Vulnerability-Lookup

GHSA-85CG-FG77-RRM5

Vulnerability from github – Published: 2026-07-01 00:34 – Updated: 2026-07-01 00:34

Details

Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users' playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-58447"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T22:16:58Z",
    "severity": "HIGH"
  },
  "details": "Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to delete videos from other users\u0027 playlists by supplying an arbitrary global video index in the remove_video action of the playlist endpoint. Attackers can obtain per-video index values from the public playlist JSON API and submit them to the playlist video deletion endpoint without ownership validation, permanently removing videos from playlists they do not own.",
  "id": "GHSA-85cg-fg77-rrm5",
  "modified": "2026-07-01T00:34:01Z",
  "published": "2026-07-01T00:34:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58447"
    },
    {
      "type": "WEB",
      "url": "https://github.com/iv-org/invidious/issues/5777"
    },
    {
      "type": "WEB",
      "url": "https://github.com/iv-org/invidious/pull/5790"
    },
    {
      "type": "WEB",
      "url": "https://github.com/iv-org/invidious/commit/77ad41678b45c4f6815940123f1796fc51259f45"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/invidious-cross-user-playlist-video-deletion-via-missing-ownership-check"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-862X-3JQQ-F754

Vulnerability from github – Published: 2025-11-11 06:30 – Updated: 2026-04-08 21:33

Details

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-12126"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-11T04:15:46Z",
    "severity": "MODERATE"
  },
  "details": "The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them.",
  "id": "GHSA-862x-3jqq-f754",
  "modified": "2026-04-08T21:33:08Z",
  "published": "2025-11-11T06:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12126"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3392629%40the-total-book-project\u0026new=3392629%40the-total-book-project"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/the-total-book-project"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-864Q-6X2V-WVG4

Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23

Details

An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a different vulnerability than CVE-2019-9732.

Severity

9.8 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-9756"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-17T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a different vulnerability than CVE-2019-9732.",
  "id": "GHSA-864q-6x2v-wvg4",
  "modified": "2022-05-13T01:23:05Z",
  "published": "2022-05-13T01:23:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9756"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/blog/categories/releases"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/54243"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8666-8WPQ-7C9Q

Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-10 15:33

Details

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact's numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user's company.

Severity

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-19433"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-10T15:17:43Z",
    "severity": "HIGH"
  },
  "details": "Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact\u0027s personal data as a vCard via the contact\u0027s numeric identifier, because the save and export operations retrieve the record without constraining the query to the authenticated user\u0027s company.",
  "id": "GHSA-8666-8wpq-7c9q",
  "modified": "2026-08-10T15:33:52Z",
  "published": "2026-08-10T15:33:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19433"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Roskus/prospero-flow-crm/commit/f16b4af2027b17bef7c604c92dbd86cf38082398"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3"
    },
    {
      "type": "WEB",
      "url": "https://secur0.com/en/cna/cve-list/cve-2026-19433-idor-in-prospero-flow-crm-contact-save-and-vcard-export"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-86CX-WWF4-PHQ4

Vulnerability from github – Published: 2026-07-24 22:32 – Updated: 2026-08-18 18:04

Summary

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Details

Summary

An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.

Details

When a user attempts to create or update a file share, the application must verify that the requested file path falls within the user's assigned BasePath. However, in server/handles/sharing.go, this authorization check relies on a simple string prefix function: strings.HasPrefix(requested_path, user.BasePath).

Because strings.HasPrefix does not account for directory separators (e.g., /), an attacker whose BasePath is assigned to /base can supply a target path like /base2/secret_document.txt. The validation strings.HasPrefix("/base2/secret_document.txt", "/base") evaluates to true, successfully passing the authorization filter.

Once the share is created, the public share download/list handlers unwrap and serve the file based on the stored absolute path without re-verifying the creator's current directory scope, granting the attacker horizontal access to unauthorized data.

PoC

Prerequisites: 1. A system with at least two distinct directories at the root level: /base and /base2. 2. A sensitive file exists at /base2/secret.txt. 3. An attacker account with the CanShare permission enabled and its Base path strictly limited to /base.

Exploitation Steps: 1. Log in as the attacker account and obtain the JWT authorization token. 2. Send a POST request to create a new share, intentionally targeting the unauthorized sibling directory /base2:

POST /api/share/create HTTP/1.1
Host: <your-openlist-host>
Authorization: <attacker-jwt-token>
Content-Type: application/json

{
  "files": ["/base2/secret.txt"],
  "pwd": "",
  "max_accessed": 0
}

Observe the bypass: The API accepts the request and responds with a successful share creation message, returning a share_id.

