Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
2945 vulnerabilities reference this CWE, most recent first.
CVE-2026-96366 (GCVE-0-2026-96366)
Vulnerability from cvelistv5 – Published: 2026-10-22 01:21 – Updated: 2026-10-22 14:59
VLAI
EPSS
VEX
Title
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
Summary
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 14:59 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
drupal
CNA
References
1 reference
Impacted products
Date Public
2026-09-23 16:25
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-96366",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T14:59:43.990295Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T14:59:46.866Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/webform",
"product": "Webform",
"repo": "https://git.drupalcode.org/project/webform",
"vendor": "Drupal",
"versions": [
{
"lessThan": "6.2.12",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "6.3.1",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sandro Kneub\u00c3\u00bchl (blackpharao)"
},
{
"lang": "en",
"type": "finder",
"value": "omidsec"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jacob Rockowitz (jrockowitz)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Bram Driesen (bramdriesen)"
},
{
"lang": "en",
"type": "coordinator",
"value": "cilefen (cilefen)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Damien McKenna (damienmckenna)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Heine Deelstra (heine)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Drew Webber (mcdruid)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Mohit Aghera (mohit_aghera)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jess (xjm)"
}
],
"datePublic": "2026-09-23T16:25:53.000Z",
"descriptions": [
{
"lang": "en",
"value": "Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T01:21:38.055Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-169"
}
],
"title": "Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-96366",
"datePublished": "2026-10-22T01:21:38.055Z",
"dateReserved": "2026-09-23T01:32:48.995Z",
"dateUpdated": "2026-10-22T14:59:46.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96356 (GCVE-0-2026-96356)
Vulnerability from cvelistv5 – Published: 2026-10-22 01:21 – Updated: 2026-10-22 14:44
VLAI
EPSS
VEX
Title
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
Summary
Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 14:44 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
drupal
CNA
References
1 reference
Impacted products
Date Public
2026-09-23 16:27
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-96356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T14:44:05.593311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T14:44:08.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/webform",
"product": "Webform",
"repo": "https://git.drupalcode.org/project/webform",
"vendor": "Drupal",
"versions": [
{
"lessThan": "6.2.12",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
},
{
"lessThan": "6.3.1",
"status": "affected",
"version": "6.3.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Bramley (acbramley)"
},
{
"lang": "en",
"type": "finder",
"value": "enyug"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jacob Rockowitz (jrockowitz)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Liam Morland (liam morland)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Bram Driesen (bramdriesen)"
},
{
"lang": "en",
"type": "coordinator",
"value": "cilefen (cilefen)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Lee Rowlands (larowlan)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jess (xjm)"
}
],
"datePublic": "2026-09-23T16:27:21.000Z",
"descriptions": [
{
"lang": "en",
"value": "Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T01:21:33.909Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-174"
}
],
"title": "Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-96356",
"datePublished": "2026-10-22T01:21:33.909Z",
"dateReserved": "2026-09-23T01:32:48.994Z",
"dateUpdated": "2026-10-22T14:44:08.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95860 (GCVE-0-2026-95860)
Vulnerability from cvelistv5 – Published: 2026-11-03 20:11 – Updated: 2026-11-07 03:30
VLAI
EPSS
VEX
Title
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
Summary
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-07 03:29 UTC
CWE
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/node-opcua/node-opcua/security… | x_refsource_CONFIRM |
| https://github.com/node-opcua/node-opcua/pull/1580 | x_refsource_MISC |
| https://github.com/node-opcua/node-opcua/commit/0… | x_refsource_MISC |
| https://github.com/node-opcua/node-opcua/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| node-opcua | node-opcua |
Affected:
>= 2.42.0, < 2.180.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95860",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-07T03:29:59.942958Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T03:30:26.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-opcua",
"vendor": "node-opcua",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.42.0, \u003c 2.180.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188: Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:11:38.816Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f"
},
{
"name": "https://github.com/node-opcua/node-opcua/pull/1580",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-opcua/node-opcua/pull/1580"
},
{
"name": "https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698"
},
{
"name": "https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0"
}
],
"source": {
"advisory": "GHSA-xggf-m53x-jc3f",
"discovery": "UNKNOWN"
},
"title": "node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-95860",
"datePublished": "2026-11-03T20:11:38.816Z",
"dateReserved": "2026-09-22T16:39:45.795Z",
"dateUpdated": "2026-11-07T03:30:26.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95814 (GCVE-0-2026-95814)
Vulnerability from cvelistv5 – Published: 2026-09-22 20:21 – Updated: 2026-09-23 12:51
VLAI
EPSS
VEX
Title
Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
