CWE-639

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1219",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-20T20:37:24.748298Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-20T20:37:50.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MP3 Audio Player \u2013 Music Player, Podcast Player \u0026 Radio by Sonaar",
          "vendor": "sonaar",
          "versions": [
            {
              "lessThanOrEqual": "5.10",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kenneth Dunn"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The MP3 Audio Player \u2013 Music Player, Podcast Player \u0026 Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the \u0027load_track_note_ajax\u0027 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T09:26:36.530Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce8fa964-d543-4d46-a534-e403dff4f425?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/sonaar-music.php#L179"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mp3-music-player-by-sonaar/tags/5.10/public/class-sonaar-music-public.php#L323"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3453076/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-02-18T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "MP3 Audio Player \u2013 Music Player, Podcast Player \u0026 Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-1219",
    "datePublished": "2026-02-19T09:26:36.530Z",
    "dateReserved": "2026-01-20T01:27:06.784Z",
    "dateUpdated": "2026-02-20T20:37:50.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-27T20:48:09.831629Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-27T20:48:18.851Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "askbot",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux"
          ],
          "product": "askbot",
          "vendor": "askbot",
          "versions": [
            {
              "status": "affected",
              "version": "0.12.2"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:askbot:askbot:0.12.2:*:windows:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:askbot:askbot:0.12.2:*:macos:*:*:*:*:*",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:askbot:askbot:0.12.2:*:linux:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Daniel Celis"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAll versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.\u003c/span\u003e\u003cp\u003eThis issue affects askbot: 0.12.2.\u003c/p\u003e"
            }
          ],
          "value": "All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-27T14:04:18.274Z",
        "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
        "shortName": "Fluid Attacks"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://fluidattacks.com/advisories/ghost"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://askbot.com/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ASKBOT/askbot-devel/commit/3da3d75f35204aa71633c7a315327ba39cb6295d"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Askbot 0.12.2 - Insecure Direct Object Reference (IDOR)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
    "assignerShortName": "Fluid Attacks",
    "cveId": "CVE-2026-1213",
    "datePublished": "2026-01-27T14:04:18.274Z",
    "dateReserved": "2026-01-19T21:32:48.977Z",
    "dateUpdated": "2026-01-27T20:48:18.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1206",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-26T17:35:55.831733Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-26T17:51:15.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Elementor Website Builder \u2013 more than just a page builder",
          "vendor": "elemntor",
          "versions": [
            {
              "lessThanOrEqual": "3.35.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Angus Girvan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and including, 3.35.7. This is due to a logic error in the is_allowed_to_read_template() function permission check that treats non-published templates as readable without verifying edit capabilities. This makes it possible for authenticated attackers, with contributor-level access and above, to read private or draft Elementor template content via the \u0027template_id\u0027 supplied to the \u0027get_template_data\u0027 action of the \u0027elementor_ajax\u0027 endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:12:59.673Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a4420935-4952-4460-afc2-1c6df6965b3d?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3489160/elementor/trunk/includes/template-library/sources/local.php?old=3473768\u0026old_path=elementor%2Ftrunk%2Fincludes%2Ftemplate-library%2Fsources%2Flocal.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-19T16:18:39.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-25T17:26:49.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Elementor Website Builder \u003c= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-1206",
    "datePublished": "2026-03-26T05:29:33.177Z",
    "dateReserved": "2026-01-19T16:01:46.785Z",
    "dateUpdated": "2026-04-08T17:12:59.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-23T20:12:37.957880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-23T20:12:48.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Elevation C3",
          "vendor": "Hubitat",
          "versions": [
            {
              "lessThan": "2.4.2.157",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Elevation C4",
          "vendor": "Hubitat",
          "versions": [
            {
              "lessThan": "2.4.2.157",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Elevation C5",
          "vendor": "Hubitat",
          "versions": [
            {
              "lessThan": "2.4.2.157",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Elevation C7",
          "vendor": "Hubitat",
          "versions": [
