Common Weakness Enumeration
CWE-266
AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
2215 vulnerabilities reference this CWE, most recent first.
CVE-2026-19191 (GCVE-0-2026-19191)
Vulnerability from cvelistv5 – Published: 2026-08-07 03:30 – Updated: 2026-08-07 17:36
VLAI
EPSS
VEX
Title
StableBit DrivePool DrivePoolService DrivePool.Service.exe permission
Summary
A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\StableBit\DrivePool\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:35 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386709 | vdb-entry |
| https://vuldb.com/vuln/386709/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19191 | third-party-advisory |
| https://vuldb.com/submit/864539 | third-party-advisory |
| https://winslow1984.com/books/cve-collection/page… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19191",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:35:14.614473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:36:19.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:stablebit:drivepool:*:*:*:*:*:*:*:*"
],
"modules": [
"DrivePoolService"
],
"product": "DrivePool",
"vendor": "StableBit",
"versions": [
{
"status": "affected",
"version": "2.3.13.1687"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "winslow1984 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\\Program Files\\StableBit\\DrivePool\\DrivePool.Service.exe of the component DrivePoolService. Such manipulation leads to permission issues. The attack must be carried out locally. The exploit has been disclosed publicly and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-275",
"description": "Permission Issues",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T03:30:09.090Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386709 | StableBit DrivePool DrivePoolService DrivePool.Service.exe permission",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/386709"
},
{
"name": "VDB-386709 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386709/cti"
},
{
"name": "CVE-2026-19191 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19191"
},
{
"name": "Submit #864539 | StableBit StableBit DrivePool 2.3.13.1687 Local Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/864539"
},
{
"tags": [
"exploit"
],
"url": "https://winslow1984.com/books/cve-collection/page/stablebit-drivepool-23131687-local-privilege-escalation-via-insecure-deserialization"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-06T22:05:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "StableBit DrivePool DrivePoolService DrivePool.Service.exe permission",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19191",
"datePublished": "2026-08-07T03:30:09.090Z",
"dateReserved": "2026-08-06T20:00:01.802Z",
"dateUpdated": "2026-08-07T17:36:19.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19190 (GCVE-0-2026-19190)
Vulnerability from cvelistv5 – Published: 2026-08-07 02:30 – Updated: 2026-08-07 18:04
VLAI
EPSS
VEX
Title
StableBit Scanner ScannerService Scanner.Service.exe permission
Summary
A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\Program Files (x86)\StableBit\Scanner\Service\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:04 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386708 | vdb-entry |
| https://vuldb.com/vuln/386708/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19190 | third-party-advisory |
| https://vuldb.com/submit/864538 | third-party-advisory |
| https://winslow1984.com/books/cve-collection/page… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19190",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:04:46.095583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:04:55.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:stablebit:scanner:*:*:*:*:*:*:*:*"
],
"modules": [
"ScannerService"
],
"product": "Scanner",
"vendor": "StableBit",
"versions": [
{
"status": "affected",
"version": "2.6.13.4088"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "winslow1984 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in StableBit Scanner 2.6.13.4088. This affects an unknown part of the file C:\\Program Files (x86)\\StableBit\\Scanner\\Service\\Scanner.Service.exe of the component ScannerService. This manipulation causes permission issues. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-275",
"description": "Permission Issues",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T02:30:09.530Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386708 | StableBit Scanner ScannerService Scanner.Service.exe permission",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/386708"
},
{
"name": "VDB-386708 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386708/cti"
},
{
