Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
2944 vulnerabilities reference this CWE, most recent first.
CVE-2026-122116 (GCVE-0-2026-122116)
Vulnerability from cvelistv5 – Published: 2026-11-04 17:47 – Updated: 2026-11-04 20:00
VLAI
EPSS
VEX
Summary
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:57 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
mitre
CNA
References
1 reference
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Yealink | T3XW Series Phones |
Affected:
124.85.0.1 , < 124.87.0.22
(custom)
|
|
| Yealink | T4X Series Phones |
Affected:
108.85.0.1 , < 108.87.0.23
(custom)
|
|
| Yealink | T5X Series Phones |
Affected:
96.85.0.1 , < 96.87.0.24
(custom)
|
|
| Yealink | T7X Series Phones |
Affected:
185.87.0.5 , < 185.87.0.39
(custom)
|
|
| Yealink | SIP-T85W、SIP-T87W |
Affected:
185.87.0.5 , < 185.87.0.39
(custom)
|
|
| Yealink | AX83H、AX86R |
Affected:
180.86.0.1 , < 180.87.0.15
(custom)
|
|
| Yealink | CP925 |
Affected:
148.85.0.1 , < 148.87.0.41
(custom)
|
|
| Yealink | CP935W |
Affected:
149.85.0.1 , < 149.87.0.41
(custom)
|
|
| Yealink | MP E2 Teams Series |
Affected:
176.15.0.1 , < 176.15.0.191
(custom)
|
|
| Yealink | VP59 Teams |
Affected:
91.15.0.1 , < 91.15.1.37
(custom)
|
|
| Yealink | SIP-T58W |
Affected:
150.86.0.5 , < 150.87.0.22
(custom)
|
|
| Yealink | VP59 |
Affected:
91.86.0.5 , < 91.87.0.27
(custom)
|
|
| Yealink | CP965 |
Affected:
143.86.0.5 , < 143.87.0.27
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-122116",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:57:46.241561Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:00:57.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "T3XW Series Phones",
"vendor": "Yealink",
"versions": [
{
"lessThan": "124.87.0.22",
"status": "affected",
"version": "124.85.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "T4X Series Phones",
"vendor": "Yealink",
"versions": [
{
"lessThan": "108.87.0.23",
"status": "affected",
"version": "108.85.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "T5X Series Phones",
"vendor": "Yealink",
"versions": [
{
"lessThan": "96.87.0.24",
"status": "affected",
"version": "96.85.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "T7X Series Phones",
"vendor": "Yealink",
"versions": [
{
"lessThan": "185.87.0.39",
"status": "affected",
"version": "185.87.0.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "SIP-T85W\u3001SIP-T87W",
"vendor": "Yealink",
"versions": [
{
"lessThan": "185.87.0.39",
"status": "affected",
"version": "185.87.0.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "AX83H\u3001AX86R",
"vendor": "Yealink",
"versions": [
{
"lessThan": "180.87.0.15",
"status": "affected",
"version": "180.86.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "CP925",
"vendor": "Yealink",
"versions": [
{
"lessThan": "148.87.0.41",
"status": "affected",
"version": "148.85.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "CP935W",
"vendor": "Yealink",
"versions": [
{
"lessThan": "149.87.0.41",
"status": "affected",
"version": "149.85.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "MP E2 Teams Series",
"vendor": "Yealink",
"versions": [
{
"lessThan": "176.15.0.191",
"status": "affected",
"version": "176.15.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "VP59 Teams",
"vendor": "Yealink",
"versions": [
{
"lessThan": "91.15.1.37",
"status": "affected",
"version": "91.15.0.1",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "SIP-T58W",
"vendor": "Yealink",
"versions": [
{
"lessThan": "150.87.0.22",
"status": "affected",
"version": "150.86.0.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "VP59",
"vendor": "Yealink",
"versions": [
{
"lessThan": "91.87.0.27",
"status": "affected",
"version": "91.86.0.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "CP965",
"vendor": "Yealink",
"versions": [
{
"lessThan": "143.87.0.27",
"status": "affected",
"version": "143.86.0.5",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to unauthorized users. The latest Yealink firmware has addressed this vulnerability by restricting 802.1X configuration modification privileges to administrator accounts only by default."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:47:04.288Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.yealink.com/en/trust-center/security-bulletins/wifi-8021x-peap-authentication-credential-leakage-vulnerability"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eWe recommend that when enabling Wi-Fi 802.1X, you can restrict the access types of web users by updating security.web_limited_access_level via Auto Provision; for example: security.web_limited_access_level=user. Alternatively, refer to the Admin Guide to configure Wi-Fi permissions for the user account: network-wifi = 2, wifi = 2.\u003c/div\u003e\u003cdiv\u003eRegarding this vulnerability, newer firmware versions of the device have, by default, restricted 802.1X-related function permissions to administrator-only.\u003c/div\u003e"
}
],