            {
              "lessThan": "2.4.2.157",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Elevation C8",
          "vendor": "Hubitat",
          "versions": [
            {
              "lessThan": "2.4.2.157",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Elevation C8 pro",
          "vendor": "Hubitat",
          "versions": [
            {
              "lessThan": "2.4.2.157",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aaron \u0027theHastyOne\u0027 Hasty of Ostrich Lab reported this vulnerability to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated user to control connected devices outside of their authorized scope via client-side request manipulation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-29T16:51:31.043Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-022-06"
        },
        {
          "tags": [
            "technical-description",
            "related"
          ],
          "url": "https://ostrichlab.io/research-blog/?post=hubitat_writeup"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Hubitat has released the following for users to implement:\u003cbr\u003e\u003cbr\u003e* Firmware version [2.4.2.157](\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://community.hubitat.com/t/release-2-4-2-available/154531/10\"\u003ehttps://community.hubitat.com/t/release-2-4-2-available/154531/10\u003c/a\u003e)\u003cbr\u003e"
            }
          ],
          "value": "Hubitat has released the following for users to implement:\n\n* Firmware version [2.4.2.157]( https://community.hubitat.com/t/release-2-4-2-available/154531/10 )"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2026-1201",
    "datePublished": "2026-01-22T21:52:01.011Z",
    "dateReserved": "2026-01-19T14:29:21.551Z",
    "dateUpdated": "2026-01-29T16:51:31.043Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1080",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-11T15:35:19.935747Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-11T15:35:58.862Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "GitLab",
          "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
          "vendor": "GitLab",
          "versions": [
            {
              "lessThan": "18.6.6",
              "status": "affected",
              "version": "16.7",
              "versionType": "semver"
            },
            {
              "lessThan": "18.7.4",
              "status": "affected",
              "version": "18.7",
              "versionType": "semver"
            },
            {
              "lessThan": "18.8.4",
              "status": "affected",
              "version": "18.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thanks [go7f0](https://hackerone.com/go7f0) for reporting this vulnerability through our HackerOne bug bounty program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to access iteration data from private descendant groups by querying the iterations API endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-11T11:33:41.565Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "name": "GitLab Issue #586477",
          "tags": [
            "issue-tracking",
            "permissions-required"
          ],
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/586477"
        },
        {
          "name": "HackerOne Bug Bounty Report #3484568",
          "tags": [
            "technical-description",
            "exploit",
            "permissions-required"
          ],
          "url": "https://hackerone.com/reports/3484568"
        },
        {
          "url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to versions 18.6.6, 18.7.4, 18.8.4 or above."
        }
      ],
      "title": "Authorization Bypass Through User-Controlled Key in GitLab"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-1080",
    "datePublished": "2026-02-11T11:33:41.565Z",
    "dateReserved": "2026-01-16T20:34:06.208Z",
    "dateUpdated": "2026-02-11T15:35:58.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T20:49:24.250071Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T20:49:29.949Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP ULike \u2013 Like \u0026 Dislike Buttons for Engagement and Feedback",
          "vendor": "alimir",
          "versions": [
            {
              "lessThanOrEqual": "4.8.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pouria Shahba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is due to the `wp_ulike_delete_history_api` AJAX action not verifying that the log entry being deleted belongs to the current user. This makes it possible for authenticated attackers, with Subscriber-level access and above (granted the \u0027stats\u0027 capability is assigned to their role), to delete arbitrary log entries belonging to other users via the \u0027id\u0027 parameter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:19:20.969Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bee2e520-46cc-4b54-9849-fafb9b37ba19?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ulike/trunk/admin/admin-ajax.php#L94"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ulike/tags/4.8.3.1/admin/admin-ajax.php#L94"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3451296/wp-ulike/trunk/admin/admin-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-21T11:22:41.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-02-02T14:51:27.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP ULike \u003c= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via \u0027id\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-0909",
    "datePublished": "2026-02-03T03:24:35.125Z",
    "dateReserved": "2026-01-13T18:21:37.374Z",
    "dateUpdated": "2026-04-08T17:19:20.969Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "(open-source design and prototyping platform, Kaleidos)",