"name": "CVE-2026-19190 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19190"
},
{
"name": "Submit #864538 | StableBit StableBit Scanner 2.6.13.4088 Local Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/864538"
},
{
"tags": [
"exploit"
],
"url": "https://winslow1984.com/books/cve-collection/page/stablebit-scanner-26134088-local-privilege-escalation-via-insecure-deserialization"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-06T22:05:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "StableBit Scanner ScannerService Scanner.Service.exe permission",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19190",
"datePublished": "2026-08-07T02:30:09.530Z",
"dateReserved": "2026-08-06T19:59:50.226Z",
"dateUpdated": "2026-08-07T18:04:55.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19189 (GCVE-0-2026-19189)
Vulnerability from cvelistv5 – Published: 2026-08-07 02:00 – Updated: 2026-08-07 15:32
VLAI
EPSS
VEX
Title
Power Sofware PowerISO Kernel Driver scdemu.sys privileges management
Summary
A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\Windows\System32\drivers\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege management. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 15:32 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386707 | vdb-entry |
| https://vuldb.com/vuln/386707/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19189 | third-party-advisory |
| https://vuldb.com/submit/864536 | third-party-advisory |
| https://winslow1984.com/books/cve-collection/page… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Power Sofware | PowerISO |
Affected:
9.3.0.0
cpe:2.3:a:poweriso:poweriso:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T15:32:32.496628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:32:50.309Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:poweriso:poweriso:*:*:*:*:*:*:*:*"
],
"modules": [
"Kernel Driver"
],
"product": "PowerISO",
"vendor": "Power Sofware",
"versions": [
{
"status": "affected",
"version": "9.3.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "winslow1984 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Power Sofware PowerISO 9.3.0.0. Affected by this issue is some unknown functionality in the library C:\\Windows\\System32\\drivers\\scdemu.sys of the component Kernel Driver. The manipulation results in improper privilege management. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T02:00:10.601Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386707 | Power Sofware PowerISO Kernel Driver scdemu.sys privileges management",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/386707"
},
{
"name": "VDB-386707 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386707/cti"
},
{
"name": "CVE-2026-19189 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19189"
},
{
"name": "Submit #864536 | PowerISO PowerISO 9.3.0.0 Kernel Driver 6.9.0.0 Local Privilege Escalation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/864536"
},
{
"tags": [
"exploit"
],
"url": "https://winslow1984.com/books/cve-collection/page/poweriso-9300-kernel-driver-6900-local-privilege-escalation-via-arbitrary-registry-write-or-deletion"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-06T22:01:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "Power Sofware PowerISO Kernel Driver scdemu.sys privileges management",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19189",
"datePublished": "2026-08-07T02:00:10.601Z",
"dateReserved": "2026-08-06T19:56:04.969Z",
"dateUpdated": "2026-08-07T15:32:50.309Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19007 (GCVE-0-2026-19007)
Vulnerability from cvelistv5 – Published: 2026-08-06 06:15 – Updated: 2026-08-06 14:56
VLAI
EPSS
VEX
Title
mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management
Summary
A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:56 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386390 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/386390/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19007 | third-party-advisory |
| https://vuldb.com/submit/862643 | third-party-advisory |
| https://github.com/mf-yang/openclaw-cn/issues/564 | exploitissue-tracking |
| https://github.com/mf-yang/openclaw-cn/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mf-yang | openclaw-cn |
Affected:
0.2.0
Affected: 0.2.1 cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19007",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:56:16.426980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:56:29.496Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*"
],
"product": "openclaw-cn",
"vendor": "mf-yang",
"versions": [
{
"status": "affected",
"version": "0.2.0"
},
{
"status": "affected",