The attacker can now access the public share endpoint (e.g., via the web UI or API /api/fs/list / /sd/<share-id>/...) to download or view /base2/secret.txt, completely bypassing their directory restrictions.

7b0bd29c9d12ad0b7b84a4a156559a5b

90b16bf15b6e8bfb87f16c4ab8864ea7

Impact

This is a High-severity Horizontal and Vertical Privilege Escalation vulnerability. A malicious user with basic sharing privileges can weaponize this path confusion to expose, read, and download any file from other users' directories or internal application paths, provided the target path shares the same string prefix as their own directory. This completely breaks the data isolation guarantees of the application.

Remediation Recommendations

Canonical Path Containment: Replace the raw strings.HasPrefix check with a robust, separator-aware path containment validation. Ensure both paths are normalized, and use logic such as: target == base || strings.HasPrefix(target, base + "/").

Centralized Validation Utility: Implement a dedicated function (e.g., utils.IsSubPath(base, target)) and apply it consistently across share creation, updating, and viewing handlers to prevent regressions.

Credits

Thai Son Dinh from VinSOC Labs (R&D)

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OpenListTeam/OpenList/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:32:37Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn authorization bypass vulnerability exists in the file sharing mechanism of `Openlist`. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.\n\n### Details\nWhen a user attempts to create or update a file share, the application must verify that the requested file path falls within the user\u0027s assigned `BasePath`. However, in `server/handles/sharing.go`, this authorization check relies on a simple string prefix function: `strings.HasPrefix(requested_path, user.BasePath)`.\n\nBecause `strings.HasPrefix` does not account for directory separators (e.g., `/`), an attacker whose `BasePath` is assigned to `/base` can supply a target path like `/base2/secret_document.txt`. The validation `strings.HasPrefix(\"/base2/secret_document.txt\", \"/base\")` evaluates to `true`, successfully passing the authorization filter. \n\nOnce the share is created, the public share download/list handlers unwrap and serve the file based on the stored absolute path without re-verifying the creator\u0027s current directory scope, granting the attacker horizontal access to unauthorized data.\n\n### PoC\n**Prerequisites:**\n1. A system with at least two distinct directories at the root level: `/base` and `/base2`.\n2. A sensitive file exists at `/base2/secret.txt`.\n3. An attacker account with the `CanShare` permission enabled and its `Base path` strictly limited to `/base`.\n\n**Exploitation Steps:**\n1. Log in as the attacker account and obtain the JWT authorization token.\n2. Send a `POST` request to create a new share, intentionally targeting the unauthorized sibling directory `/base2`:\n\n```http\nPOST /api/share/create HTTP/1.1\nHost: \u003cyour-openlist-host\u003e\nAuthorization: \u003cattacker-jwt-token\u003e\nContent-Type: application/json\n\n{\n  \"files\": [\"/base2/secret.txt\"],\n  \"pwd\": \"\",\n  \"max_accessed\": 0\n}\n```\nObserve the bypass: The API accepts the request and responds with a successful share creation message, returning a `share_id`.\n\nThe attacker can now access the public share endpoint (e.g., via the web UI or API `/api/fs/list` / `/sd/\u003cshare-id\u003e/...`) to download or view `/base2/secret.txt`, completely bypassing their directory restrictions.\n\n\u003cimg width=\"2457\" height=\"1307\" alt=\"7b0bd29c9d12ad0b7b84a4a156559a5b\" src=\"https://github.com/user-attachments/assets/415e4915-dbc2-4738-8c53-8174998b42a9\" /\u003e\n\n\u003cimg width=\"1937\" height=\"856\" alt=\"90b16bf15b6e8bfb87f16c4ab8864ea7\" src=\"https://github.com/user-attachments/assets/8dc5205e-2ac6-4f4f-9d40-e1e9d72229d5\" /\u003e\n\n### Impact\nThis is a High-severity Horizontal and Vertical Privilege Escalation vulnerability. A malicious user with basic sharing privileges can weaponize this path confusion to expose, read, and download any file from other users\u0027 directories or internal application paths, provided the target path shares the same string prefix as their own directory. This completely breaks the data isolation guarantees of the application.\n\n### Remediation Recommendations\nCanonical Path Containment: Replace the raw `strings.HasPrefix` check with a robust, separator-aware path containment validation. Ensure both paths are normalized, and use logic such as: `target == base || strings.HasPrefix(target, base + \"/\")`.\n\nCentralized Validation Utility: Implement a dedicated function (e.g., `utils.IsSubPath(base, target)`) and apply it consistently across share creation, updating, and viewing handlers to prevent regressions.\n\n### Credits\n- Thai Son Dinh from VinSOC Labs (R\u0026D)",
  "id": "GHSA-86cx-wwf4-phq4",
  "modified": "2026-08-18T18:04:49Z",
  "published": "2026-07-24T22:32:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-86cx-wwf4-phq4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenListTeam/OpenList"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API"
}