          "vendor": "Penpot",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Louis Sanchez via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Posting this as an update rather than a first disclosure. The advisory\nwent public on 2026-08-04 with no vendor fix. Penpot has shipped two\nreleases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on\n2026-08-27 -- and I re-checked the code this morning: the missing\npermission check is still missing in both, and in every release before\nthem. It was fixed on develop the day after this advisory went public.\nThat fix has never shipped. Anyone running a released version of\nself-hosted Penpot should know that, so here is the whole thing in one\nmessage.\n\n\nSUMMARY\n=======\n\nPenpot\u0027s file-import RPC command takes an optional caller-supplied\nfile-id, meaning \"import into this existing file instead of creating a\nnew one.\" The handler checks that the caller may edit the project they\nnamed -- a project they own, since they supplied it. It never checks\nthat the file-id they supplied belongs to them.\n\nSo any authenticated user can point that parameter at any file on the\ninstance and overwrite it. The same operation also re-parents the file\ninto the attacker\u0027s project, which is the part that matters: the\nattacker does not merely destroy the victim\u0027s design, they end up owning\nit. On a default install with open self-registration, the attacker needs\nno prior relationship to the target at all.\n\n\nAFFECTED\n========\n\nProduct:  Penpot (open-source design and prototyping platform, Kaleidos)\nAffected: 1.20 through 2.17.2, self-hosted Community Edition and\n          Penpot Cloud. The in-place file-id parameter was introduced in\n          1.20 -- the handler\u0027s own ::doc/changes metadata records\n          \"1.20  Add file-id param for in-place import\". The CVE record\n          was updated 2026-08-27 to state the range as 1.20 through\n          2.17.1, the same day 2.17.2 shipped; 2.17.2 is also affected\n          and is not yet reflected in the record.\nFixed in: nothing released. Fixed on develop, unreleased, since\n          2026-08-05, and present in the 2.18.0 release-candidate line.\n          Never backported to a 2.17.x release.\n\nCVE-2026-17613, assigned by CERT/CC as CNA, record state PUBLISHED.\nCWE-639 (Authorization Bypass Through User-Controlled Key), CWE-862\n(Missing Authorization).\n\n\nSTILL UNPATCHED IN EVERY RELEASE -- FIXED ON DEVELOP, NOT SHIPPED\n=================================================================\n\nThe published advisory last verified the flaw at develop HEAD on\n2026-07-27. Penpot has released 2.17.1 and 2.17.2 since then\n(2026-08-17 and 2026-08-27), and 2.17.0 shortly before it (2026-07-22).\nNone of the three fixes it. Verified today, 2026-09-10:\n\n  backend/src/app/rpc/commands/binfile.clj @ tag 2.17.2\n\n    line  78  (files/check-read-permissions! pool profile-id file-id)\n              -- export path, correct check, present\n    line 153  (projects/check-edition-permissions! pool profile-id project-id)\n              -- import path, checks only the caller\u0027s own project\n    line 160  (uuid? file-id)\n    line 161  (assoc ::bfc/file-id file-id)\n              -- import path, the supplied file-id bound unchecked\n\n  same file @ develop 37dab75e (2026-09-10T18:29:44Z)\n\n    line  88  (files/check-read-permissions! cfg profile-id file-id)\n              -- export path, correct check, present\n    line 166  (projects/check-edition-permissions! pool profile-id project-id)\n              -- import path; file-id is no longer a parameter here at\n                 all, so there is nothing left to check\n\nThe fix exists. It just has not shipped. The day after this advisory\nwent public, commit 9242556d landed on develop and removed file-id from\nimport-binfile outright -- gone from the schema, from the handler\u0027s\ndestructuring, and from the audit props. Commit message: \":bug: Close\nimport-binfile schema and remove file-id parameter (#10994)\". The same\nchange is in the current 2.18.0 release-candidate line (2.18.0-RC5). It\nhas never been backported to a 2.17.x release.\n\nThe 2.17.2 release notes list three bug fixes, one of them a different\nsecurity fix (an SVG-exporter command-injection bug, per the vendor\u0027s\nown changelog) -- so the vendor does put security fixes in this line\nwhen it chooses to. This one is not among them. The code above is\nbyte-identical to 2.17.0 (2026-07-22) and 2.17.1 (2026-08-17) -- the\nsame three call sites, the same line numbers, across the last three\nreleases. I am not going to guess why -- I am saying that today, 105\ndays after the report, nobody running a released version of Penpot has\nthe fix that has sat on develop, unreleased, for 36 days.\n\n\nROOT CAUSE\n==========\n\nWhat makes this one worth reading is that the correct check is in the\nsame source file, about seventy lines away, on the other direction of\nthe same feature.\n\nexport-binfile validates read permission on its file-id before handing\nanything back:\n\n  (sv/defmethod ::export-binfile\n    ...\n    [{:keys [::db/pool] :as cfg}\n     {:keys [::rpc/profile-id file-id] :as params}]\n    (files/check-read-permissions! pool profile-id file-id)   ; \u003c-- yes\n    (sse/response (partial export-binfile cfg params)))\n\nimport-binfile validates the caller\u0027s project and then binds the\ncaller\u0027s file-id straight through:\n\n  (sv/defmethod ::import-binfile\n    ...\n    [{:keys [::db/pool] :as cfg}\n     {:keys [::rpc/profile-id project-id version file-id upload-id]\n      :as params}]\n    (projects/check-edition-permissions! pool profile-id project-id)\n    (let [...\n          cfg (cond-\u003e cfg\n                (uuid? file-id)\n                (assoc ::bfc/file-id file-id))]   ; \u003c-- no check\n      ...))\n\nThe permission function exists. It is already imported. It is used\ncorrectly a few dozen lines up. The import path just does not call it.