Summary
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 12:49 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/dani-garcia/vaultwarden/pull/7554 | patchissue-tracking |
| https://github.com/dani-garcia/vaultwarden/blob/1… | technical-description |
| https://github.com/dani-garcia/vaultwarden/blob/1… | technical-description |
| https://github.com/dani-garcia/vaultwarden | product |
| https://www.vulncheck.com/advisories/vaultwarden-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dani-garcia | vaultwarden |
Affected:
0 , ≤ 1.37.3
(semver)
cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:* |
Date Public
2026-08-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95814",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T12:49:15.557025Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T12:51:17.228Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/dani-garcia/vaultwarden",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dani-garcia/vaultwarden",
"product": "vaultwarden",
"repo": "https://github.com/dani-garcia/vaultwarden",
"vendor": "dani-garcia",
"versions": [
{
"lessThanOrEqual": "1.37.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.37.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-08-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, and is_in_full_access_group to access protected cipher data server-side."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T20:21:13.488Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #7554 (open, unmerged)",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/dani-garcia/vaultwarden/pull/7554"
},
{
"name": "Cipher::get_access_restrictions at 1.37.3",
"tags": [
"technical-description"
],
"url": "https://github.com/dani-garcia/vaultwarden/blob/1.37.3/src/db/models/cipher.rs"
},
{
"name": "Group::is_in_full_access_group at 1.37.3",
"tags": [
"technical-description"
],
"url": "https://github.com/dani-garcia/vaultwarden/blob/1.37.3/src/db/models/group.rs"
},
{
"tags": [
"product"
],
"url": "https://github.com/dani-garcia/vaultwarden"
},
{
"name": "VulnCheck Advisory: Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vaultwarden-through-1.37.3-authorization-bypass-via-missing-status-check"
}
],
"title": "Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-95814",
"datePublished": "2026-09-22T20:21:13.488Z",
"dateReserved": "2026-09-22T15:47:13.821Z",
"dateUpdated": "2026-09-23T12:51:17.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95811 (GCVE-0-2026-95811)
Vulnerability from cvelistv5 – Published: 2026-09-25 01:31 – Updated: 2026-09-26 15:07
VLAI
EPSS
VEX
Title
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it
Summary
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.
The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.
Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 13:53 UTC
CWE
Assigner
CPANSec
CNA
References
7 references
| URL | Tags |
|---|---|
| https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/… | issue-tracking |
| https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/… | release-notes |
| https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/… | release-notes |
| https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/… | release-notes |
| https://www.cve.org/CVERecord?id=CVE-2020-24660 | related |
| https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/… | exploit |
| https://lists.debian.org/debian-lts-announce/2026… |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-95811",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T13:53:01.823535Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:53:07.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/work_items/3723"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-26T15:07:03.342Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2026/09/msg00032.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Lemonldap::NG::Handler"
],
"packageName": "Lemonldap-NG-Handler",
"packageURL": "pkg:cpan/Lemonldap-NG-Handler",
"programFiles": [
"lib/Lemonldap/NG/Handler/Main/Run.pm"
],
"programRoutines": [
{
"name": "Lemonldap::NG::Handler::Main::Run::run"
},
{
"name": "Lemonldap::NG::Handler::Main::Run::grant"
},
{
"name": "Lemonldap::NG::Handler::Main::Run::getLevel"
},
{
"name": "Lemonldap::NG::Handler::Main::Run::isUnprotected"
}
],
"repo": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng",
"versions": [
{
"lessThan": "2.16.10",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
},
{
"lessThan": "2.21.6",
"status": "affected",
"version": "2.17.0",
"versionType": "custom"
},
{
"lessThan": "2.23.4",
"status": "affected",
"version": "2.22.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Deepseek agent, Linagora"
}
],
"descriptions": [
{
"lang": "en",
"value": "Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it.\n\nThe handler matches each vhost\u0027s locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost\u0027s default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike.\n\nOnly a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-180",
"description": "CWE-180 Incorrect Behavior Order: Validate Before Canonicalize",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T01:31:22.472Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3723"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.23.4"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.21.6"
},
{
"tags": [
"release-notes"
],
"url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.16.10"
},
{
"tags": [
"related"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2020-24660"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Lemonldap-NG-Handler 2.16.10, 2.21.6 or 2.23.4 or later. Only 2.23.4 is on CPAN; the 2.16.10 and 2.21.6 LTS releases are available from https://lemonldap-ng.org/download.html."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-95811",
"datePublished": "2026-09-25T01:31:22.472Z",
"dateReserved": "2026-09-22T15:43:06.362Z",
"dateUpdated": "2026-09-26T15:07:03.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95695 (GCVE-0-2026-95695)
Vulnerability from cvelistv5 – Published: 2026-10-13 20:17 – Updated: 2026-10-14 16:58
VLAI
EPSS
VEX
Title