"value": "We recommend that when enabling Wi-Fi 802.1X, you can restrict the access types of web users by updating security.web_limited_access_level via Auto Provision; for example: security.web_limited_access_level=user. Alternatively, refer to the Admin Guide to configure Wi-Fi permissions for the user account: network-wifi = 2, wifi = 2.\n\nRegarding this vulnerability, newer firmware versions of the device have, by default, restricted 802.1X-related function permissions to administrator-only."
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-122116",
"datePublished": "2026-11-04T17:47:04.288Z",
"dateReserved": "2026-11-04T17:47:03.995Z",
"dateUpdated": "2026-11-04T20:00:57.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121837 (GCVE-0-2026-121837)
Vulnerability from cvelistv5 – Published: 2026-11-06 05:39 – Updated: 2026-11-09 17:40
VLAI
EPSS
VEX
Title
Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
Summary
A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:36 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
redhat
CNA
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-121837 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2566744 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Exploit Intelligence |
cpe:/a:redhat:exploit_intelligence:0
|
|
| Red Hat | Red Hat build of Quarkus |
cpe:/a:redhat:quarkus:3
|
Date Public
2026-11-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121837",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:36:20.290643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:40:27.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:exploit_intelligence:0"
],
"defaultStatus": "affected",
"packageName": "exploit-intelligence/agent-client-rhel9",
"product": "Exploit Intelligence",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3"
],
"defaultStatus": "affected",
"packageName": "quarkus-rest-data-panache",
"product": "Red Hat build of Quarkus",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Emirhan \u00c7atk\u0131n for reporting this issue."
}
],
"datePublic": "2026-11-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the REST Data Panache component of Quarkus. When a security constraint is applied to an entity property using the @SecureField annotation on its getter method rather than the field itself, the generated REST resource fails to enforce this constraint for filtering and sorting operations. This allows an authenticated user to infer sensitive data values by observing which records match specific filter criteria or how they are ordered, even though the values are omitted from the final response."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T05:39:00.196Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-121837"
},
{
"name": "RHBZ#2566744",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566744"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-01T22:36:54.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-11-05T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort",
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-863: Incorrect Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-121837",
"datePublished": "2026-11-06T05:39:00.196Z",
"dateReserved": "2026-11-04T07:00:27.108Z",
"dateUpdated": "2026-11-09T17:40:27.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121562 (GCVE-0-2026-121562)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-09 15:18
VLAI
EPSS
VEX
Title
CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
Summary
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:18 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/CTFd/CTFd/commit/122c224030224… | patch |
| https://github.com/CTFd/CTFd | product |
| https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/… | technical-description |
| https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/sche… | technical-description |
| https://blog.ctfd.io/ctfd-3-8-7/ | technical-description |
| https://github.com/CTFd/CTFd/releases/tag/3.8.7 | technical-descriptionrelease-notes |
| https://www.vulncheck.com/advisories/ctfd-3.1.0-b… | third-party-advisory |
Impacted products
Date Public
2026-08-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:18:38.798663Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:18:59.931Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CTFd",
"vendor": "CTFd",
"versions": [
{
"lessThan": "3.8.7",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ctfd:ctfd:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.8.7",
"versionStartIncluding": "3.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Oceanwarranty (ASK PENTEST SDN. BHD.)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "ColdHeat"
}
],
"datePublic": "2026-08-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:17.803Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/CTFd/CTFd/commit/122c224030224ca6a04d2928280055a84bbd4850"
},
{
"tags": [
"product"
],
"url": "https://github.com/CTFd/CTFd"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/api/v1/teams.py#L128-L131"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/CTFd/CTFd/blob/3.8.6/CTFd/schemas/teams.py#L336-L363"
},
{
"tags": [
"technical-description"
],
"url": "https://blog.ctfd.io/ctfd-3-8-7/"
},
{
"name": "CTFd 3.8.7 Release Notes",
"tags": [
"technical-description",
"release-notes"
],
"url": "https://github.com/CTFd/CTFd/releases/tag/3.8.7"
},
{
