Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4324 vulnerabilities reference this CWE, most recent first.
CVE-2026-93991 (GCVE-0-2026-93991)
Vulnerability from cvelistv5 – Published: 2026-09-19 22:58 – Updated: 2026-09-19 22:58
VLAI
EPSS
VEX
Title
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
Summary
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/argoproj/argo-workflows/securi… | vendor-advisory |
| https://github.com/argoproj/argo-workflows/commit… | patch |
| https://github.com/argoproj/argo-workflows/releas… | release-notes |
| https://github.com/argoproj/argo-workflows | product |
| https://www.vulncheck.com/advisories/argo-workflo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| argoproj | argo-workflows |
Affected:
4.1.0 , < 4.1.4
(semver)
cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:*:*:* |
Date Public
2026-09-18 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/argoproj/argo-workflows/v4",
"product": "argo-workflows",
"repo": "https://github.com/argoproj/argo-workflows",
"vendor": "argoproj",
"versions": [
{
"lessThan": "4.1.4",
"status": "affected",
"version": "4.1.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.4",
"versionStartIncluding": "4.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "thesecguy45"
},
{
"lang": "en",
"type": "reporter",
"value": "euriconicacio"
}
],
"datePublic": "2026-09-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T22:58:11.895Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q65w-j2vp-47c4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-q65w-j2vp-47c4"
},
{
"tags": [
"patch"
],
"url": "https://github.com/argoproj/argo-workflows/commit/a40972386c097ddf816d2e60e13f058bedca53d9"
},
{
"name": "argo-workflows v4.1.4 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/argoproj/argo-workflows/releases/tag/v4.1.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/argoproj/argo-workflows"
},
{
"name": "VulnCheck Advisory: Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/argo-workflows-4.1.0-through-4.1.3-cross-namespace-disclosure-via-negated-selector"
}
],
"title": "Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93991",
"datePublished": "2026-09-19T22:58:11.895Z",
"dateReserved": "2026-09-19T12:04:52.547Z",
"dateUpdated": "2026-09-19T22:58:11.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93955 (GCVE-0-2026-93955)
Vulnerability from cvelistv5 – Published: 2026-09-19 22:15 – Updated: 2026-09-19 22:15
VLAI
EPSS
VEX
Title
grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization
Summary
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/407914 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/407914/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-93955 | third-party-advisory |
| https://vuldb.com/submit/943921 | third-party-advisory |
| https://github.com/grimmory-tools/grimmory/issues/2431 | exploitissue-tracking |
| https://github.com/grimmory-tools/grimmory/issues… | issue-tracking |
| https://github.com/grimmory-tools/grimmory/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grimmory-tools | grimmory |
Affected:
3.3.0
Affected: 3.3.1 Affected: 3.3.2 Affected: 3.3.3 Affected: 3.4.0 Affected: 3.4.1 cpe:2.3:a:grimmory-tools:grimmory:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:grimmory-tools:grimmory:*:*:*:*:*:*:*:*"
],
"modules": [
"Download Endpoint"
],
"product": "grimmory",
"vendor": "grimmory-tools",
"versions": [
{
"status": "affected",
"version": "3.3.0"
},
{
"status": "affected",
"version": "3.3.1"
},
{
"status": "affected",
"version": "3.3.2"
},
{
"status": "affected",
"version": "3.3.3"
},
{
"status": "affected",
"version": "3.4.0"
},
{
"status": "affected",
"version": "3.4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue \u201chas already been reported elsewhere.\u201d No fixing commit or pull request is identified there."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T22:15:09.092Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-407914 | grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/407914"
},
{
"name": "VDB-407914 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/407914/cti"
},
{
"name": "CVE-2026-93955 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-93955"
},
{
"name": "Submit #943921 | grimmory-tools grimmory 3.3.3 Incorrect Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/943921"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/grimmory-tools/grimmory/issues/2431"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/grimmory-tools/grimmory/issues/2431#issuecomment-5384402858"
},
{
"tags": [
"product"
],
"url": "https://github.com/grimmory-tools/grimmory/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-19T10:56:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-93955",
"datePublished": "2026-09-19T22:15:09.092Z",
"dateReserved": "2026-09-19T08:51:16.505Z",
"dateUpdated": "2026-09-19T22:15:09.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93758 (GCVE-0-2026-93758)
Vulnerability from cvelistv5 – Published: 2026-09-18 16:56 – Updated: 2026-09-18 16:56
VLAI
EPSS
VEX
Title
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
Summary
An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user's own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB Inc. | Mongoid |
Affected:
9.1.0
(semver)
Affected: 9.0.0 , ≤ 9.0.11 (semver) Affected: 8.1.0 , ≤ 8.1.12 (semver) Affected: 8.0.0 , ≤ 8.0.12 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mongoid",
"vendor": "MongoDB Inc.",
"versions": [
{
"status": "affected",
"version": "9.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.0.11",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.1.12",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0.12",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user\u0027s own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application."
