Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
2946 vulnerabilities reference this CWE, most recent first.
CVE-2026-86043 (GCVE-0-2026-86043)
Vulnerability from cvelistv5 – Published: 2026-09-16 18:51 – Updated: 2026-09-16 19:38
VLAI
EPSS
VEX
Title
Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
Summary
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:38 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zalando/skipper/security/advis… | x_refsource_CONFIRM |
| https://github.com/zalando/skipper/commit/2cfceab… | x_refsource_MISC |
| https://github.com/zalando/skipper/releases/tag/v… | x_refsource_MISC |
| https://github.com/zalando/skipper/tree/v0.27.35 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86043",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:38:03.907390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:38:17.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "skipper",
"vendor": "zalando",
"versions": [
{
"status": "affected",
"version": "\u003c 0.27.37"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBodyOptionally truncates bodies at maxBodyBytes, while filters/openpolicyagent/internal/envoy/skipperadapter.go copies the request headers without adding a Content-Length value that reflects the truncation. For an HTTP/1.1 request using Transfer-Encoding: chunked or an HTTP/2 request without Content-Length, a body-inspecting policy that follows the prior mitigation and permits input.truncated_body equal to false can evaluate only the truncated prefix, allow the request, and then forward the full oversized body to the protected upstream. This residual issue is distinct from CVE-2026-50197. This issue is fixed in version 0.27.37."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:52:33.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76"
},
{
"name": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
},
{
"name": "https://github.com/zalando/skipper/releases/tag/v0.27.35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
},
{
"name": "https://github.com/zalando/skipper/tree/v0.27.35",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zalando/skipper/tree/v0.27.35"
}
],
"source": {
"advisory": "GHSA-5gpm-rgj3-9q76",
"discovery": "UNKNOWN"
},
"title": "Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86043",
"datePublished": "2026-09-16T18:51:20.486Z",
"dateReserved": "2026-09-04T19:29:21.058Z",
"dateUpdated": "2026-09-16T19:38:17.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86009 (GCVE-0-2026-86009)
Vulnerability from cvelistv5 – Published: 2026-10-16 16:19 – Updated: 2026-10-21 02:26
VLAI
EPSS
VEX
Title
Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control
Summary
Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 02:26 UTC
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Mailu/Mailu/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/Mailu/Mailu/issues/2686 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/pull/4072 | x_refsource_MISC |
| https://github.com/Mailu/Mailu/commit/f05aeb8322e… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86009",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T02:26:25.611618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T02:26:54.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Mailu/Mailu/issues/2686"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Mailu",
"vendor": "Mailu",
"versions": [
{
"status": "affected",
"version": "\u003c f05aeb8322e2f61096af6b089d61ba6f40587d96"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:19:06.420Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Mailu/Mailu/security/advisories/GHSA-crww-m82r-2wfm"
},
{
"name": "https://github.com/Mailu/Mailu/issues/2686",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/issues/2686"
},
{
"name": "https://github.com/Mailu/Mailu/pull/4072",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/pull/4072"
},
{
"name": "https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Mailu/Mailu/commit/f05aeb8322e2f61096af6b089d61ba6f40587d96"
}
],
"source": {
"advisory": "GHSA-crww-m82r-2wfm",
"discovery": "UNKNOWN"
},
"title": "Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-86009",
"datePublished": "2026-10-16T16:19:06.420Z",
"dateReserved": "2026-09-04T19:17:36.246Z",
"dateUpdated": "2026-10-21T02:26:54.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85978 (GCVE-0-2026-85978)
Vulnerability from cvelistv5 – Published: 2026-09-09 10:31 – Updated: 2026-09-09 14:19
VLAI
EPSS
VEX
Title
Unauthenticated Remote Code Execution in Akana API Platform
Summary
An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 12:33 UTC
CWE
Assigner
Perforce
CNA
References
1 reference
Impacted products
Date Public
2026-09-08 18:29
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85978",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T12:33:13.356890Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T12:33:44.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Akana API Platform"
],
"product": "Akana",
"vendor": "Perforce",
"versions": [
{
"status": "unaffected",
"version": "2024.1.6, 2025.1.2, 2026.2"
},
{
"status": "affected",
"version": "All versions prior to 2024.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "2024.1.5",