"name": "VulnCheck Advisory: CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ctfd-3.1.0-before-3.8.7-information-disclosure-via-api-v1-teams-endpoint"
}
],
"title": "CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121562",
"datePublished": "2026-11-03T15:17:17.803Z",
"dateReserved": "2026-11-03T14:46:18.615Z",
"dateUpdated": "2026-11-09T15:18:59.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121543 (GCVE-0-2026-121543)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-03 18:28
VLAI
EPSS
VEX
Title
smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
Summary
smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:48 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/a466350665/smart-sso/issues/79 | issue-tracking |
| https://github.com/a466350665/smart-sso | product |
| https://github.com/a466350665/smart-sso/commit/9b… | patch |
| https://github.com/a466350665/smart-sso/blob/91d2… | technical-description |
| https://github.com/a466350665/smart-sso/blob/91d2… | technical-description |
| https://github.com/a466350665/smart-sso/commit/a7… | technical-descriptionpatch |
| https://www.vulncheck.com/advisories/smart-sso-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a466350665 | smart-sso |
Affected:
0 , ≤ 2.0.1
(custom)
cpe:2.3:a:a466350665:smart-sso:*:*:*:*:*:*:*:* |
Date Public
2026-10-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121543",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:48:39.162182Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:28:09.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:maven/org.springframework.boot/spring-boot-starter-parent",
"product": "smart-sso",
"vendor": "a466350665",
"versions": [
{
"lessThanOrEqual": "2.0.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:a466350665:smart-sso:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:04.528Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #79",
"tags": [
"issue-tracking"
],
"url": "https://github.com/a466350665/smart-sso/issues/79"
},
{
"tags": [
"product"
],
"url": "https://github.com/a466350665/smart-sso"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/a466350665/smart-sso/commit/9bccabaa5ec5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-starter/smart-sso-starter-client/src/main/java/openjoe/smart/sso/client/filter/PermissionFilter.java#L38-L47"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/a466350665/smart-sso/blob/91d2dfef8973d308fa1b762e4c86dfbcbe9793ff/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/admin/UserRoleController.java"
},
{
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/a466350665/smart-sso/commit/a74a791bea7fc7b06ce95f52ce5805d8d7886d48"
},
{
"name": "VulnCheck Advisory: smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/smart-sso-through-2.0.1-incorrect-authorization-in-permissionfilter-enables-admin-escalation"
}
],
"title": "smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121543",
"datePublished": "2026-11-03T15:17:04.528Z",
"dateReserved": "2026-11-03T14:46:03.836Z",
"dateUpdated": "2026-11-03T18:28:09.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121541 (GCVE-0-2026-121541)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:01 – Updated: 2026-11-06 19:32
VLAI
EPSS
VEX
Title
Bake filesystem path entitlements approval can be skipped in some multi-target builds
Summary
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:32 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
Docker
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/docker/buildx/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Docker | Docker Buildx |
Affected:
0.19.0 , < 0.38.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T19:32:14.150536Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T19:32:25.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Docker Buildx",
"vendor": "Docker",
"versions": [
{
"lessThan": "0.38.1",
"status": "affected",
"version": "0.19.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hCaptcha security team"
}
],
"descriptions": [
{
"lang": "en",
"value": "In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The advisory-described fs.read bypass: a victim runs an untrusted multi-target Bake definition, and favorable target iteration order permits disclosure of client-readable files. This metric assesses file disclosure only; it does not assess filesystem-write impacts described in the broader report."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:01:09.960Z",
"orgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
"shortName": "Docker"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/docker/buildx/security/advisories/GHSA-xg6v-cv2h-2w5h"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade Docker Buildx to v0.38.1 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Bake filesystem path entitlements approval can be skipped in some multi-target builds",
"workarounds": [
{
"lang": "en",
"value": "Run only trusted Bake definitions until upgrading. Check that Bake definitions do not contain suspicious paths outside trusted directories."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "686469e6-3ff6-451b-ab8b-cf5b9e89401e",
"assignerShortName": "Docker",
"cveId": "CVE-2026-121541",