\n\nDownstream, the in-place import fetches the target file by id alone with\nno ownership predicate on the query, enables overwrite mode, writes the\nattacker\u0027s content into the victim\u0027s file row, and sets that row\u0027s\nproject to the attacker\u0027s project. The final update is keyed only on the\nattacker-supplied file id.\n\n\nEXPLOITATION\n============\n\nPrerequisite: any authenticated account with a project of its own. On a\ndefault install, self-register.\n\n  POST /api/rpc/command/import-binfile\n  Cookie: \u003cattacker session\u003e\n  Content-Type: multipart/form-data\n\n    project-id = \u003ca project the attacker owns\u003e   ; checked\n    file-id    = \u003cthe victim\u0027s file\u003e             ; NOT checked\n    file       = \u003ca valid single-file .penpot archive\u003e\n\nThe obvious objection is that file ids are random UUIDs, so how do you\naim it. In practice they leak through entirely normal use, and two of\nthe three routes require no mistake by the victim:\n\n  1. Public share links. Clicking Share produces a URL with the file id\n     in it in plaintext. People send those to clients and contractors\n     all day. Whoever holds the link holds the targeting data.\n\n  2. Shared-library enumeration. Any user who has ever linked a shared\n     design-system library can read that library\u0027s file id from an\n     ordinary library-listing call. No error, no audit trail. This is\n     the route that reaches an entire organisation\u0027s design system\n     rather than one file.\n\n  3. Workspace and viewer URLs embed the file id, so it turns up in\n     screenshots, support tickets, Slack pastes and screen shares.\n\nOn attack complexity, since it came up during coordination: AC:H is\nmeant for conditions the attacker cannot arrange unilaterally. Receiving\na share link and listing shared libraries are ordinary actions any\naccount can take on its own. Complexity stays Low.\n\n\nIMPACT\n======\n\n  - Data destruction. The victim\u0027s file contents are replaced with the\n    attacker\u0027s.\n\n  - Persistent takeover. Penpot resolves file permissions by walking\n    file -\u003e project -\u003e team. Re-parenting rewrites that lineage, so the\n    attacker becomes the legitimate owner in the eyes of every other\n    endpoint, free to open, edit, export, duplicate and re-share the\n    victim\u0027s design. The file vanishes from the victim\u0027s project. They\n    cannot reach it to attempt a restore.\n\n  - Library poisoning. If the hijacked file was a shared design library,\n    every file in every other team that syncs from it starts pulling\n    attacker-controlled components, colours and typography.\n\n  - Cross-team scope. The attacker holds no authorisation on the\n    victim\u0027s team. The operation moves a resource out of that boundary\n    entirely.\n\nDesign files are not low-value data. One file can hold an unreleased\nproduct\u0027s whole interface, pre-launch brand and marketing assets, or\nmockups carrying real customer names in placeholder text. Agencies\nroutinely run one instance with a team per client and rely on team\nseparation to keep those clients confidential from each other. That\nassumption does not currently hold.\n\nThe original report also bundled a lower-severity issue with the same\nroot pattern: the realtime WebSocket channel lets a client subscribe to\na file or team topic using a client-supplied id with no permission\ncheck, allowing live exfiltration of collaborative edits and\nshared-library changes for any file whose id you know. Same mistake --\ntrusting a client-supplied identifier without re-checking it. One\ndisciplined patch closes both.\n\n\nON THE SCORE\n============\n\nThe CVE record carries 7.5 High:\n\n  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\nThat is also the number on my own advisory. I publish the assigned score\nrather than mine, because the CVE record is what the ecosystem actually\nconsumes and a mismatched headline number reads as inflation. It is also\nthe number I disagree with, and I would rather argue that in the open\nthan quietly ship a different one.\n\nC:N/I:N describes the vulnerable endpoint honestly enough if you read\nthe operation as \"the victim\u0027s file is destroyed.\" But the file is not\ndestroyed. It is moved, intact, into the attacker\u0027s project, where they\ncan read and export it. That is a confidentiality loss. Its contents are\nthen attacker-controlled, and if it was a shared library that content\npropagates into other teams\u0027 files. That is an integrity loss with a\nblast radius past the original resource. Scoring it A:H only measures\nwhat the victim stopped having, not what the attacker started having.\n\nS:U has the same problem. The operation carries a resource across a team\nboundary the attacker was never authorised for; calling that scope\nunchanged treats Penpot\u0027s file store as one undifferentiated pool, which\nis precisely the assumption the product\u0027s team model tells customers is\nfalse.\n\nMy pre-assignment score was 9.9. Take that as one researcher\u0027s read, not\nas a correction to the record -- but if you are triaging this from the\n7.5 alone, triage the impact section above instead. Worth more than\neither number for that purpose: the CISA ADP Vulnrichment enrichment on\nthe same record carries an SSVC assessment of exploitation\nproof-of-concept, technical impact partial, automatable yes. I wrote the\ngeneral version of this argument up here, alongside the same pattern in\nCVE-2026-16751:\n\n  https://vokecyber.com/blog/when-cvss-scores-the-endpoint-not-the-loss\n\n\nMITIGATIONS\n===========\n\nNo fixed release to upgrade to, so, in order of value:\n\n  1. Disable open self-registration. Does not fix the bug. Removes the\n     sign-up-and-attack path and takes the score to 6.5, since the\n     attacker then needs an account somebody gave them.\n\n  2. Treat every account on the instance as having write access to every\n     file on it, and plan accordingly. If you rely on team separation\n     for client confidentiality, consider separate instances for\n     genuinely sensitive work until this is fixed.\n\n  3. Audit for prior exploitation. Look for file rows whose owning\n     project changed with no corresponding user action, and for edits\n     written by a profile that is not a member of the file\u0027s team. An\n     in-place import does not leave a normal change row behind, so the\n     signal to chase is a file whose project lineage no longer matches\n     the accounts that historically edited it.\n\n  4. Keep backups outs"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/47"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/47"
