Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3973 vulnerabilities reference this CWE, most recent first.
CVE-2026-82281 (GCVE-0-2026-82281)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:19 – Updated: 2026-08-31 19:02
VLAI
EPSS
VEX
Title
Kotaemon Missing Ownership Check in Conversation Functions
Summary
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 19:01 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Cinnamon/kotaemon/issues/846 | issue-tracking |
| https://github.com/Cinnamon/kotaemon | product |
| https://github.com/Cinnamon/kotaemon/blob/9ad3e4e… | technical-description |
| https://www.vulncheck.com/advisories/kotaemon-mis… | third-party-advisory |
Impacted products
Date Public
2026-07-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82281",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T19:01:55.723864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T19:02:55.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Cinnamon/kotaemon/issues/846"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "kotaemon",
"vendor": "Cinnamon",
"versions": [
{
"lessThanOrEqual": "0.12.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cinnamon:kotaemon:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.12.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-07-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users\u0027 chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:19:01.076Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #846",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Cinnamon/kotaemon/issues/846"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cinnamon/kotaemon"
},
{
"name": "Vulnerable code: control.py",
"tags": [
"technical-description"
],
"url": "https://github.com/Cinnamon/kotaemon/blob/9ad3e4e49aa35b8acddd235918a5d9753c1cfdf9/libs/ktem/ktem/pages/chat/control.py"
},
{
"name": "VulnCheck Advisory: Kotaemon Missing Ownership Check in Conversation Functions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/kotaemon-missing-ownership-check-in-conversation-functions"
}
],
"title": "Kotaemon Missing Ownership Check in Conversation Functions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82281",
"datePublished": "2026-08-28T16:19:01.076Z",
"dateReserved": "2026-08-28T11:12:50.930Z",
"dateUpdated": "2026-08-31T19:02:55.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82280 (GCVE-0-2026-82280)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:19 – Updated: 2026-08-31 18:47
VLAI
EPSS
VEX
Title
Quivr Prompt Endpoints Missing Ownership Validation
Summary
Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 18:46 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/QuivrHQ/quivr/issues/3698 | issue-tracking |
| https://github.com/QuivrHQ/quivr | product |
| https://github.com/QuivrHQ/quivr/blob/v0.0.322/ba… | technical-description |
| https://www.vulncheck.com/advisories/quivr-prompt… | third-party-advisory |
| https://github.com/The-Vibe-Company/Quivr/issues/3698 | exploit |
Impacted products
Date Public
2026-07-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82280",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T18:46:49.905037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:47:10.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/The-Vibe-Company/Quivr/issues/3698"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "quivr",
"vendor": "QuivrHQ",
"versions": [
{
"lessThanOrEqual": "0.0.322",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:quivr:quivr:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.0.322",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-07-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:19:00.389Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3698",
"tags": [
"issue-tracking"
],
"url": "https://github.com/QuivrHQ/quivr/issues/3698"
},
{
"tags": [
"product"
],
"url": "https://github.com/QuivrHQ/quivr"
},
{
"name": "Vulnerable code: prompt_routes.py",
"tags": [
"technical-description"
],
"url": "https://github.com/QuivrHQ/quivr/blob/v0.0.322/backend/api/quivr_api/modules/prompt/controller/prompt_routes.py"
},
{
"name": "VulnCheck Advisory: Quivr Prompt Endpoints Missing Ownership Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/quivr-prompt-endpoints-missing-ownership-validation"
}
],
"title": "Quivr Prompt Endpoints Missing Ownership Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82280",
"datePublished": "2026-08-28T16:19:00.389Z",
"dateReserved": "2026-08-28T11:12:50.590Z",
"dateUpdated": "2026-08-31T18:47:10.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82271 (GCVE-0-2026-82271)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:18 – Updated: 2026-08-31 19:07
VLAI
EPSS
VEX
Title
R2R Missing Ownership Check Allows Modifying Other Users' Conversations
Summary
R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users' conversation histories, corrupting state and injecting malicious content.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 19:07 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SciPhi-AI/R2R/issues/2292 | issue-tracking |
| https://github.com/SciPhi-AI/R2R | product |
| https://github.com/SciPhi-AI/R2R/blob/9c5a94d151f… | technical-description |
| https://www.vulncheck.com/advisories/r2r-missing-… | third-party-advisory |
Date Public
2026-06-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82271",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T19:07:14.460529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T19:07:38.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/SciPhi-AI/R2R/issues/2292"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "r2r",
"product": "R2R",
"vendor": "SciPhi-AI",
"versions": [
{
"lessThanOrEqual": "3.6.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-06-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users\u0027 conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users\u0027 conversation histories, corrupting state and injecting malicious content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:18:54.164Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2292",
"tags": [
"issue-tracking"
],
"url": "https://github.com/SciPhi-AI/R2R/issues/2292"
},
{
"tags": [
"product"
],
"url": "https://github.com/SciPhi-AI/R2R"
},
{
"name": "Vulnerable code: conversations_router.py",
"tags": [
"technical-description"
],
"url": "https://github.com/SciPhi-AI/R2R/blob/9c5a94d151f90876bd7eb860f300a8fd662dc481/py/core/main/api/v3/conversations_router.py"
},
{
"name": "VulnCheck Advisory: R2R Missing Ownership Check Allows Modifying Other Users\u0027 Conversations",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/r2r-missing-ownership-check-allows-modifying-other-users-conversations"
}
],
"title": "R2R Missing Ownership Check Allows Modifying Other Users\u0027 Conversations",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82271",
"datePublished": "2026-08-28T16:18:54.164Z",
"dateReserved": "2026-08-28T11:12:38.809Z",
"dateUpdated": "2026-08-31T19:07:38.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81892 (GCVE-0-2026-81892)
Vulnerability from cvelistv5 – Published: 2026-08-31 20:38 – Updated: 2026-08-31 20:38
VLAI
EPSS
VEX
Title
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Summary
EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1.
