kyverno/kyverno/security/advis… | vendor-advisory |
| https://github.com/kyverno/kyverno/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/kyverno-1.17… | third-party-advisory |
Impacted products
Date Public
2026-10-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122304",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T16:11:57.602734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T16:55:12.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/kyverno/kyverno",
"product": "kyverno",
"vendor": "kyverno",
"versions": [
{
"lessThan": "1.19.2",
"status": "affected",
"version": "1.17.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.19.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.19.2",
"versionStartIncluding": "1.17.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "euriconicacio"
},
{
"lang": "en",
"type": "finder",
"value": "thevilledev"
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference context entries to read cross-namespace Secrets and modify validatingwebhookconfigurations using the cleanup controller\u0027s ServiceAccount."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T02:25:08.931Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p58h-r4j3-h5vx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-p58h-r4j3-h5vx"
},
{
"name": "GitHub Security Advisory (GHSA-rcxg-3f92-3mgr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-rcxg-3f92-3mgr"
},
{
"name": "VulnCheck Advisory: Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kyverno-1.17.0-before-1.19.2-privilege-escalation-via-cleanuppolicy-context-loader"
}
],
"title": "Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-122304",
"datePublished": "2026-11-05T02:25:08.931Z",
"dateReserved": "2026-11-04T23:23:51.289Z",
"dateUpdated": "2026-11-09T16:55:12.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.