        },
        {
          "url": "https://github.com/penpot/penpot"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://penpot.app/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://vokecyber.com"
        },
        {
          "url": "https://vokecyber.com/blog/cve-2026-17613-penpot-cross-team-file-takeover"
        },
        {
          "url": "https://vokecyber.com/blog/when-cvss-scores-the-endpoint-not-the-loss"
        },
        {
          "url": "https://vokecyber.com/research"
        },
        {
          "url": "https://vokecyber.com/research/cve-2026-17613-penpot-cross-team-file-takeover"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-17613"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/47"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-17613: Penpot cross-team file takeover via import-binfile (unpatched in 2.17.2)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-16751",
              "type": "related"
            },
            {
              "destId": "CVE-2026-17613",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0413",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/47",
            "automated": true,
            "contentSha256": "dfb7136b474f69e1d616f18aaa2b95b5cb066a235d2de07ebdadf391f9cd9332",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/47",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-11T02:20:54Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0413"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:32Z",
    "dateUpdated": "2026-10-02T04:57:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0413"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCORM Lab Launch Integration",
          "vendor": "Skillable",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skillable\u0027s SCORM lab launch endpoint validates a launch token but\nenforces per-user allocation limits using a browser-supplied userId\nthat is not bound to the validated token. An authenticated learner\ncan modify this identifier to bypass configured limits, launch\nconcurrent lab instances, and consume another learner\u0027s allocation.\nSkillable states that no fix is planned for the legacy SCORM launch\npath. CVE-2026-56877 was assigned by MITRE.\n\n\n1. Advisory information\n-----------------------\nTitle: CVE-2026-56877 - Skillable SCORM userId authorisation\nbypass\nAdvisory: https://github.com/GregDurys/security-advisories/tree/main/skillable\nCVE: CVE-2026-56877 (assigned; record publication pending)\nClass: CWE-639 (Authorization Bypass Through User-Controlled Key)\nCVSS: 6.5 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\nDate: 2026-07-12\nAuthor: Greg Durys \u003chttps://payloadforge.io\u003e\n\n\n2. Affected software\n--------------------\nVendor: Skillable (formerly Learn on Demand Systems)\nService: Hosted SCORM lab provisioning (cloud service, no\non-premises deployment)\nEndpoint: scorm.skillable.com/scorm/launch\nTested: 2026-04-28 to 2026-05-03 (production endpoint, via the\nRed Team Ops course on the Zero Point Security platform)\nFix: None. The vendor states that no server-side identity\nvalidation will be added to the SCORM launch path.\nRemediation is migration to an API or LTI 1.3 launch\nintegration.\n\n\n3. Testing scope\n----------------\nAll validation was performed within a normal student workflow on\nthe Red Team Ops course. The bypass and the cross-user denial of\nservice were confirmed against the production endpoint. The\ncertification exam endpoint was not tested; Skillable subsequently\nconfirmed to an affected customer that the same weakness could\naffect exam allocations and could return details associated with\nanother learner\u0027s session.\n\n\n4. Summary\n----------\nThe SCORM launch request is assembled and initiated client-side.\nLoading a lab unit builds a launch URL and requests it from\nscorm.skillable.com with a SCORM token and userId as query\nparameters. Skillable validates the token sufficiently to authorise\nthe launch, then evaluates the per-user launch limit against the\nsupplied userId. The token is server-validated, while the userId is\nclient-controlled,\nand no binding between the two is enforced.\n\nThe userId accepts arbitrary strings with no format validation.\nValues with a non-hexadecimal character in an otherwise\nexpected-length identifier, and entirely fabricated structures, were\nboth accepted and provisioned lab instances. The same SCORM token\nlaunches labs under different userId values, demonstrating that the token does not bind the launch to the\nsupplied userId. The token remained unchanged\nacross the tested launches, indicating that it did not provide a\nuser-specific binding to the supplied userId.\n\n(a) Rate-limit bypass. Launching with a modified userId bypassed the\nper-user limit and provisioned a fresh LabInstanceId. Two\nconcurrent instances under different userId values were confirmed.