"status": "affected",
"version": "2024.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.1.1",
"status": "affected",
"version": "2025.1.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2026.1",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-09-08T18:29:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eAn unauthenticated remote code execution vulnerability exists in the Policy Manager console of\u0026nbsp;Akana\u0026nbsp;API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "An unauthenticated remote code execution vulnerability exists in the Policy Manager console of\u00a0Akana\u00a0API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-41",
"description": "CWE-41 Improper resolution of path equivalence",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:19:29.425Z",
"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
"shortName": "Perforce"
},
"references": [
{
"url": "https://portal.perforce.com/s/cve/a91Qi000003CcxRIAS/unauthenticated-remote-code-execution-in-akana-policy-manager-console"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Remote Code Execution in Akana API Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
"assignerShortName": "Perforce",
"cveId": "CVE-2026-85978",
"datePublished": "2026-09-09T10:31:55.863Z",
"dateReserved": "2026-09-04T18:45:33.859Z",
"dateUpdated": "2026-09-09T14:19:29.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85744 (GCVE-0-2026-85744)
Vulnerability from cvelistv5 – Published: 2026-11-06 17:05 – Updated: 2026-11-09 22:44
VLAI
EPSS
VEX
Title
FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass
Summary
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response['msg'] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target's existing contents. This issue is fixed in version 1.8.227.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:34 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/freescout-help-desk/freescout/… | x_refsource_CONFIRM |
| https://github.com/freescout-help-desk/freescout/… | x_refsource_MISC |
| https://github.com/freescout-help-desk/freescout/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| freescout-help-desk | freescout |
Affected:
< 1.8.227
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:34:51.876985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:44:53.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "freescout",
"vendor": "freescout-help-desk",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.227"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.227, the conversation_merge action records a failed authorization check for the target conversation in response[\u0027msg\u0027] and then clears that value inside the source-conversation loop. An authenticated agent can merge a conversation they control into a target conversation in a mailbox they cannot access. The operation injects threads, attachments, and audit records into the unauthorized target and deletes the source conversation, but it does not disclose the target\u0027s existing contents. This issue is fixed in version 1.8.227."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:05:25.166Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-v8vc-cmf9-gg2c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-v8vc-cmf9-gg2c"
},
{
"name": "https://github.com/freescout-help-desk/freescout/commit/7c485c96bef7188c276906200250ce9d8a2bdfeb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/freescout-help-desk/freescout/commit/7c485c96bef7188c276906200250ce9d8a2bdfeb"
},
{
"name": "https://github.com/freescout-help-desk/freescout/releases/tag/1.8.227",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/freescout-help-desk/freescout/releases/tag/1.8.227"
}
],
"source": {
"advisory": "GHSA-v8vc-cmf9-gg2c",
"discovery": "UNKNOWN"
},
"title": "FreeScout: Conversation Merge Cross-Mailbox Authorization Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85744",
"datePublished": "2026-11-06T17:05:25.166Z",
"dateReserved": "2026-09-04T14:50:16.720Z",
"dateUpdated": "2026-11-09T22:44:53.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85724 (GCVE-0-2026-85724)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:29 – Updated: 2026-09-24 14:19
VLAI
EPSS
VEX
Title
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
Summary
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 14:18 UTC
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/moquette-io/moquette/security/… | x_refsource_CONFIRM |
| https://github.com/moquette-io/moquette/commit/b4… | x_refsource_MISC |
| https://github.com/moquette-io/moquette/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| moquette-io | moquette |
Affected:
< 0.18.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85724",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T14:18:56.863679Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:19:04.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "moquette",
"vendor": "moquette-io",
"versions": [
{
"status": "affected",
"version": "\u003c 0.18.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-155",