Severity
8.1 (High)
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/EasyCorp/EasyAdminBundle/secur… | x_refsource_CONFIRM |
| https://github.com/EasyCorp/EasyAdminBundle/commi… | x_refsource_MISC |
| https://github.com/EasyCorp/EasyAdminBundle/commi… | x_refsource_MISC |
| https://github.com/EasyCorp/EasyAdminBundle/relea… | x_refsource_MISC |
| https://github.com/EasyCorp/EasyAdminBundle/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EasyCorp | EasyAdminBundle |
Affected:
>= 4.0.0, < 4.29.16
Affected: >= 5.0.0, < 5.5.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "EasyAdminBundle",
"vendor": "EasyCorp",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.29.16"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony\u0027s security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route\u0027s name can execute that route\u0027s controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T20:38:06.196Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h"
},
{
"name": "https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8"
},
{
"name": "https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699"
},
{
"name": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16"
},
{
"name": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1"
}
],
"source": {
"advisory": "GHSA-g2fm-8hr4-j82h",
"discovery": "UNKNOWN"
},
"title": "EasyAdmin custom-action dispatcher bypasses access_control on other routes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81892",
"datePublished": "2026-08-31T20:38:06.196Z",
"dateReserved": "2026-08-27T17:48:42.123Z",
"dateUpdated": "2026-08-31T20:38:06.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81853 (GCVE-0-2026-81853)
Vulnerability from cvelistv5 – Published: 2026-08-31 02:31 – Updated: 2026-08-31 15:58
VLAI
EPSS
VEX
Title
AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle
Summary
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.
AshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource's primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: "guess"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.
This issue affects ash_admin: from 0.1.0 before 1.3.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:57 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_admin/security… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-81853.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-81853 | related |
| https://github.com/ash-project/ash_admin/commit/3… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_admin |
Affected:
0.1.0 , < 1.3.1
(semver)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
|
| ash-project | ash_admin |
Affected:
98b03baa8422b94dd13e305bf08b8ee3f7232c7b , < 3c3e905d47f1155dcc1ca3fb347348b05a66065a
(git)
cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81853",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:57:41.689629Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:58:40.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash_admin",
"packageURL": "pkg:hex/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "1.3.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshAdmin.Helpers\u0027"
],
"packageName": "ash-project/ash_admin",
"packageURL": "pkg:github/ash-project/ash_admin",
"product": "ash_admin",
"programFiles": [
"lib/ash_admin/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshAdmin.Helpers\u0027:decode_primary_key/2"
}
],
"repo": "https://github.com/ash-project/ash_admin",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3c3e905d47f1155dcc1ca3fb347348b05a66065a",
"status": "affected",
"version": "98b03baa8422b94dd13e305bf08b8ee3f7232c7b",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"value": "The resource has a composite primary key, and the deployment relies on AshAdmin\u0027s authorization (a custom actor plug and policies) so that reading otherwise-restricted attribute values crosses a boundary."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_admin:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.3.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshAdmin.Helpers.decode_primary_key/2\u003c/code\u003e decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and \u003ccode\u003e:safe\u003c/code\u003e still allows any already-interned attribute name. An attacker can therefore encode \u003ccode\u003e%{api_token: \"guess\"}\u003c/code\u003e and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; \u003ccode\u003eMap.to_list/1\u003c/code\u003e also accepts structs, yielding a bogus \u003ccode\u003e__struct__\u003c/code\u003e key. The fix rejects any decoded key that is not a real primary-key field.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_admin: from 0.1.0 before 1.3.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\n`AshAdmin.Helpers.decode_primary_key/2` decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and `:safe` still allows any already-interned attribute name. An attacker can therefore encode `%{api_token: \"guess\"}` and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; `Map.to_list/1` also accepts structs, yielding a bogus `__struct__` key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"value": "Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attributes.\n\nAshAdmin.Helpers.decode_primary_key/2 decodes the composite-primary-key form (Base64 plus ETF) and returns the decoded map verbatim as the lookup filter, without checking that its keys are the resource\u0027s primary-key fields. The deserialization guards bound size, block new atoms and funs, and reject nested expressions, but none restricts which fields come back, and :safe still allows any already-interned attribute name. An attacker can therefore encode %{api_token: \"guess\"} and have it spliced into the lookup filter, brute-forcing a sensitive attribute value (API token, reset token) one equality guess at a time; Map.to_list/1 also accepts structs, yielding a bogus __struct__ key. The fix rejects any decoded key that is not a real primary-key field.\n\nThis issue affects ash_admin: from 0.1.0 before 1.3.1."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-77 Manipulating User-Controlled Variables"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T02:31:29.547Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_admin/security/advisories/GHSA-jxr8-hpv2-qp38"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-81853.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-81853"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_admin/commit/3c3e905d47f1155dcc1ca3fb347348b05a66065a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-81853",