\n\n(b) Cross-user denial of service. A consenting colleague\u0027s userId\nwas obtained through an authenticated learner enumeration vector\non the LMS. A lab launched under that userId consumed the\ncolleague\u0027s allocation. The colleague then attempted to launch\nthe same lab and was locked out, while other labs launched\nnormally.\n\n(c) Cost. Each instance provisions cloud VMs (typically a domain\ncontroller plus one to three machines, active 30 to 60 minutes)\nat the course provider\u0027s expense. An authenticated learner\nenumeration vector on the LMS would scale any of the above\nacross the enumerable enrolled population.\n\n\n5. Remediation\n--------------\nBind the launch to a server-validated learner identity, for example\nthrough a user-scoped signed token or server-to-server integration.\nDo not enforce per-user limits using an unverified browser-supplied\nuserId. Skillable states that it will not add this binding to the\nlegacy SCORM path and recommends migration to its API or LTI 1.3\nintegration.\n\n\n6. Disclosure timeline\n----------------------\n2026-04-28 Per-user rate-limit error observed; userId modification\nreturned a new LabInstanceId\n2026-04-29 Concurrent lab instances confirmed against a single\naccount\n2026-05-03 Cross-user denial of service confirmed with a consenting\nfellow student\n2026-05-08 Findings documented; Skillable support ticket #4043837\nraised; disclosure channel provided\n2026-05-11 Report submitted to Disclosures () skillable com (encrypted\narchive)\n2026-05-13 Skillable acknowledged receipt (Nat Shere, Manager,\nProduct Security)\n2026-05-19 CVE request submitted to MITRE (Skillable is not a CNA)\n2026-05-27 Status request to Skillable; no response\n2026-06-08 Second follow-up, restating the 60-day disclosure window\n(closing 2026-07-12)\n2026-06-10 Skillable responded that the issue is \"an inherent flaw\nin the SCORM technology\" and requested no disclosure\nwithout written permission\n2026-06-10 Pushback sent; open-ended embargo declined; 2026-07-12\ndate held\n2026-06-23 MITRE assigned CVE-2026-56877; coordinated disclosure\nremained under embargo until 2026-07-12\n2026-06-26 Skillable sent at least one affected customer an\nadvisory (\"SCORM-based lab launches and recommended\nmigration\"; no CVE, no CVSS), stating no server-side\nfix and recommending migration\n2026-06-26 Coordination update sent to Skillable\n2026-07-12 Advisory published\n\n\n7. Current status\n-----------------\nVendor fix: The vendor states that no fix is planned for\nthe SCORM launch path\nVendor remediation: Migration to an API or LTI 1.3 launch\nintegration\nCustomer communication: Sent to at least one affected customer on\n2026-06-26 (private notification, no CVE,\nno CVSS)\nCVE: CVE-2026-56877, assigned by the MITRE CNA of\nLast Resort\n\n\n8. References\n-------------\n- https://github.com/GregDurys/security-advisories/tree/main/skillable\n- https://www.cve.org/CVERecord?id=CVE-2026-56877\n- https://cwe.mitre.org/data/definitions/639.html\n- https://payloadforge.io/beyond-crto-skillable\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/20"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "url": "https://github.com/GregDurys/security-advisories/tree/main/skillable"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://payloadforge.io"
        },
        {
          "url": "https://payloadforge.io/beyond-crto-skillable"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56877"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-56877 - Skillable SCORM userId authorisation bypass",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-56877",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0352",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20",
            "automated": true,
            "contentSha256": "585ca0c01365cf23961b9778b1126c606d723ea93385ebcf493a309fcfb6de37",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-12T10:19:54Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0352"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:57Z",
    "dateUpdated": "2026-09-11T07:55:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0352"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Revive Adserver Vulnerabilities",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matteo Beccati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "========================================================================\nRevive Adserver Security Advisory                     REVIVE-SA-2026-001\n------------------------------------------------------------------------\nhttps://www.revive-adserver.com/security/revive-sa-2026-001\n------------------------------------------------------------------------\nDate:                  2026-01-14\nRisk Level:            High\nApplications affected: Revive Adserver\nVersions affected:     \u003c= 6.0.4\nVersions not affected: \u003e= 6.0.5\nWebsite:               https://www.revive-adserver.com/\n========================================================================\n\n\n========================================================================\nVulnerability 1: Format string injection\n========================================================================\nVulnerability Type:    Use of Externally-Controlled Format String\n                       [CWE-134]\nCVE-ID:                CVE-2026-21640\nRisk level:            Low\nCVSS Base Score:       2.7\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3445332\nhttps://github.com/revive-adserver/revive-adserver/commit/c40187d8\nhttps://cwe.mitre.org/data/definitions/134.html\n\n\n========================================================================\nVulnerability 2: Authorization Bypass\n========================================================================\nVulnerability Type:    Authorization Bypass Through User-Controlled Key\n                       [CWE-639]\nCVE-ID:                CVE-2026-21641\nRisk level:            High\nCVSS Base Score:       7.