Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
16454 vulnerabilities reference this CWE, most recent first.
CVE-2026-86283 (GCVE-0-2026-86283)
Vulnerability from cvelistv5 – Published: 2026-09-06 14:15 – Updated: 2026-09-08 18:18
VLAI
EPSS
VEX
Title
MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
Summary
MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:18 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/44573e4a8 | patch |
GCVE extensions
AI-generated
Not human-reviewed
Model
qwen3.8:27b
advisory
bcp-05-x-01
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:18:11.942447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:18:22.932Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"UiBeta Collections view"
],
"product": "MISP",
"programFiles": [
"app/View/Themed/UiBeta/Collections/view.ctp"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThanOrEqual": "2.5.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP\u0027s UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller\u0027s access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance.\u003c/p\u003e"
}
],
"value": "MISP\u0027s UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller\u0027s access control list (ACL). The CollectionsController::view() action correctly resolved collection element UUIDs through Event::fetchSimpleEvents($user, ...), which enforces per-user event ACL. However, the view template independently re-queried the same UUIDs using only an Event.uuid IN (...) condition, omitting the createEventConditions() authorization filter. Because collection element UUIDs are stored without server-side authorization against the referenced event (CollectionElementsController::add() accepts whatever UUID the collection owner posts), an authenticated user with view access to a collection could retrieve full details of events they are not permitted to read. The exposed data included event identifiers, info, dates, timestamps, creator organization, all event tags, and galaxy clusters (the latter attached via a cluster-scoped rather than event-scoped ACL check). This constitutes an authorization bypass at the presentation layer, allowing horizontal privilege escalation across event boundaries within the MISP instance."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T09:04:40.182Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/44573e4a8"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe view template now retrieves the authenticated user object and applies Event::createEventConditions($me) to the secondary event query, ensuring the same per-user ACL that the controller enforces is also applied at the view layer. The galaxy cluster attachment call was also updated to use the same authenticated user reference, closing the cluster-scoped ACL gap.\u003c/p\u003e"
}
],
"value": "The view template now retrieves the authenticated user object and applies Event::createEventConditions($me) to the secondary event query, ensuring the same per-user ACL that the controller enforces is also applied at the view layer. The galaxy cluster attachment call was also updated to use the same authenticated user reference, closing the cluster-scoped ACL gap."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "none",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
}
},
"recordType": "advisory",
"vulnId": "gcve-1-2026-20028"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_patch2vuln": {
"assumptions": [
"The MISP instance is assumed to be deployed over a network (web application) with multiple users of varying privilege levels.",
"The UiBeta theme is assumed to be active or selectable by the affected user; if the theme is not in use, the vulnerability is not reachable.",
"The attacker is assumed to have at least read access to a collection that contains elements referencing events outside their ACL.",
"No specific MISP version range is identified in the patch; the affected version is marked as unspecified.",
"The CVSS assumes the exposed event data constitutes a high confidentiality impact; if the deployment only contains low-sensitivity data, the impact rating would be lower."
],
"commit": "44573e4a8e9dff43815f83a91a9c8b9f0f790261",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Scottish Government - National Cyber Team"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "The vulnerability is exploitable over the network (AV:N) via the MISP web interface. Attack complexity is low (AC:L) because the attacker only needs to view a collection whose elements reference events outside their ACL; no race conditions or special timing are required. No attack target manipulation is needed (AT:N). The attacker must be an authenticated MISP user with at least view access to a collection (PR:L). No user interaction is required beyond normal browsing (UI:N). The impact is high on the confidentiality of the vulnerable component (VC:H) because full event metadata, tags, and galaxy cluster data are exposed to unauthorized users. There is no integrity or availability impact on the vulnerable component (VI:N, VA:N) and no impact on external components (SC:N, SI:N, SA:N) since the exposed data resides within the same MISP instance.",
"draft": true,
"fixSummary": "The view template now retrieves the authenticated user object and applies Event::createEventConditions($me) to the secondary event query, ensuring the same per-user ACL that the controller enforces is also applied at the view layer. The galaxy cluster attachment call was also updated to use the same authenticated user reference, closing the cluster-scoped ACL gap.",
"generatedAt": "2026-09-06T13:42:10.775993Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"patchSha256": "3d73a5a5268dbae77114b00d96440a3b5b164e76dbc349cdf8c915ff8f18f72b",
"patchSummary": "In app/View/Themed/UiBeta/Collections/view.ctp, the patch adds retrieval of the authenticated user via $this-\u003eget(\u0027me\u0027), builds an ACL condition array using $_eventModel-\u003ecreateEventConditions($_me), appends the Event.uuid IN clause to that condition array, and passes the combined conditions to the Event::find() call. The attachClustersToEventIndex() call was changed from $this-\u003eSession-\u003eread(\u0027Auth.User\u0027) to the same $_me variable for consistency. A guard clause (!empty($_me)) was added to prevent unauthenticated execution of the query.",
"patchTruncated": false,
"source": "https://github.com/MISP/MISP/commit/44573e4a8.patch",
"subject": "fix: [security] Apply the caller\u0027s ACL to the beta collection",
"weaknessRationale": [
{
"cweId": "CWE-862",
"rationale": "The view-layer query for events by UUID omitted the authorization check (createEventConditions) that the controller layer applied, resulting in a missing authorization enforcement at the point where data was retrieved for display."