"datePublished": "2026-11-03T22:01:09.960Z",
"dateReserved": "2026-11-03T14:41:36.745Z",
"dateUpdated": "2026-11-06T19:32:25.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121418 (GCVE-0-2026-121418)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-07 02:55
VLAI
EPSS
VEX
Title
SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
Summary
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 02:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/surrealdb/surrealdb/security/a… | vendor-advisory |
| https://www.vulncheck.com/advisories/surrealdb-3.… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121418",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T02:55:16.322637Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T02:55:36.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x6mm-9295-rvph"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/surrealdb",
"product": "surrealdb",
"vendor": "surrealdb",
"versions": [
{
"lessThan": "3.3.0",
"status": "affected",
"version": "3.1.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.3.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.3.0",
"versionStartIncluding": "3.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "santhreal"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:15.918Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x6mm-9295-rvph)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x6mm-9295-rvph"
},
{
"name": "VulnCheck Advisory: SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-incorrect-authorization-via-streaming-index-planner"
}
],
"title": "SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121418",
"datePublished": "2026-11-03T14:28:15.918Z",
"dateReserved": "2026-11-03T12:29:41.359Z",
"dateUpdated": "2026-11-07T02:55:36.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121413 (GCVE-0-2026-121413)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-03 17:11
VLAI
EPSS
VEX
Title
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
Summary
Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:11 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/parse-community/parse-server/s… | vendor-advisory |
| https://github.com/parse-community/parse-server/p… | patchissue-tracking |
| https://github.com/parse-community/parse-server/p… | patchissue-tracking |
| https://www.vulncheck.com/advisories/parse-server… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| parse-community | parse-server |
Affected:
9.0.0 , < 9.10.6-alpha.4
(semver)
Unaffected: 9.10.6-alpha.4 (semver) |
|
| parse-community | parse-server |
Affected:
0 , < 8.6.112
(semver)
Unaffected: 8.6.112 (semver) |
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121413",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:11:08.314489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:11:44.523Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "9.10.6-alpha.4",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.10.6-alpha.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/parse-server",
"product": "parse-server",
"vendor": "parse-community",
"versions": [
{
"lessThan": "8.6.112",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.6.112",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10.6-alpha.4",
"versionStartIncluding": "9.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.6.112",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "mtrezza"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user\u0027s session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:12.320Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2j2x-c587-q33g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-2j2x-c587-q33g"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/parse-community/parse-server/pull/10808"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/parse-community/parse-server/pull/10809"
},
{
"name": "VulnCheck Advisory: Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/parse-server-before-8.6.112-and-9.0.0-before-9.10.6-alpha.4-session-permission-bypass-via-upgradetorevocablesession"
}
],
"title": "Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121413",
"datePublished": "2026-11-03T14:28:12.320Z",
"dateReserved": "2026-11-03T12:28:46.507Z",
"dateUpdated": "2026-11-03T17:11:44.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121024 (GCVE-0-2026-121024)
Vulnerability from cvelistv5 – Published: 2026-11-03 08:48 – Updated: 2026-11-03 20:18
VLAI
EPSS
VEX
Title
Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet
Summary
Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 20:18 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
AxxonSoft
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.axxonsoft.com/legal/axxonsoft-vulnera… | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121024",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T20:18:02.836202Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:18:16.710Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "AxxonNet",
"vendor": "AxxonSoft",
"versions": [
{
"lessThan": "3.28.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Discovered internally by the AxxonSoft product team."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API."