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3445710\nhttps://github.com/revive-adserver/revive-adserver/commit/f6059335\nhttps://cwe.mitre.org/data/definitions/639.html\n\n\n========================================================================\nVulnerability 3: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21642\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3470970\nhttps://github.com/revive-adserver/revive-adserver/commit/e245a88\nhttps://github.com/revive-adserver/revive-adserver/commit/0ebc96d\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nVulnerability 4: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21663\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3473696\nhttps://github.com/revive-adserver/revive-adserver/commit/c130eb0\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nVulnerability 5: Reflected XSS\n========================================================================\nVulnerability Type:    Improper Neutralization of Input During Web Page\n                       Generation (\u2018Cross-site Scripting\u2019) [CWE-79]\nCVE-ID:                CVE-2026-21664\nRisk level:            Medium\nCVSS Base Score:       6.1\nCVSS Vector:           CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n========================================================================\n\nDescription\n-----------\n\n\nDetails\n-------\n\n\nReferences\n----------\nhttps://hackerone.com/reports/3468169\nhttps://github.com/revive-adserver/revive-adserver/commit/e88e9ed\nhttps://github.com/revive-adserver/revive-adserver/commit/7a99f69\nhttps://cwe.mitre.org/data/definitions/79.html\n\n\n========================================================================\nSolution\n========================================================================\n\n\n\n\n========================================================================\nContact Information\n========================================================================\n\nThe security contact for Revive Adserver can be reached at:\n\u003csecurity AT revive-adserver DOT com\u003e.\n\n\n\n\n--\nMatteo Beccati\nOn behalf of the Revive Adserver Team\nhttps://www.revive-adserver.com/\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T07:57:43Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/19"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/134.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/79.html"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/0ebc96d"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/7a99f69"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c130eb0"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/c40187d8"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e245a88"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/e88e9ed"
        },
        {
          "url": "https://github.com/revive-adserver/revive-adserver/commit/f6059335"
        },
        {
          "url": "https://hackerone.com/reports/3445332"
        },
        {
          "url": "https://hackerone.com/reports/3445710"
        },
        {
          "url": "https://hackerone.com/reports/3468169"
        },
        {
          "url": "https://hackerone.com/reports/3470970"
        },
        {
          "url": "https://hackerone.com/reports/3473696"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.revive-adserver.com/"
        },
        {
          "url": "https://www.revive-adserver.com/security/revive-sa-2026-001"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[REVIVE-SA-2026-001] Revive Adserver Vulnerabilities",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-21640",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21641",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21642",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21663",
              "type": "related"
            },
            {
              "destId": "CVE-2026-21664",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0227",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/19",
            "automated": true,
            "contentSha256": "3cc90b37896729de9b4382b0e85f8f06d38ebf529ecfe7b27dd12029dffd23ac",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-14T12:39:23Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0227"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:43Z",
    "dateUpdated": "2026-09-08T07:57:43Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0227"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2026-56877 - Skillable",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Skillable\u0027s SCORM lab launch endpoint validates a launch token but\nenforces per-user allocation limits using a browser-supplied userId\nthat is not bound to the validated token. An authenticated learner\ncan modify this identifier to bypass configured limits, launch\nconcurrent lab instances, and consume another learner\u0027s allocation.\nSkillable states that no fix is planned for the legacy SCORM launch\npath. CVE-2026-56877 was assigned by MITRE.\n\n\n1. Advisory information\n-----------------------\nTitle: CVE-2026-56877 - Skillable SCORM userId authorisation\nbypass\nAdvisory: https://github.com/GregDurys/security-advisories/tree/main/skillable\nCVE: CVE-2026-56877 (assigned; record publication pending)\nClass: CWE-639 (Authorization Bypass Through User-Controlled Key)\nCVSS: 6.5 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\nDate: 2026-07-12\nAuthor: Greg Durys \u003chttps://payloadforge.io\u003e\n\n\n2. Affected software\n--------------------\nVendor: Skillable (formerly Learn on Demand Systems)\nService: Hosted SCORM lab provisioning (cloud service, no\non-premises deployment)\nEndpoint: scorm.skillable.com/scorm/launch\nTested: 2026-04-28 to 2026-05-03 (production endpoint, via the\nRed Team Ops course on the Zero Point Security platform)\nFix: None. The vendor states that no server-side identity\nvalidation will be added to the SCORM launch path.