"version": "0.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "TrumpChen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the function isApprovedElevatedSender of the file src/auto-reply/reply/reply-elevated.ts. This manipulation causes improper privilege management. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T06:15:08.258Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386390 | mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/386390"
},
{
"name": "VDB-386390 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386390/cti"
},
{
"name": "CVE-2026-19007 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19007"
},
{
"name": "Submit #862643 | mf-yang openclaw-cn 0.2.1 Improper Privilege Management (CWE-269)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862643"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/mf-yang/openclaw-cn/issues/564"
},
{
"tags": [
"product"
],
"url": "https://github.com/mf-yang/openclaw-cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T22:09:12.000Z",
"value": "VulDB entry last update"
}
],
"title": "mf-yang openclaw-cn reply-elevated.ts isApprovedElevatedSender privileges management",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19007",
"datePublished": "2026-08-06T06:15:08.258Z",
"dateReserved": "2026-08-05T20:03:56.712Z",
"dateUpdated": "2026-08-06T14:56:29.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19005 (GCVE-0-2026-19005)
Vulnerability from cvelistv5 – Published: 2026-08-06 05:45 – Updated: 2026-08-06 15:06
VLAI
EPSS
VEX
Title
nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management
Summary
A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 15:06 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386386 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/386386/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19005 | third-party-advisory |
| https://vuldb.com/submit/862638 | third-party-advisory |
| https://github.com/nanocoai/nanoclaw/issues/2807 | exploitissue-tracking |
| https://github.com/nanocoai/nanoclaw/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nanocoai | NanoClaw |
Affected:
2.0.0
Affected: 2.0.1 Affected: 2.0.2 Affected: 2.0.3 Affected: 2.0.4 Affected: 2.0.5 Affected: 2.0.6 Affected: 2.0.7 Affected: 2.0.8 Affected: 2.0.9 Affected: 2.0.10 Affected: 2.0.11 Affected: 2.0.12 Affected: 2.0.13 Affected: 2.0.14 Affected: 2.0.15 Affected: 2.0.16 Affected: 2.0.17 Affected: 2.0.18 Affected: 2.0.19 Affected: 2.0.20 Affected: 2.0.21 Affected: 2.0.22 Affected: 2.0.23 Affected: 2.0.24 Affected: 2.0.25 Affected: 2.0.26 Affected: 2.0.27 Affected: 2.0.28 Affected: 2.0.29 Affected: 2.0.30 Affected: 2.0.31 Affected: 2.0.32 Affected: 2.0.33 Affected: 2.0.34 Affected: 2.0.35 Affected: 2.0.36 Affected: 2.0.37 Affected: 2.0.38 Affected: 2.0.39 Affected: 2.0.40 Affected: 2.0.41 Affected: 2.0.42 Affected: 2.0.43 Affected: 2.0.44 Affected: 2.0.45 Affected: 2.0.46 Affected: 2.0.47 Affected: 2.0.48 Affected: 2.0.49 Affected: 2.0.50 Affected: 2.0.51 Affected: 2.0.52 Affected: 2.0.53 Affected: 2.0.54 Affected: 2.0.55 Affected: 2.0.56 Affected: 2.0.57 Affected: 2.0.58 Affected: 2.0.59 Affected: 2.0.60 Affected: 2.0.61 Affected: 2.0.62 Affected: 2.0.63 Affected: 2.0.64 cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19005",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T15:06:31.842982Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T15:06:38.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/862638"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nanocoai:nanoclaw:*:*:*:*:*:*:*:*"
],
"modules": [
"Child-Agent Creation"
],
"product": "NanoClaw",
"vendor": "nanocoai",
"versions": [
{
"status": "affected",
"version": "2.0.0"
},
{
"status": "affected",
"version": "2.0.1"
},
{
"status": "affected",
"version": "2.0.2"
},
{
"status": "affected",
"version": "2.0.3"
},
{
"status": "affected",
"version": "2.0.4"
},
{
"status": "affected",
"version": "2.0.5"
},
{
"status": "affected",
"version": "2.0.6"
},
{
"status": "affected",
"version": "2.0.7"
},
{
"status": "affected",
"version": "2.0.8"
},
{
"status": "affected",
"version": "2.0.9"
},
{
"status": "affected",
"version": "2.0.10"
},
{
"status": "affected",
"version": "2.0.11"
},
{
"status": "affected",
"version": "2.0.12"
},
{
"status": "affected",
"version": "2.0.13"
},
{
"status": "affected",
"version": "2.0.14"
},
{
"status": "affected",
"version": "2.0.15"
},
{
"status": "affected",
"version": "2.0.16"
},
{
"status": "affected",
"version": "2.0.17"
},
{
"status": "affected",
"version": "2.0.18"
},
{
"status": "affected",
"version": "2.0.19"
},
{
"status": "affected",
"version": "2.0.20"
},
{
"status": "affected",
"version": "2.0.21"
},
{
"status": "affected",
"version": "2.0.22"