"description": "CWE-155: Improper Neutralization of Wildcards or Matching Symbols",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:29:36.296Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq"
},
{
"name": "https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af"
},
{
"name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
}
],
"source": {
"advisory": "GHSA-5f42-97gr-vfhq",
"discovery": "UNKNOWN"
},
"title": "Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85724",
"datePublished": "2026-09-23T16:29:36.296Z",
"dateReserved": "2026-09-04T14:45:10.648Z",
"dateUpdated": "2026-09-24T14:19:04.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85697 (GCVE-0-2026-85697)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-04 17:42
VLAI
EPSS
VEX
Title
Documenso 2.17.0 PDF Route Ignores Document Visibility
Summary
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:42 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/documenso/documenso/issues/3112 | issue-tracking |
| https://github.com/documenso/documenso | product |
| https://github.com/documenso/documenso/blob/v2.17… | technical-description |
| https://www.vulncheck.com/advisories/documenso-2.… | third-party-advisory |
Impacted products
Date Public
2026-07-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85697",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:42:36.114391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:42:57.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/documenso/documenso/issues/3112"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThanOrEqual": "2.17.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:39.491Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3112",
"tags": [
"issue-tracking"
],
"url": "https://github.com/documenso/documenso/issues/3112"
},
{
"tags": [
"product"
],
"url": "https://github.com/documenso/documenso"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/documenso/documenso/blob/v2.17.0/apps/remix/server/api/files/files.helpers.ts"
},
{
"name": "VulnCheck Advisory: Documenso 2.17.0 PDF Route Ignores Document Visibility",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/documenso-2.17.0-pdf-route-ignores-document-visibility"
}
],
"title": "Documenso 2.17.0 PDF Route Ignores Document Visibility",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85697",
"datePublished": "2026-09-04T14:32:39.491Z",
"dateReserved": "2026-09-04T13:51:52.593Z",
"dateUpdated": "2026-09-04T17:42:57.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85622 (GCVE-0-2026-85622)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-04 15:40
VLAI
EPSS
VEX
Title
AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket
Summary
AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 15:39 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/iss… | issue-tracking |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud | product |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/blo… | technical-description |
| https://www.vulncheck.com/advisories/appflowy-clo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ 0.9.64
(custom)
|
Date Public
2026-07-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85622",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T15:39:45.690714Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:40:12.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "0.9.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_v2 handler, allowing authenticated users to bind sessions to workspaces they do not belong to. Attackers can send sync Manifest messages with victim object identifiers to read full document or database state from collaborations in other workspaces without victim involvement."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:13.299Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1629",
"tags": [
"issue-tracking"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1629"
},
{
"tags": [
"product"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/src/api/ws.rs"
},
{
"name": "VulnCheck Advisory: AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/appflowy-cloud-through-0.9.64-cross-workspace-collab-read-via-websocket"
}
],
"title": "AppFlowy-Cloud through 0.9.64 Cross-Workspace Collab Read via WebSocket",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85622",
"datePublished": "2026-09-04T14:32:13.299Z",
"dateReserved": "2026-09-04T11:03:33.315Z",
"dateUpdated": "2026-09-04T15:40:12.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85620 (GCVE-0-2026-85620)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-14 19:33
VLAI
EPSS
VEX
Title
Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
Summary
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:19 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crystaldba/postgres-mcp/issues/178 | issue-tracking |
| https://github.com/crystaldba/postgres-mcp | product |
| https://github.com/crystaldba/postgres-mcp/blob/v… | technical-description |
| https://www.vulncheck.com/advisories/postgres-mcp… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| crystaldba | postgres-mcp |
Affected:
0 , ≤ 0.3.0
(semver)
|
Date Public
2026-06-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85620",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:19:58.465013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:33:09.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/postgres-mcp",