\nRemediation is migration to an API or LTI 1.3 launch\nintegration.\n\n\n3. Testing scope\n----------------\nAll validation was performed within a normal student workflow on\nthe Red Team Ops course. The bypass and the cross-user denial of\nservice were confirmed against the production endpoint. The\ncertification exam endpoint was not tested; Skillable subsequently\nconfirmed to an affected customer that the same weakness could\naffect exam allocations and could return details associated with\nanother learner\u0027s session.\n\n\n4. Summary\n----------\nThe SCORM launch request is assembled and initiated client-side.\nLoading a lab unit builds a launch URL and requests it from\nscorm.skillable.com with a SCORM token and userId as query\nparameters. Skillable validates the token sufficiently to authorise\nthe launch, then evaluates the per-user launch limit against the\nsupplied userId. The token is server-validated, while the userId is\nclient-controlled,\nand no binding between the two is enforced.\n\nThe userId accepts arbitrary strings with no format validation.\nValues with a non-hexadecimal character in an otherwise\nexpected-length identifier, and entirely fabricated structures, were\nboth accepted and provisioned lab instances. The same SCORM token\nlaunches labs under different userId values, demonstrating that the token does not bind the launch to the\nsupplied userId. The token remained unchanged\nacross the tested launches, indicating that it did not provide a\nuser-specific binding to the supplied userId.\n\n(a) Rate-limit bypass. Launching with a modified userId bypassed the\nper-user limit and provisioned a fresh LabInstanceId. Two\nconcurrent instances under different userId values were confirmed.\n\n(b) Cross-user denial of service. A consenting colleague\u0027s userId\nwas obtained through an authenticated learner enumeration vector\non the LMS. A lab launched under that userId consumed the\ncolleague\u0027s allocation. The colleague then attempted to launch\nthe same lab and was locked out, while other labs launched\nnormally.\n\n(c) Cost. Each instance provisions cloud VMs (typically a domain\ncontroller plus one to three machines, active 30 to 60 minutes)\nat the course provider\u0027s expense. An authenticated learner\nenumeration vector on the LMS would scale any of the above\nacross the enumerable enrolled population.\n\n\n5. Remediation\n--------------\nBind the launch to a server-validated learner identity, for example\nthrough a user-scoped signed token or server-to-server integration.\nDo not enforce per-user limits using an unverified browser-supplied\nuserId. Skillable states that it will not add this binding to the\nlegacy SCORM path and recommends migration to its API or LTI 1.3\nintegration.\n\n\n6. Disclosure timeline\n----------------------\n2026-04-28 Per-user rate-limit error observed; userId modification\nreturned a new LabInstanceId\n2026-04-29 Concurrent lab instances confirmed against a single\naccount\n2026-05-03 Cross-user denial of service confirmed with a consenting\nfellow student\n2026-05-08 Findings documented; Skillable support ticket #4043837\nraised; disclosure channel provided\n2026-05-11 Report submitted to Disclosures () skillable com (encrypted\narchive)\n2026-05-13 Skillable acknowledged receipt (Nat Shere, Manager,\nProduct Security)\n2026-05-19 CVE request submitted to MITRE (Skillable is not a CNA)\n2026-05-27 Status request to Skillable; no response\n2026-06-08 Second follow-up, restating the 60-day disclosure window\n(closing 2026-07-12)\n2026-06-10 Skillable responded that the issue is \"an inherent flaw\nin the SCORM technology\" and requested no disclosure\nwithout written permission\n2026-06-10 Pushback sent; open-ended embargo declined; 2026-07-12\ndate held\n2026-06-23 MITRE assigned CVE-2026-56877; coordinated disclosure\nremained under embargo until 2026-07-12\n2026-06-26 Skillable sent at least one affected customer an\nadvisory (\"SCORM-based lab launches and recommended\nmigration\"; no CVE, no CVSS), stating no server-side\nfix and recommending migration\n2026-06-26 Coordination update sent to Skillable\n2026-07-12 Advisory published\n\n\n7. Current status\n-----------------\nVendor fix: The vendor states that no fix is planned for\nthe SCORM launch path\nVendor remediation: Migration to an API or LTI 1.3 launch\nintegration\nCustomer communication: Sent to at least one affected customer on\n2026-06-26 (private notification, no CVE,\nno CVSS)\nCVE: CVE-2026-56877, assigned by the MITRE CNA of\nLast Resort\n\n\n8. References\n-------------\n- https://github.com/GregDurys/security-advisories/tree/main/skillable\n- https://www.cve.org/CVERecord?id=CVE-2026-56877\n- https://cwe.mitre.org/data/definitions/639.html\n- https://payloadforge.io/beyond-crto-skillable\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:10:05Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/20"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/639.html"
        },
        {
          "url": "https://github.com/GregDurys/security-advisories/tree/main/skillable"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://payloadforge.io"
        },
        {
          "url": "https://payloadforge.io/beyond-crto-skillable"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56877"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-56877 - Skillable SCORM userId authorisation bypass",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0097",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/20",
            "automated": true,
            "contentSha256": "585ca0c01365cf23961b9778b1126c606d723ea93385ebcf493a309fcfb6de37",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-12T10:19:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-09T10:10:05Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0097"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}