"datePublished": "2026-08-31T02:31:29.547Z",
"dateReserved": "2026-08-30T23:15:02.371Z",
"dateUpdated": "2026-08-31T15:58:40.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81846 (GCVE-0-2026-81846)
Vulnerability from cvelistv5 – Published: 2026-09-01 19:04 – Updated: 2026-09-01 19:36
VLAI
EPSS
VEX
Title
runZero MCP 'Findings summaries' Data Leak
Summary
An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CNA · runZero (v2.0.3)
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 19:36 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.runzero.com/advisories/runzero-mcp-fi… | vendor-advisory |
| https://help.runzero.com/docs/release-notes/#512608260 | release-notes |
Impacted products
Date Public
2026-09-01 19:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81846",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T19:36:32.794252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T19:36:40.308Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Findings summaries"
],
"product": "Platform",
"vendor": "runZero",
"versions": [
{
"lessThanOrEqual": "5.1.260825.0",
"status": "affected",
"version": "4.0.251031.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero, Inc."
}
],
"datePublic": "2026-09-01T19:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low)."
}
],
"value": "An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low)."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T19:04:31.494Z",
"orgId": "44488dab-36db-4358-99f9-bc116477f914",
"shortName": "runZero"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.runzero.com/advisories/runzero-mcp-findings-summaries-data-leak-cve-2026-81846"
},
{
"tags": [
"release-notes"
],
"url": "https://help.runzero.com/docs/release-notes/#512608260"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "runZero MCP \u0027Findings summaries\u0027 Data Leak",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "44488dab-36db-4358-99f9-bc116477f914",
"assignerShortName": "runZero",
"cveId": "CVE-2026-81846",
"datePublished": "2026-09-01T19:04:31.494Z",
"dateReserved": "2026-08-27T16:11:24.858Z",
"dateUpdated": "2026-09-01T19:36:40.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81817 (GCVE-0-2026-81817)
Vulnerability from cvelistv5 – Published: 2026-08-27 13:10 – Updated: 2026-08-27 19:44
VLAI
EPSS
VEX
Title
Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Summary
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.
The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.
The patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.
The fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths.
Version impacted =>3.3.0
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 19:44 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/flowintel/flowintel/commit/106… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81817",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T19:44:05.383823Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T19:44:14.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "flowintel",
"repo": "https://github.com/flowintel/flowintel",
"vendor": "flowintel",
"versions": [
{
"lessThanOrEqual": "3.3.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "David Cruciani"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.\u003c/p\u003e\n\u003cp\u003eThe routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.\u003c/p\u003e\n\u003cp\u003eThe patch introduces \u003ccode\u003etask_case_bound_required\u003c/code\u003e, which loads both objects and returns \u003ccode\u003e404\u003c/code\u003e unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.\u003c/p\u003e\u003cp\u003eThe fix also adds explicit checks that a requested \u003ccode\u003enote_id\u003c/code\u003e belongs to the current task before returning or exporting it, closing related cross-object access paths.\u003c/p\u003eVersion impacted =\u0026gt;3.3.0"
}
],
"value": "Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints.\n\n\nThe routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to the supplied case. As a result, an authenticated user with editor-level access to one case could potentially substitute the ID of a task from another case and invoke operations against that foreign task.\n\n\nThe patch introduces task_case_bound_required, which loads both objects and returns 404 unless the task belongs to the requested case. This protection is applied to edit, delete, note, assignment, status, file, export, MISP-linking, subtask, external-reference, and other task-related endpoints.\n\nThe fix also adds explicit checks that a requested note_id belongs to the current task before returning or exporting it, closing related cross-object access paths.\n\nVersion impacted =\u003e3.3.0"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:10:30.500Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/flowintel/flowintel/commit/10676eec7f1286d7ee0769546c772c5cb9c1c72b.patch"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-81817",
"datePublished": "2026-08-27T13:10:30.500Z",
"dateReserved": "2026-08-27T13:10:27.900Z",
"dateUpdated": "2026-08-27T19:44:14.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81668 (GCVE-0-2026-81668)
Vulnerability from cvelistv5 – Published: 2026-08-27 11:15 – Updated: 2026-08-27 14:30
VLAI
EPSS
VEX
Title
Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
Summary
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:27 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-81668 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2524928 | issue-trackingx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81668",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:27:31.227878Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:30:55.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "rubygem-katello",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Arpit Jain, Independent Security Researcher (Github: arpitjain099) for reporting this issue."