"product": "postgres-mcp",
"vendor": "crystaldba",
"versions": [
{
"lessThanOrEqual": "0.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg_read_file through FROM-clause syntax to read arbitrary files despite restricted-mode protections."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:11.907Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #178",
"tags": [
"issue-tracking"
],
"url": "https://github.com/crystaldba/postgres-mcp/issues/178"
},
{
"tags": [
"product"
],
"url": "https://github.com/crystaldba/postgres-mcp"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crystaldba/postgres-mcp/blob/v0.3.0/src/postgres_mcp/sql/safe_sql.py"
},
{
"name": "VulnCheck Advisory: Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/postgres-mcp-pro-0.3.0-restricted-mode-bypass-via-from-clause-function"
}
],
"title": "Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85620",
"datePublished": "2026-09-04T14:32:11.907Z",
"dateReserved": "2026-09-04T11:03:33.315Z",
"dateUpdated": "2026-09-14T19:33:09.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85619 (GCVE-0-2026-85619)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-04 17:56
VLAI
EPSS
VEX
Title
AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
Summary
AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim's object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/iss… | issue-tracking |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud | product |
| https://github.com/AppFlowy-IO/AppFlowy-Cloud/blo… | technical-description |
| https://www.vulncheck.com/advisories/appflowy-clo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AppFlowy-IO | AppFlowy-Cloud |
Affected:
0 , ≤ 0.9.64
(custom)
|
Date Public
2026-06-04 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85619",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:55:50.046578Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:56:11.229Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AppFlowy-Cloud",
"vendor": "AppFlowy-IO",
"versions": [
{
"lessThanOrEqual": "0.9.64",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to access documents and database rows across workspaces. Attackers can supply a victim\u0027s object ID with their own workspace ID to bypass access controls and read, modify, or delete cross-workspace data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:11.220Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1624",
"tags": [
"issue-tracking"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/issues/1624"
},
{
"tags": [
"product"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/AppFlowy-IO/AppFlowy-Cloud/blob/0.9.64/libs/access-control/src/casbin/collab.rs"
},
{
"name": "VulnCheck Advisory: AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/appflowy-cloud-0.9.64-cross-workspace-collab-access-via-http-api"
}
],
"title": "AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85619",
"datePublished": "2026-09-04T14:32:11.220Z",
"dateReserved": "2026-09-04T11:03:33.315Z",
"dateUpdated": "2026-09-04T17:56:11.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85597 (GCVE-0-2026-85597)
Vulnerability from cvelistv5 – Published: 2026-09-04 11:30 – Updated: 2026-10-08 15:51
VLAI
EPSS
VEX
Title
Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict
Summary
Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 18:03 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/traefik/traefik/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/traefik-befo… | third-party-advisory |
Impacted products
Date Public
2026-08-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T18:03:53.030722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:04:02.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v2",
"product": "traefik",
"vendor": "traefik",
"versions": [
{
"lessThan": "2.11.55",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.11.55",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/traefik/traefik/v3",
"product": "traefik",
"vendor": "traefik",
"versions": [
{
"lessThanOrEqual": "3.7.10",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.11.55",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.7.12",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "james-yusuke"
}
],
"datePublic": "2026-08-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution across multiple hostnames in a single router rule, causing the strict mTLS requirement to fall back to default options for all hosts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:51:49.372Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g55h-rg46-x9c5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-g55h-rg46-x9c5"
},
{
"name": "VulnCheck Advisory: Traefik before v2.11.55 mTLS Bypass via TLS Option Conflict",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/traefik-before-2.11.55-mtls-bypass-via-tls-option-conflict"
}
],
"title": "Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85597",
"datePublished": "2026-09-04T11:30:00.783Z",
"dateReserved": "2026-09-04T11:00:28.730Z",
"dateUpdated": "2026-10-08T15:51:49.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.