GHSA-86JQ-PWGX-6VRQ

Vulnerability from github – Published: 2023-03-17 12:30 – Updated: 2023-03-23 18:20

Summary

Improper Authorization in nilsteampassnet/teampass

Details

Improper Authorization in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "nilsteampassnet/teampass"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-1463"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-17T18:23:40Z",
    "nvd_published_at": "2023-03-17T12:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper Authorization in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.",
  "id": "GHSA-86jq-pwgx-6vrq",
  "modified": "2023-03-23T18:20:49Z",
  "published": "2023-03-17T12:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1463"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nilsteampassnet/teampass/commit/4e06fbaf2b78c3615d0599855a72ba7e31157516"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nilsteampassnet/TeamPass"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/f6683c3b-a0f2-4615-b639-1920c8ae12e6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Authorization in nilsteampassnet/teampass"
}

GHSA-86VQ-CCWF-RM62

Vulnerability from github – Published: 2026-02-27 18:35 – Updated: 2026-03-19 16:13

Summary

Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints

Details

Description

A vulnerability has been identified in Umbraco Engage where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoints can be accessed directly over the network without requiring a valid session or user credentials. By supplying a user-controlled identifier parameter (e.g., ?id=), an attacker can retrieve sensitive data associated with arbitrary records.

Because no access control validation is performed, the endpoints are vulnerable to enumeration attacks, allowing attackers to iterate over identifiers and extract data at scale.

Impact

An unauthenticated attacker can retrieve sensitive Engage-related data by directly querying the affected API endpoints. The vulnerability allows arbitrary record access through predictable or enumerable identifiers.

The confidentiality impact is considered high. No direct integrity or availability impact has been identified.

The scope of exposed data depends on the deployment but may include analytics data, tracking data, customer-related information, or other Engage-managed content.

Patches

The vulnerability affects both v16 and v17. Patches have already been released. Users are advised to update to 16.2.1 or 17.1.1

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Engage.Forms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0"
            },
            {
              "fixed": "16.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Umbraco.Engage.Forms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.0"
            },
            {
              "fixed": "17.1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-306",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-27T18:35:57Z",
    "nvd_published_at": "2026-02-26T22:20:47Z",
    "severity": "HIGH"
  },
  "details": "### Description\nA vulnerability has been identified in Umbraco Engage where certain API endpoints are exposed without enforcing authentication or authorization checks. The affected endpoints can be accessed directly over the network without requiring a valid session or user credentials. By supplying a user-controlled identifier parameter (e.g., ?id=), an attacker can retrieve sensitive data associated with arbitrary records.\n\nBecause no access control validation is performed, the endpoints are vulnerable to enumeration attacks, allowing attackers to iterate over identifiers and extract data at scale.\n\n### Impact\nAn unauthenticated attacker can retrieve sensitive Engage-related data by directly querying the affected API endpoints. The vulnerability allows arbitrary record access through predictable or enumerable identifiers.\n\nThe confidentiality impact is considered high. No direct integrity or availability impact has been identified.\n\nThe scope of exposed data depends on the deployment but may include analytics data, tracking data, customer-related information, or other Engage-managed content.\n\n### Patches\nThe vulnerability affects both v16 and v17. Patches have already been released. Users are advised to update to 16.2.1 or 17.1.1\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_",
  "id": "GHSA-86vq-ccwf-rm62",
  "modified": "2026-03-19T16:13:28Z",
  "published": "2026-02-27T18:35:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/umbraco/Umbraco.Engage.Issues/security/advisories/GHSA-86vq-ccwf-rm62"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27449"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/umbraco/Umbraco.Engage.Issues"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints"
}

GHSA-872Q-6CM2-XCC6

Vulnerability from github – Published: 2026-01-21 18:30 – Updated: 2026-01-31 00:30