},
{
"status": "affected",
"version": "2.0.23"
},
{
"status": "affected",
"version": "2.0.24"
},
{
"status": "affected",
"version": "2.0.25"
},
{
"status": "affected",
"version": "2.0.26"
},
{
"status": "affected",
"version": "2.0.27"
},
{
"status": "affected",
"version": "2.0.28"
},
{
"status": "affected",
"version": "2.0.29"
},
{
"status": "affected",
"version": "2.0.30"
},
{
"status": "affected",
"version": "2.0.31"
},
{
"status": "affected",
"version": "2.0.32"
},
{
"status": "affected",
"version": "2.0.33"
},
{
"status": "affected",
"version": "2.0.34"
},
{
"status": "affected",
"version": "2.0.35"
},
{
"status": "affected",
"version": "2.0.36"
},
{
"status": "affected",
"version": "2.0.37"
},
{
"status": "affected",
"version": "2.0.38"
},
{
"status": "affected",
"version": "2.0.39"
},
{
"status": "affected",
"version": "2.0.40"
},
{
"status": "affected",
"version": "2.0.41"
},
{
"status": "affected",
"version": "2.0.42"
},
{
"status": "affected",
"version": "2.0.43"
},
{
"status": "affected",
"version": "2.0.44"
},
{
"status": "affected",
"version": "2.0.45"
},
{
"status": "affected",
"version": "2.0.46"
},
{
"status": "affected",
"version": "2.0.47"
},
{
"status": "affected",
"version": "2.0.48"
},
{
"status": "affected",
"version": "2.0.49"
},
{
"status": "affected",
"version": "2.0.50"
},
{
"status": "affected",
"version": "2.0.51"
},
{
"status": "affected",
"version": "2.0.52"
},
{
"status": "affected",
"version": "2.0.53"
},
{
"status": "affected",
"version": "2.0.54"
},
{
"status": "affected",
"version": "2.0.55"
},
{
"status": "affected",
"version": "2.0.56"
},
{
"status": "affected",
"version": "2.0.57"
},
{
"status": "affected",
"version": "2.0.58"
},
{
"status": "affected",
"version": "2.0.59"
},
{
"status": "affected",
"version": "2.0.60"
},
{
"status": "affected",
"version": "2.0.61"
},
{
"status": "affected",
"version": "2.0.62"
},
{
"status": "affected",
"version": "2.0.63"
},
{
"status": "affected",
"version": "2.0.64"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "TrumpChen (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreateAgent of the file src/modules/agent-to-agent/create-agent.ts of the component Child-Agent Creation. Performing a manipulation results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T05:45:09.344Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386386 | nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/386386"
},
{
"name": "VDB-386386 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386386/cti"
},
{
"name": "CVE-2026-19005 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19005"
},
{
"name": "Submit #862638 | qwibitai nanoclaw 2.0.64 Improper Privilege Management (CWE-269)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862638"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/nanocoai/nanoclaw/issues/2807"
},
{
"tags": [
"product"
],
"url": "https://github.com/nanocoai/nanoclaw/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T21:56:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "nanocoai NanoClaw Child-Agent Creation create-agent.ts handleCreateAgent privileges management",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19005",
"datePublished": "2026-08-06T05:45:09.344Z",
"dateReserved": "2026-08-05T19:51:07.858Z",
"dateUpdated": "2026-08-06T15:06:38.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18998 (GCVE-0-2026-18998)
Vulnerability from cvelistv5 – Published: 2026-08-06 04:45 – Updated: 2026-08-06 17:32
VLAI
EPSS
VEX
Title
cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization
Summary
A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 17:25 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386381 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/386381/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18998 | third-party-advisory |
| https://vuldb.com/submit/862628 | third-party-advisory |
| https://vuldb.com/submit/862629 | third-party-advisory |
| https://github.com/cosmicstack-labs/mercury-agent… | exploitissue-tracking |
| https://github.com/cosmicstack-labs/mercury-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cosmicstack-labs | mercury-agent |
Affected:
1.1.0
Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Affected: 1.1.4 Affected: 1.1.5 Affected: 1.1.6 Affected: 1.1.7 Affected: 1.1.8 Affected: 1.1.9 Affected: 1.1.10 Affected: 1.1.11 Affected: 1.1.12 cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18998",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T17:25:38.770763Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:32:05.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"delegate_task Tool"
],
"product": "mercury-agent",
"vendor": "cosmicstack-labs",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "affected",