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter\u0027s identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T11:15:42.330Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-81668"
},
{
"name": "RHBZ#2524928",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524928"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup",
"workarounds": [
{
"lang": "en",
"value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-81668",
"datePublished": "2026-08-27T11:15:42.330Z",
"dateReserved": "2026-08-27T10:42:56.761Z",
"dateUpdated": "2026-08-27T14:30:55.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81658 (GCVE-0-2026-81658)
Vulnerability from cvelistv5 – Published: 2026-08-27 10:22 – Updated: 2026-08-27 14:47
VLAI
EPSS
VEX
Title
Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
Summary
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:47 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-81658 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2524899 | issue-trackingx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
Date Public
2026-08-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:47:40.754824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:47:55.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "foreman",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Arpit Jain, Independent Security Researcher (Github: arpitjain099) for reporting this issue."
}
],
"datePublic": "2026-08-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization or location by supplying the corresponding audit ID. This can result in unauthorized disclosure of historical template contents, which may contain sensitive configuration information, credentials, or other secrets. The REST API revision endpoints correctly restrict this lookup."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T10:55:31.059Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-81658"
},
{
"name": "RHBZ#2524899",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524899"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-08-27T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup",
"workarounds": [
{
"lang": "en",
"value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when they become available."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-639: Authorization Bypass Through User-Controlled Key"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-81658",
"datePublished": "2026-08-27T10:22:08.586Z",
"dateReserved": "2026-08-27T09:57:41.073Z",
"dateUpdated": "2026-08-27T14:47:55.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81576 (GCVE-0-2026-81576)
Vulnerability from cvelistv5 – Published: 2026-08-27 07:14 – Updated: 2026-08-27 13:13
VLAI
EPSS
VEX
Title
Improper Authentication of Session Handles
Summary
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read
license information belonging to another handle.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:10 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://cdn.wibu.com/fileadmin/wibu_downloads/sec… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wibu-systems-ag | codemeter-runtime |
Affected:
9.00 , < 9.10
(custom)
Affected: 8.00 , < 8.41a (custom) Affected: 7.00 Affected: 6.00 cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:* cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:* |
Date Public
2026-08-25 13:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:10:38.008516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:13:33.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.wibu.com/products/codemeter/runtime.html",
"defaultStatus": "unaffected",
"product": "codemeter-runtime",
"vendor": "wibu-systems-ag",
"versions": [
{
"lessThan": "9.10",
"status": "affected",
"version": "9.00",
"versionType": "custom"
},
{
"lessThan": "8.41a",
"status": "affected",
"version": "8.00",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.00"
},
{
"status": "affected",
"version": "6.00"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.10",
"versionStartIncluding": "9.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.41a",
"versionStartIncluding": "8.00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:7.00:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wibu-systems-ag:codemeter-runtime:6.00:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Teylu of Vector Informatik GmbH"
}
],
"datePublic": "2026-08-25T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak\u003cbr\u003eSID as sole authenticator. An attacker can brute-force the SID, recover another session\u0027s handle number, and read\u003cbr\u003elicense information belonging to another handle."
}
],
"value": "If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak\nSID as sole authenticator. An attacker can brute-force the SID, recover another session\u0027s handle number, and read\nlicense information belonging to another handle."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T08:00:26.426Z",
"orgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"shortName": "wibu"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103401.pdf"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Improper Authentication of Session Handles",
"x_generator": {
"engine": "Vulnogram 1.0.0-beta"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fc02b1f-71e7-4514-a878-169626f68903",
"assignerShortName": "wibu",
"cveId": "CVE-2026-81576",
"datePublished": "2026-08-27T07:14:11.299Z",
"dateReserved": "2026-08-27T07:01:24.780Z",
"dateUpdated": "2026-08-27T13:13:33.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.