IBM WebSphere Application Server Liberty Incorrect Authorization
Summary
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:57 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7292228 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | WebSphere Application Server - Liberty |
Affected:
20.0.0.12 , ≤ 26.0.0.10
(semver)
cpe:2.3:a:ibm:websphere_application_server_liberty:20.0.0.12:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95695",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:57:35.636013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:58:46.503Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:websphere_application_server_liberty:20.0.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:*"
],
"product": "WebSphere Application Server - Liberty",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "26.0.0.10",
"status": "affected",
"version": "20.0.0.12",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization.\u003c/p\u003e"
}
],
"value": "IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:17:53.799Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7292228"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT502929. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to\u00a0\u003ca href=\"https://www.ibm.com/support/pages/node/6553910\" rel=\"nofollow\"\u003eHow to determine if Liberty is using a specific feature\u003c/a\u003e.\u00a0\u003cbr/\u003e\u003cbr/\u003e\u003cstrong\u003eFor IBM WebSphere Application Server Liberty 20.0.0.12 - 26.0.0.10 using the grpc-1.0 feature:\u00a0\u003c/strong\u003e\u003cbr/\u003e\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves \u003ca href=\"https://www.ibm.com/support/pages/node/7277460\" rel=\"nofollow\"\u003eDT502929\u003c/a\u003e\u003cbr/\u003e--OR--\u003cbr/\u003e\u00b7 Apply Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026).\u00a0\u003cbr/\u003e\u003cbr/\u003eAdditional interim fixes may be available and linked off the interim fix download page.\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR DT502929. To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to\u00a0 How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 .\u00a0\n\nFor IBM WebSphere Application Server Liberty 20.0.0.12 - 26.0.0.10 using the grpc-1.0 feature:\u00a0\n\u00b7 Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves DT502929 https://www.ibm.com/support/pages/node/7277460 \n--OR--\n\u00b7 Apply Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026).\u00a0\n\nAdditional interim fixes may be available and linked off the interim fix download page."
}
],
"title": "IBM WebSphere Application Server Liberty Incorrect Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-95695",
"datePublished": "2026-10-13T20:17:53.799Z",
"dateReserved": "2026-09-22T14:27:46.218Z",
"dateUpdated": "2026-10-14T16:58:46.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95654 (GCVE-0-2026-95654)
Vulnerability from cvelistv5 – Published: 2026-09-22 15:24 – Updated: 2026-09-22 15:48
VLAI
EPSS
VEX
Title
Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token
Summary
Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:48 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/David-Crty/databasement/commit… | patch |
| https://github.com/David-Crty/databasement/blob/v… | technical-description |
| https://github.com/David-Crty/databasement/blob/v… | technical-description |
| https://github.com/David-Crty/databasement/releas… | release-notes |
| https://github.com/David-Crty/databasement | product |
| https://www.vulncheck.com/advisories/databasement… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| David-Crty | Databasement |
Affected:
0 , < 1.7.14
(semver)
Unaffected: 1.7.14 (semver) |
Date Public
2026-09-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95654",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:48:26.638426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:48:52.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Databasement",
"vendor": "David-Crty",
"versions": [
{
"lessThan": "1.7.14",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.14",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abror Bakhromov"
}
],
"datePublic": "2026-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:24:12.859Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/David-Crty/databasement/commit/128efeaf6bc9ad4a63940f4c3030a56ab2969778"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/David-Crty/databasement/blob/v1.7.13/app/Livewire/Auth/AcceptInvitation.php#L30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/David-Crty/databasement/blob/v1.7.13/app/Livewire/Auth/AcceptInvitation.php#L45"
},
{
"name": "Databasement v1.7.14 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/David-Crty/databasement/releases/tag/v1.7.14"
},
{
"tags": [
"product"
],
"url": "https://github.com/David-Crty/databasement"
},
{
"name": "VulnCheck Advisory: Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/databasement-before-1.7.14-authorization-bypass-via-stale-invitation-token"
}
],
"title": "Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-95654",
"datePublished": "2026-09-22T15:24:12.859Z",
"dateReserved": "2026-09-22T12:28:58.960Z",
"dateUpdated": "2026-09-22T15:48:52.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95639 (GCVE-0-2026-95639)
Vulnerability from cvelistv5 – Published: 2026-10-13 20:27 – Updated: 2026-10-14 10:40
VLAI
EPSS
VEX
Title
Photoshop Desktop | Incorrect Authorization (CWE-863)
Summary
Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 03:59 UTC
CWE
- CWE-863 - Incorrect Authorization (CWE-863)
Assigner
adobe
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.adobe.com/trust/security/products/pho… | vendor-advisory |
Impacted products
Date Public
2026-10-13 17:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95639",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T03:59:19.044962Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T10:40:51.574Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Photoshop",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "27.10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "27.11",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Photoshop",