"version": "1.1.4"
},
{
"status": "affected",
"version": "1.1.5"
},
{
"status": "affected",
"version": "1.1.6"
},
{
"status": "affected",
"version": "1.1.7"
},
{
"status": "affected",
"version": "1.1.8"
},
{
"status": "affected",
"version": "1.1.9"
},
{
"status": "affected",
"version": "1.1.10"
},
{
"status": "affected",
"version": "1.1.11"
},
{
"status": "affected",
"version": "1.1.12"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChenMarry (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T04:45:09.185Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386381 | cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/386381"
},
{
"name": "VDB-386381 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386381/cti"
},
{
"name": "CVE-2026-18998 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18998"
},
{
"name": "Submit #862628 | cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862628"
},
{
"name": "Submit #862629 | cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862629"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cosmicstack-labs/mercury-agent/issues/74"
},
{
"tags": [
"product"
],
"url": "https://github.com/cosmicstack-labs/mercury-agent/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T21:47:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18998",
"datePublished": "2026-08-06T04:45:09.185Z",
"dateReserved": "2026-08-05T19:41:53.908Z",
"dateUpdated": "2026-08-06T17:32:05.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18996 (GCVE-0-2026-18996)
Vulnerability from cvelistv5 – Published: 2026-08-06 04:15 – Updated: 2026-08-06 12:13
VLAI
EPSS
VEX
Title
cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment
Summary
A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 12:12 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386379 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/386379/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18996 | third-party-advisory |
| https://vuldb.com/submit/862625 | third-party-advisory |
| https://vuldb.com/submit/862630 | third-party-advisory |
| https://vuldb.com/submit/862636 | third-party-advisory |
| https://vuldb.com/submit/862637 | third-party-advisory |
| https://github.com/cosmicstack-labs/mercury-agent… | exploitissue-tracking |
| https://github.com/cosmicstack-labs/mercury-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cosmicstack-labs | mercury-agent |
Affected:
1.1.0
Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Affected: 1.1.4 Affected: 1.1.5 Affected: 1.1.6 Affected: 1.1.7 Affected: 1.1.8 Affected: 1.1.9 Affected: 1.1.10 Affected: 1.1.11 Affected: 1.1.12 cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18996",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T12:12:48.835183Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T12:13:14.698Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"run_command Handler"
],
"product": "mercury-agent",
"vendor": "cosmicstack-labs",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "affected",
"version": "1.1.4"
},
{
"status": "affected",
"version": "1.1.5"
},
{
"status": "affected",
"version": "1.1.6"
},
{
"status": "affected",
"version": "1.1.7"
},
{
"status": "affected",
"version": "1.1.8"
},
{
"status": "affected",
"version": "1.1.9"
},
{
"status": "affected",
"version": "1.1.10"
},
{
"status": "affected",
"version": "1.1.11"
},
{
"status": "affected",
"version": "1.1.12"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChenMarry (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T04:15:09.618Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386379 | cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/386379"
},
{
"name": "VDB-386379 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386379/cti"
},
{
"name": "CVE-2026-18996 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18996"
},
{
"name": "Submit #862625 | cosmicstack-labs mercury-agent 1.1.12 Incorrect Privilege Assignment (CWE-266)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862625"
},
{
"name": "Submit #862630 | cosmicstack-labs mercury-agent 1.1.12 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862630"
},
{
"name": "Submit #862636 | cosmicstack-labs mercury-agent 1.1.12 Incorrect Authorization (CWE-863) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862636"
},
{
"name": "Submit #862637 | cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285) (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862637"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cosmicstack-labs/mercury-agent/issues/72"
},
{
"tags": [
"product"
],
"url": "https://github.com/cosmicstack-labs/mercury-agent/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T21:46:38.000Z",