}
],
"value": "An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual ownership or scoping restrictions, then updated and linked to the requesting user\u0027s own record. This may result in unintended disclosure and unauthorized modification of data belonging to other users of the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:56:41.325Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/MONGOID-5992"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Cross-principal document update, theft, and deletion via unvalidated id in nested attributes",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-93758",
"datePublished": "2026-09-18T16:56:41.325Z",
"dateReserved": "2026-09-18T16:51:38.102Z",
"dateUpdated": "2026-09-18T16:56:41.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93736 (GCVE-0-2026-93736)
Vulnerability from cvelistv5 – Published: 2026-09-18 16:04 – Updated: 2026-09-18 17:25
VLAI
EPSS
VEX
Title
Mealie before 3.21.0 Information Disclosure via Ratings Endpoint
Summary
Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 17:25 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/mealie-recipes/mealie/issues/7909 | issue-tracking |
| https://github.com/mealie-recipes/mealie | product |
| https://github.com/mealie-recipes/mealie/blob/v3.… | technical-description |
| https://github.com/mealie-recipes/mealie/blob/v3.… | technical-description |
| https://github.com/mealie-recipes/mealie/pull/7903 | patchissue-tracking |
| https://github.com/mealie-recipes/mealie/commit/6… | patch |
| https://github.com/mealie-recipes/mealie/releases… | release-notes |
| https://www.vulncheck.com/advisories/mealie-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| mealie-recipes | mealie |
Affected:
0 , < 3.21.0
(semver)
cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:* |
Date Public
2026-07-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93736",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T17:25:36.834668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:25:44.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/mealie-recipes/mealie/issues/7909"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/mealie-recipes/mealie",
"product": "mealie",
"repo": "https://github.com/mealie-recipes/mealie",
"vendor": "mealie-recipes",
"versions": [
{
"lessThan": "3.21.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "George Chen"
}
],
"datePublic": "2026-07-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user\u0027s recipe ratings and favorites by specifying arbitrary user IDs in the URL path. Attackers can access private recipe identifiers, rating values, and favorite flags belonging to other users across different groups or households."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:04:48.581Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #7909",
"tags": [
"issue-tracking"
],
"url": "https://github.com/mealie-recipes/mealie/issues/7909"
},
{
"tags": [
"product"
],
"url": "https://github.com/mealie-recipes/mealie"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/routes/users/ratings.py#L44-L52"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mealie-recipes/mealie/blob/v3.20.1/mealie/repos/repository_users.py#L82-L88"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/mealie-recipes/mealie/pull/7903"
},
{
"tags": [
"patch"
],
"url": "https://github.com/mealie-recipes/mealie/commit/6889101a760a457019276c10514e630660b3ed28"
},
{
"name": "mealie v3.21.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/mealie-recipes/mealie/releases/tag/v3.21.0"
},
{
"name": "VulnCheck Advisory: Mealie before 3.21.0 Information Disclosure via Ratings Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mealie-before-3.21.0-information-disclosure-via-ratings-endpoint"
}
],
"title": "Mealie before 3.21.0 Information Disclosure via Ratings Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93736",
"datePublished": "2026-09-18T16:04:48.581Z",
"dateReserved": "2026-09-18T15:38:23.485Z",
"dateUpdated": "2026-09-18T17:25:44.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93660 (GCVE-0-2026-93660)
Vulnerability from cvelistv5 – Published: 2026-09-18 14:23 – Updated: 2026-09-18 14:23
VLAI
EPSS
VEX
Title
SQLBot through 1.10.1 Improper Access Control via Dashboard Update
Summary
SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/dataease/SQLBot/issues/1377 | issue-tracking |
| https://github.com/dataease/SQLBot/commit/fccdd29… | patch |
| https://github.com/dataease/SQLBot/blob/v1.10.1/b… | technical-description |
| https://github.com/dataease/SQLBot/blob/v1.10.1/b… | technical-description |