"vendor": "Adobe",
"versions": [
{
"lessThanOrEqual": "26.11.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "26.11.8",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-10-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"environmentalScore": 8.6,
"environmentalSeverity": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "LOW",
"modifiedAttackVector": "LOCAL",
"modifiedAvailabilityImpact": "HIGH",
"modifiedConfidentialityImpact": "HIGH",
"modifiedIntegrityImpact": "HIGH",
"modifiedPrivilegesRequired": "NONE",
"modifiedScope": "CHANGED",
"modifiedUserInteraction": "REQUIRED",
"privilegesRequired": "NONE",
"remediationLevel": "NOT_DEFINED",
"reportConfidence": "NOT_DEFINED",
"scope": "CHANGED",
"temporalScore": 8.6,
"temporalSeverity": "HIGH",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization (CWE-863)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T20:27:46.216Z",
"orgId": "078d4453-3bcd-4900-85e6-15281da43538",
"shortName": "adobe"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Photoshop Desktop | Incorrect Authorization (CWE-863)",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
"assignerShortName": "adobe",
"cveId": "CVE-2026-95639",
"datePublished": "2026-10-13T20:27:46.216Z",
"dateReserved": "2026-09-22T11:06:57.165Z",
"dateUpdated": "2026-10-14T10:40:51.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94609 (GCVE-0-2026-94609)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:20 – Updated: 2026-09-28 15:41
VLAI
EPSS
VEX
Title
authentik: Privilege Escalation to Superuser via Group Hierarchy
Summary
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 15:41 UTC
Assigner
GitHub_M
CNA
References
15 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| goauthentik | authentik |
Affected:
< 2026.2.7
Affected: >= 2026.5.0, < 2026.5.7 Affected: >= 2026.8.0, < 2026.8.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94609",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T15:41:43.925095Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:41:52.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "authentik",
"vendor": "goauthentik",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.2.7"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0, \u003c 2026.5.7"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0, \u003c 2026.8.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:20:45.703Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc"
},
{
"name": "https://github.com/goauthentik/authentik/pull/25956",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/pull/25956"
},
{
"name": "https://github.com/goauthentik/authentik/pull/25961",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/pull/25961"
},
{
"name": "https://github.com/goauthentik/authentik/pull/25966",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/pull/25966"
},
{
"name": "https://github.com/goauthentik/authentik/pull/25971",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/pull/25971"
},
{
"name": "https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030"
},
{
"name": "https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87"
},
{
"name": "https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60"
},
{
"name": "https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67"
},
{
"name": "https://docs.goauthentik.io/releases/2026.2#fixed-in-202627",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.goauthentik.io/releases/2026.2#fixed-in-202627"
},
{
"name": "https://docs.goauthentik.io/releases/2026.5#fixed-in-202657",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.goauthentik.io/releases/2026.5#fixed-in-202657"
},
{
"name": "https://docs.goauthentik.io/releases/2026.8#fixed-in-202682",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.goauthentik.io/releases/2026.8#fixed-in-202682"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7"
},
{
"name": "https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2"
}
],
"source": {
"advisory": "GHSA-h6c5-mpvq-j4jc",
"discovery": "UNKNOWN"
},
"title": "authentik: Privilege Escalation to Superuser via Group Hierarchy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-94609",
"datePublished": "2026-09-24T16:20:45.703Z",
"dateReserved": "2026-09-21T21:32:23.741Z",
"dateUpdated": "2026-09-28T15:41:52.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94205 (GCVE-0-2026-94205)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:25 – Updated: 2026-10-07 20:11
VLAI
EPSS
VEX
Title
Gitea fork workflow approval bypass through maintainer-triggered events
Summary
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 20:11 UTC
CWE
Assigner
Gitea
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39399 | patch |
| https://blog.gitea.com/release-of-28.0.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.0.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-94205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:11:31.504995Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T20:11:55.392Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.27.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/Michael-JRead"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
}
],
"descriptions": [
{
"lang": "en",
"value": "Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository\u0027s runners without an explicit approval."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:25:04.327Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-xh39-mxw9-34pp",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp"
},
{
"name": "Fix: go-gitea/gitea pull request #39399",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39399"
},
{
"name": "Gitea 28.0.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.0.0/"
},
{
"name": "go-gitea/gitea v28.0.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0"
}
],
"title": "Gitea fork workflow approval bypass through maintainer-triggered events"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-94205",
"datePublished": "2026-10-06T19:25:04.327Z",
"dateReserved": "2026-10-04T21:57:35.579Z",
"dateUpdated": "2026-10-07T20:11:55.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.