"value": "VulDB entry last update"
}
],
"title": "cosmicstack-labs mercury-agent run_command permissions.ts PermissionManager.checkShellCommand privileges assignment",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18996",
"datePublished": "2026-08-06T04:15:09.618Z",
"dateReserved": "2026-08-05T19:41:31.033Z",
"dateUpdated": "2026-08-06T12:13:14.698Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18993 (GCVE-0-2026-18993)
Vulnerability from cvelistv5 – Published: 2026-08-06 03:45 – Updated: 2026-08-06 13:27
VLAI
EPSS
VEX
Title
NousResearch hermes-agent Memory Toolset model_tools.py access control
Summary
A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 13:27 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386377 | vdb-entry |
| https://vuldb.com/vuln/386377/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18993 | third-party-advisory |
| https://vuldb.com/submit/862610 | third-party-advisory |
| https://github.com/NousResearch/hermes-agent/issu… | issue-tracking |
| https://github.com/NousResearch/hermes-agent/pull/46185 | issue-trackingpatch |
| https://github.com/NousResearch/hermes-agent/issu… | exploitissue-tracking |
| https://github.com/NousResearch/hermes-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NousResearch | hermes-agent |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16.0 cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18993",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T13:27:20.784017Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T13:27:35.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"Memory Toolset"
],
"product": "hermes-agent",
"vendor": "NousResearch",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChenMarry (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T03:45:10.418Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386377 | NousResearch hermes-agent Memory Toolset model_tools.py access control",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/386377"
},
{
"name": "VDB-386377 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386377/cti"
},
{
"name": "CVE-2026-18993 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18993"
},
{
"name": "Submit #862610 | NousResearch hermes-agent 0.16.0 Improper Access Control (CWE-284)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862610"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/NousResearch/hermes-agent/issues/46171"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/NousResearch/hermes-agent/pull/46185"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/NousResearch/hermes-agent/issues/48181"
},
{
"tags": [
"product"
],
"url": "https://github.com/NousResearch/hermes-agent/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T21:25:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "NousResearch hermes-agent Memory Toolset model_tools.py access control",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18993",
"datePublished": "2026-08-06T03:45:10.418Z",
"dateReserved": "2026-08-05T19:19:57.788Z",
"dateUpdated": "2026-08-06T13:27:35.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18976 (GCVE-0-2026-18976)
Vulnerability from cvelistv5 – Published: 2026-08-06 01:45 – Updated: 2026-08-06 13:30
VLAI
EPSS
VEX
Title
NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment
Summary
A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 13:29 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/386264 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/386264/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18976 | third-party-advisory |
| https://vuldb.com/submit/862541 | third-party-advisory |
| https://github.com/NousResearch/hermes-agent/issu… | exploitissue-tracking |
| https://github.com/NousResearch/hermes-agent/pull/46185 | issue-trackingpatch |
| https://github.com/NousResearch/hermes-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NousResearch | hermes-agent |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12 Affected: 0.13 Affected: 0.14 Affected: 0.15 Affected: 0.16.0 cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18976",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T13:29:59.091021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T13:30:10.972Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"disabled_toolsets Handler"
],
"product": "hermes-agent",
"vendor": "NousResearch",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12"
},
{
"status": "affected",
"version": "0.13"
},
{
"status": "affected",
"version": "0.14"
},
{
"status": "affected",
"version": "0.15"
},
{
"status": "affected",