Details

D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-23754"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-21T18:16:25Z",
    "severity": "HIGH"
  },
  "details": "D-Link D-View 8 versions 2.0.1.107 and below contain an improper access control vulnerability in backend API endpoints. Any authenticated user can supply an arbitrary user_id value to retrieve sensitive credential data belonging to other users, including super administrators. The exposed credential material can be reused directly as a valid authentication secret, allowing full impersonation of the targeted account. This results in complete account takeover and full administrative control over the D-View system.",
  "id": "GHSA-872q-6cm2-xcc6",
  "modified": "2026-01-31T00:30:28Z",
  "published": "2026-01-21T18:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23754"
    },
    {
      "type": "WEB",
      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10471"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/dlink-dview-8-idor-allows-credential-disclosure-and-account-takeover"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-873Q-GR5F-JJ67

Vulnerability from github – Published: 2026-06-04 09:30 – Updated: 2026-06-04 21:31

Details

The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-49192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T07:16:27Z",
    "severity": "MODERATE"
  },
  "details": "The summary service endpoint suffers from an IDOR vulnerability where it fails to verify user ownership of hardware serial numbers, exposing device data to scraping.",
  "id": "GHSA-873q-gr5f-jj67",
  "modified": "2026-06-04T21:31:20Z",
  "published": "2026-06-04T09:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49192"
    },
    {
      "type": "WEB",
      "url": "https://community.acer.com/en/kb/articles/19707"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-877V-W3F5-3PCQ

Vulnerability from github – Published: 2026-04-02 20:59 – Updated: 2026-05-06 02:40

Summary

OpenClaw: Feishu thread history and quoted messages bypass sender allowlist

Details

Summary

Feishu thread history and quoted messages bypass sender allowlist

Current Maintainer Triage

Status: open
Normalized severity: medium
Assessment: Real in shipped v2026.3.28 Feishu because fetched quoted/root/thread context bypasses sender allowlists, and SECURITY.md does not exempt remote sender-allowlist bypasses.

Affected Packages / Versions

Package: openclaw (npm)
Latest published npm version: 2026.3.31
Vulnerable version range: <=2026.3.28
Patched versions: >= 2026.3.31
First stable tag containing the fix: v2026.3.31

Fix Commit(s)

f45e5a6569aab1d58cc6de25b19f1dc4c8779b85 — 2026-03-31T19:43:54+09:00

Release Process Note

The fix is already present in released version 2026.3.31.
This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

OpenClaw thanks @AntAISecurityLab for reporting.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.28"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.31"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-02T20:59:49Z",
    "nvd_published_at": "2026-04-28T19:37:44Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nFeishu thread history and quoted messages bypass sender allowlist\n\n## Current Maintainer Triage\n- Status: open\n- Normalized severity: medium\n- Assessment: Real in shipped v2026.3.28 Feishu because fetched quoted/root/thread context bypasses sender allowlists, and SECURITY.md does not exempt remote sender-allowlist bypasses.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `\u003c=2026.3.28`\n- Patched versions: `\u003e= 2026.3.31`\n- First stable tag containing the fix: `v2026.3.31`\n\n## Fix Commit(s)\n- `f45e5a6569aab1d58cc6de25b19f1dc4c8779b85` \u2014 2026-03-31T19:43:54+09:00\n\n## Release Process Note\n- The fix is already present in released version `2026.3.31`.\n- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.\n\nOpenClaw thanks @AntAISecurityLab for reporting.",
  "id": "GHSA-877v-w3f5-3pcq",
  "modified": "2026-05-06T02:40:24Z",
  "published": "2026-04-02T20:59:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41406"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/f45e5a6569aab1d58cc6de25b19f1dc4c8779b85"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.31"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-sender-allowlist-bypass-via-thread-history-and-quoted-messages"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Feishu thread history and quoted messages bypass sender allowlist"
}

CWE-639

Authorization Bypass Through User-Controlled Key

GHSA-85CG-FG77-RRM5

GHSA-862X-3JQQ-F754

GHSA-864Q-6X2V-WVG4

GHSA-8666-8WPQ-7C9Q

GHSA-86CX-WWF4-PHQ4

Summary

Details

PoC

Impact

Remediation Recommendations

Credits

GHSA-86JQ-PWGX-6VRQ

GHSA-86VQ-CCWF-RM62

Description

Impact

Patches

Workarounds

References

GHSA-872Q-6CM2-XCC6

GHSA-873Q-GR5F-JJ67

GHSA-877V-W3F5-3PCQ

Summary

Current Maintainer Triage

Affected Packages / Versions

Fix Commit(s)

Release Process Note

Mitigation

Mitigation

Mitigation