}
],
"value": "Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T08:48:10.853Z",
"orgId": "15ede60e-6fda-426e-be9c-e788f151a377",
"shortName": "AxxonSoft"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories#CVE-2026-121024"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade AxxonNet to version 3.28.0 or later. Revoke and reissue shared report tokens that were distributed before the upgrade, and review the monitoring alert configuration for unauthorized changes."
}
],
"value": "Upgrade AxxonNet to version 3.28.0 or later. Revoke and reissue shared report tokens that were distributed before the upgrade, and review the monitoring alert configuration for unauthorized changes."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "15ede60e-6fda-426e-be9c-e788f151a377",
"assignerShortName": "AxxonSoft",
"cveId": "CVE-2026-121024",
"datePublished": "2026-11-03T08:48:10.853Z",
"dateReserved": "2026-11-03T08:40:19.154Z",
"dateUpdated": "2026-11-03T20:18:16.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120554 (GCVE-0-2026-120554)
Vulnerability from cvelistv5 – Published: 2026-11-04 09:26 – Updated: 2026-11-04 20:12
VLAI
EPSS
VEX
Title
Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
Summary
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker's repointed CSV file.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:11 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
Wordfence
CNA
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| carazo | Import and export users and customers |
Affected:
0 , ≤ 2.5.11
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120554",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:11:54.287535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:12:17.021Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Import and export users and customers",
"vendor": "carazo",
"versions": [
{
"lessThanOrEqual": "2.5.11",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdul Halim"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and no successful save intervenes before the next unattended cron tick processes the attacker\u0027s repointed CSV file."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:26:07.169Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4db0991f-fc89-411b-b0df-1a11c9ddec1f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/cron.php#L101"
},
{
"url": "https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/cron.php#L49"
},
{
"url": "https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/cron.php#L166"
},
{
"url": "https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/import.php#L1104"
},
{
"url": "https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.5.7/classes/import.php#L909"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3775652/import-users-from-csv-with-meta"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3775652/import-users-from-csv-with-meta/trunk/classes/cron.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-30T14:51:39.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-03T21:19:42.000Z",
"value": "Disclosed"
}
],
"title": "Import and export users and customers \u003c= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120554",
"datePublished": "2026-11-04T09:26:07.169Z",
"dateReserved": "2026-11-02T16:27:57.644Z",
"dateUpdated": "2026-11-04T20:12:17.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120489 (GCVE-0-2026-120489)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-02 17:30
VLAI
EPSS
VEX
Title
Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft
Summary
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:04 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/outline/outline/security/advis… | vendor-advisory |
| https://github.com/outline/outline/commit/d249b34… | patch |
| https://github.com/outline/outline/releases/tag/v1.12.0 | release-notes |
| https://github.com/outline/outline/blob/v1.11.0/s… | technical-description |
| https://www.vulncheck.com/advisories/outline-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120489",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:04:52.281986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:30:46.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/outline/outline",
"product": "Outline",
"repo": "https://github.com/outline/outline",
"vendor": "Outline",
"versions": [
{
"lessThan": "1.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getoutline:outline:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "VG"
}
],
"datePublic": "2026-10-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then call documents.update with a private collection UUID to inject phishing content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:19.300Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h6ff-rw9x-5mq2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/outline/outline/security/advisories/GHSA-h6ff-rw9x-5mq2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/outline/outline/commit/d249b34e8e5fd465d542cad87190d411fdcbd5dc"
},
{
"name": "Outline v1.12.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/outline/outline/releases/tag/v1.12.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/outline/outline/blob/v1.11.0/server/commands/documentCreator.ts#L135-L143"
},
{
"name": "VulnCheck Advisory: Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/outline-before-1.12.0-incorrect-authorization-via-authorizedocumentpublish-detached-draft"
}
],
"title": "Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120489",
"datePublished": "2026-11-02T14:29:19.300Z",
"dateReserved": "2026-11-02T14:04:51.674Z",
"dateUpdated": "2026-11-02T17:30:46.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.