"version": "0.16.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Erichen-apple (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T01:45:12.863Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-386264 | NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/386264"
},
{
"name": "VDB-386264 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/386264/cti"
},
{
"name": "CVE-2026-18976 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18976"
},
{
"name": "Submit #862541 | NousResearch Hermes Agent 0.16.0 Incorrect Privilege Assignment (CWE-266)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/862541"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/NousResearch/hermes-agent/issues/46171"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/NousResearch/hermes-agent/pull/46185"
},
{
"tags": [
"product"
],
"url": "https://github.com/NousResearch/hermes-agent/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-05T18:22:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18976",
"datePublished": "2026-08-06T01:45:12.863Z",
"dateReserved": "2026-08-05T16:17:43.809Z",
"dateUpdated": "2026-08-06T13:30:10.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18817 (GCVE-0-2026-18817)
Vulnerability from cvelistv5 – Published: 2026-08-04 22:00 – Updated: 2026-08-05 14:57 Disputed
VLAI
EPSS
VEX
Title
Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization
Summary
A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. The presence of this vulnerability remains uncertain at this time. Upgrading to version 2.3.3 can resolve this issue. The affected component should be upgraded. The project maintainer explains: "While the problem exists, I'm not really sure if it's a vulnerability. (....) Even though the back gives a token for a deactivate user, none of the endpoints actually work. That said, we will fix it, but so far it seems more like a bug instead of a vulnerability."
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:57 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385816 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385816/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18817 | third-party-advisory |
| https://vuldb.com/submit/857942 | third-party-advisory |
| https://github.com/baserow/baserow/releases/tag/2.3.3 | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18817",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:57:02.296460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:57:08.049Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:baserow:baserow:*:*:*:*:*:*:*:*"
],
"modules": [
"Inactive Non-Staff User Handler"
],
"product": "Baserow",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.3.0"
},
{
"status": "affected",
"version": "2.3.1"
},
{
"status": "affected",
"version": "2.3.2"
},
{
"status": "unaffected",
"version": "2.3.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GalaxynX (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Baserow up to 2.3.2. Affected by this issue is the function BaserowImpersonateAuthTokenSerializer of the file backend/src/baserow/api/admin/users/serializers.py of the component Inactive Non-Staff User Handler. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. The presence of this vulnerability remains uncertain at this time. Upgrading to version 2.3.3 can resolve this issue. The affected component should be upgraded. The project maintainer explains: \"While the problem exists, I\u0027m not really sure if it\u0027s a vulnerability. (....) Even though the back gives a token for a deactivate user, none of the endpoints actually work. That said, we will fix it, but so far it seems more like a bug instead of a vulnerability.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.7,
"vectorString": "AV:N/AC:H/Au:M/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T22:00:12.012Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385816 | Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385816"
},
{
"name": "VDB-385816 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385816/cti"
},
{
"name": "CVE-2026-18817 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18817"
},
{
"name": "Submit #857942 | baserow c34eb053be98bc0d04fcbf9b2d6b305cba0d5647 CWE-285 Improper Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/857942"
},
{
"tags": [
"patch"
],
"url": "https://github.com/baserow/baserow/releases/tag/2.3.3"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-04T14:59:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "Baserow Inactive Non-Staff User serializers.py BaserowImpersonateAuthTokenSerializer improper authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18817",
"datePublished": "2026-08-04T22:00:12.012Z",
"dateReserved": "2026-08-04T12:54:10.835Z",
"dateUpdated": "2026-08-05T14:57:08.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.