| https://github.com/dataease/SQLBot | product |
| https://www.vulncheck.com/advisories/sqlbot-throu… | third-party-advisory |
Date Public
2026-09-16 15:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SQLBot",
"repo": "https://github.com/dataease/SQLBot",
"vendor": "dataease",
"versions": [
{
"lessThanOrEqual": "1.10.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T15:00:17.000Z",
"descriptions": [
{
"lang": "en",
"value": "SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify other users\u0027 private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles, and view information belonging to other workspace members."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:23:22.267Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Issue #1377",
"tags": [
"issue-tracking"
],
"url": "https://github.com/dataease/SQLBot/issues/1377"
},
{
"name": "Add per-user ownership check to dashboard load/update/delete",
"tags": [
"patch"
],
"url": "https://github.com/dataease/SQLBot/commit/fccdd29421dfc32d3a552ab29b2554974e1ebc4c"
},
{
"name": "Vulnerable dashboard_service.py at v1.10.1",
"tags": [
"technical-description"
],
"url": "https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/dashboard/crud/dashboard_service.py"
},
{
"name": "Workspace-only permission check at v1.10.1",
"tags": [
"technical-description"
],
"url": "https://github.com/dataease/SQLBot/blob/v1.10.1/backend/apps/system/schemas/permission.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/dataease/SQLBot"
},
{
"name": "VulnCheck Advisory: SQLBot through 1.10.1 Improper Access Control via Dashboard Update",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sqlbot-through-1.10.1-improper-access-control-via-dashboard-update"
}
],
"title": "SQLBot through 1.10.1 Improper Access Control via Dashboard Update",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93660",
"datePublished": "2026-09-18T14:23:22.267Z",
"dateReserved": "2026-09-18T13:30:26.643Z",
"dateUpdated": "2026-09-18T14:23:22.267Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92810 (GCVE-0-2026-92810)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 14:56
VLAI
EPSS
VEX
Title
PrestaShop blockwishlist through 3.0.2 Information Disclosure
Summary
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 14:56 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/prestas… | technical-descriptionexploit |
| https://github.com/PrestaShop/blockwishlist/blob/… | technical-description |
| https://github.com/PrestaShop/blockwishlist | product |
| https://www.vulncheck.com/advisories/prestashop-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PrestaShop | blockwishlist |
Affected:
0 , ≤ 3.0.2
(semver)
cpe:2.3:a:prestashop:blockwishlist:*:*:*:*:*:*:*:* |
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92810",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T14:56:40.661096Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:56:49.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "blockwishlist",
"vendor": "PrestaShop",
"versions": [
{
"lessThanOrEqual": "3.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:prestashop:blockwishlist:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers\u0027 private wishlist contents."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:56.823Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up, finding 2",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/prestashop.md#finding-2-blockwishlist-idor-wishlist-share-token-disclosure-via-missing-authorization-check"
},
{
"name": "getUrlByIdWishListAction returns the token with no assertWriteAccess",
"tags": [
"technical-description"
],
"url": "https://github.com/PrestaShop/blockwishlist/blob/v3.0.2/controllers/front/action.php#L411-L421"
},
{
"tags": [
"product"
],
"url": "https://github.com/PrestaShop/blockwishlist"
},
{
"name": "VulnCheck Advisory: PrestaShop blockwishlist through 3.0.2 Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/prestashop-blockwishlist-through-3.0.2-information-disclosure"
}
],
"title": "PrestaShop blockwishlist through 3.0.2 Information Disclosure",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92810",
"datePublished": "2026-09-16T20:32:56.823Z",
"dateReserved": "2026-09-16T19:55:00.980Z",
"dateUpdated": "2026-09-17T14:56:49.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92809 (GCVE-0-2026-92809)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 19:24
VLAI
EPSS
VEX
Title
PrestaShop psgdpr through 1.4.3 GDPR Log Forgery
Summary
PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:41 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/prestas… | technical-descriptionexploit |
| https://github.com/PrestaShop/psgdpr/blob/v1.4.3/… | technical-description |
| https://github.com/PrestaShop/psgdpr | product |
| https://www.vulncheck.com/advisories/prestashop-p… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| PrestaShop | psgdpr |
Affected:
0 , ≤ 1.4.3
(semver)
cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* |
Date Public
2026-09-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92809",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:41:07.270504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:24:18.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "psgdpr",
"vendor": "PrestaShop",
"versions": [
{
"lessThanOrEqual": "1.4.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:56.067Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher write-up, finding 1",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/prestashop.md#finding-1-idor---authenticated-customers-can-forge-gdpr-consent-records-for-arbitrary-customers"
},
{
"name": "id_customer is taken from the request and used in the insert",
"tags": [
"technical-description"
],
"url": "https://github.com/PrestaShop/psgdpr/blob/v1.4.3/controllers/front/FrontAjaxGdpr.php#L28-L54"
},
{
"tags": [
"product"
],
"url": "https://github.com/PrestaShop/psgdpr"
},
{
"name": "VulnCheck Advisory: PrestaShop psgdpr through 1.4.3 GDPR Log Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/prestashop-psgdpr-through-1.4.3-gdpr-log-forgery"
}
],
"title": "PrestaShop psgdpr through 1.4.3 GDPR Log Forgery",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92809",
"datePublished": "2026-09-16T20:32:56.067Z",
"dateReserved": "2026-09-16T19:55:00.619Z",
"dateUpdated": "2026-09-17T19:24:18.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92773 (GCVE-0-2026-92773)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 19:25
VLAI
EPSS
VEX
Title
Trigger.dev before 4.6.0 GitHub App Installation Takeover
Summary
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim's repositories.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/triggerdotdev/trigger.dev/secu… | third-party-advisoryvendor-advisory |
| https://github.com/triggerdotdev/trigger.dev/blob… | technical-description |
| https://github.com/triggerdotdev/trigger.dev/blob… | patch |
| https://github.com/triggerdotdev/trigger.dev | product |
| https://www.vulncheck.com/advisories/trigger-dev-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| triggerdotdev | trigger.dev |
Affected:
0 , < 4.6.0
(semver)
|
Date Public
2026-09-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:54.308008Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:25:13.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "trigger.dev",
"vendor": "triggerdotdev",
"versions": [
{
"lessThan": "4.6.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user\u0027s GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining unauthorized access to the victim\u0027s repositories."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:34.037Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9rx3-j5hm-5f27)",
"tags": [
"third-party-advisory",
"vendor-advisory"
],
"url": "https://github.com/triggerdotdev/trigger.dev/security/advisories/GHSA-9rx3-j5hm-5f27"
},
{
"name": "linkGitHubAppInstallation performs no ownership check at the last affected release",
"tags": [
"technical-description"
],
"url": "https://github.com/triggerdotdev/trigger.dev/blob/v4.5.16/apps/webapp/app/services/gitHub.server.ts"
},
{
"name": "4.6.0 adds verifyGitHubAppInstallationAccess",
"tags": [
"patch"
],
"url": "https://github.com/triggerdotdev/trigger.dev/blob/v4.6.0/apps/webapp/app/services/gitHub.server.ts#L83-L86"
},
{
"tags": [
"product"
],
"url": "https://github.com/triggerdotdev/trigger.dev"
},
{
"name": "VulnCheck Advisory: Trigger.dev before 4.6.0 GitHub App Installation Takeover",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/trigger-dev-before-4.6.0-github-app-installation-takeover"
}
],
"title": "Trigger.dev before 4.6.0 GitHub App Installation Takeover",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92773",
"datePublished": "2026-09-16T20:32:34.037Z",
"dateReserved": "2026-09-16T19:15:39.366Z",
"dateUpdated": "2026-09-17T19:25:13.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92765 (GCVE-0-2026-92765)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-17 15:01
VLAI
EPSS
VEX
Title
ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList
Summary
ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles, severities, statuses, and analyst notes from other tenants.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 15:01 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/archerysec/archerysec/issues/676 | issue-tracking |
| https://github.com/archerysec/archerysec | product |
| https://github.com/archerysec/archerysec/blob/v2.… | technical-description |
| https://www.vulncheck.com/advisories/archerysec-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| archerysec | archerysec |
Affected:
0 , ≤ 2.0.6
(semver)
cpe:2.3:a:archerysec:archery:*:*:*:*:*:*:*:* |
Date Public
2026-06-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92765",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T15:01:33.865944Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T15:01:46.321Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/archerysec/archerysec/issues/676"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "archerysec",
"vendor": "archerysec",
"versions": [
{
"lessThanOrEqual": "2.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:archerysec:archery:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles, severities, statuses, and analyst notes from other tenants."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:31.272Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #676",
"tags": [
"issue-tracking"
],
"url": "https://github.com/archerysec/archerysec/issues/676"
},
{
"tags": [
"product"
],
"url": "https://github.com/archerysec/archerysec"
},
{
"name": "WebScanVulnList filters on scan_id with no organization predicate",
"tags": [
"technical-description"
],
"url": "https://github.com/archerysec/archerysec/blob/v2.0.6/webscanners/views.py#L297-L313"
},
{
"name": "VulnCheck Advisory: ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/archerysec-through-2.0.6-information-disclosure-via-webscanvulnlist"
}
],
"title": "ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92765",
"datePublished": "2026-09-16T20:32:31.272Z",
"dateReserved": "2026-09-16T19:06:21.964Z",
"dateUpdated": "2026-09-17T15:01:46.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92752 (GCVE-0-2026-92752)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
VLAI
EPSS
VEX
Title
metasfresh Unauthorized Access via Document Attachments and Comments Endpoints
Summary
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/metasfresh/metasfresh/issues/24665 | issue-tracking |
| https://github.com/metasfresh/metasfresh | product |
| https://github.com/metasfresh/metasfresh/blob/c4c… | technical-description |
| https://github.com/metasfresh/metasfresh/blob/c4c… | technical-description |
| https://www.vulncheck.com/advisories/metasfresh-u… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| metasfresh | metasfresh |
Affected:
c4c7766ef403eb470c9130031cf24cc33625ceed
(git)
|
Date Public
2026-06-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "metasfresh",
"vendor": "metasfresh",
"versions": [
{
"status": "affected",
"version": "c4c7766ef403eb470c9130031cf24cc33625ceed",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:24.865Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #24665",
"tags": [
"issue-tracking"
],
"url": "https://github.com/metasfresh/metasfresh/issues/24665"
},
{
"tags": [
"product"
],
"url": "https://github.com/metasfresh/metasfresh"
},
{
"name": "attachment endpoints stop at assertLoggedIn with no record-level check",
"tags": [
"technical-description"
],
"url": "https://github.com/metasfresh/metasfresh/blob/c4c7766ef403eb470c9130031cf24cc33625ceed/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/attachments/DocumentAttachmentsRestController.java#L63-L225"
},
{
"name": "ImageRestController applies the checkCanView guard the attachment controller omits",
"tags": [
"technical-description"
],
"url": "https://github.com/metasfresh/metasfresh/blob/c4c7766ef403eb470c9130031cf24cc33625ceed/backend/de.metas.ui.web.base/src/main/java/de/metas/ui/web/upload/ImageRestController.java#L100-L107"
},
{
"name": "VulnCheck Advisory: metasfresh Unauthorized Access via Document Attachments and Comments Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/metasfresh-unauthorized-access-via-document-attachments-and-comments-endpoints"
}
],
"title": "metasfresh Unauthorized Access via Document Attachments and Comments Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92752",
"datePublished": "2026-09-16T20:32:24.865Z",
"dateReserved": "2026-09-16T18:57:08.498Z",
"dateUpdated": "2026-09-16T20:32:24.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.