},
{
"cweId": "CWE-285",
"rationale": "The galaxy cluster attachment used a cluster-scoped ACL rather than the event-scoped ACL, and the overall view-layer authorization was weaker than the controller-layer authorization, constituting improper authorization enforcement."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-86283",
"datePublished": "2026-09-06T14:15:06.533Z",
"dateReserved": "2026-09-06T14:14:57.833Z",
"dateUpdated": "2026-09-08T18:18:22.932Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86281 (GCVE-0-2026-86281)
Vulnerability from cvelistv5 – Published: 2026-09-07 07:30 – Updated: 2026-09-07 07:30 X_Freeware
VLAI
EPSS
VEX
Title
SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery
Summary
A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Severity
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399442 | vdb-entry |
| https://vuldb.com/vuln/399442/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-86281 | third-party-advisory |
| https://vuldb.com/submit/904882 | third-party-advisory |
| https://github.com/hackliu/Vulnerability-Reports/… | exploit |
| https://www.sourcecodester.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SourceCodester | Syllabus-Aligned Learning Management & Examination System |
Affected:
1.0
cpe:2.3:a:sourcecodester:syllabus-aligned_learning_management_examination_system:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:sourcecodester:syllabus-aligned_learning_management_examination_system:*:*:*:*:*:*:*:*"
],
"product": "Syllabus-Aligned Learning Management \u0026 Examination System",
"vendor": "SourceCodester",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "BI1IHA (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management \u0026 Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T07:30:11.038Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399442 | SourceCodester Syllabus-Aligned Learning Management \u0026 Examination System cross-site request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/399442"
},
{
"name": "VDB-399442 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399442/cti"
},
{
"name": "CVE-2026-86281 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-86281"
},
{
"name": "Submit #904882 | SourceCodester Syllabus-Aligned Learning Management \u0026 Examination System 1.0 Cross Site Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/904882"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/hackliu/Vulnerability-Reports/blob/master/Syllabus%20Aligned%20Learning%20Management%20Examination%20System/VULN-08-CSRF-Missing-Tokens.md"
},
{
"tags": [
"product"
],
"url": "https://www.sourcecodester.com/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-06T15:39:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "SourceCodester Syllabus-Aligned Learning Management \u0026 Examination System cross-site request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-86281",
"datePublished": "2026-09-07T07:30:11.038Z",
"dateReserved": "2026-09-06T13:34:01.191Z",
"dateUpdated": "2026-09-07T07:30:11.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86274 (GCVE-0-2026-86274)
Vulnerability from cvelistv5 – Published: 2026-09-07 05:15 – Updated: 2026-09-08 16:02
VLAI
EPSS
VEX
Title
projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization
Summary
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 16:02 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399435 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399435/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-86274 | third-party-advisory |
| https://vuldb.com/submit/904871 | third-party-advisory |
| https://github.com/projeto-siga/siga/issues/2493 | exploitissue-tracking |
| https://github.com/projeto-siga/siga/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| projeto-siga | siga |
Affected:
11.0.2.0
Affected: 11.0.2.1 Affected: 11.0.2.2 Affected: 11.0.2.3 Affected: 11.0.2.4 Affected: 11.0.2.5 Affected: 11.0.2.6 Affected: 11.0.2.7 Affected: 11.0.2.8 Affected: 11.0.2.9 Affected: 11.0.2.10 Affected: 11.0.2.11 Affected: 11.0.2.12 Affected: 11.0.2.13 Affected: 11.1.0 Affected: 11.1.1 cpe:2.3:a:projeto-siga:siga:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86274",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T16:02:49.641036Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:02:56.051Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/904871"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:projeto-siga:siga:*:*:*:*:*:*:*:*"
],
"modules": [
"Authentication Flow"
],
"product": "siga",
"vendor": "projeto-siga",
"versions": [
{
"status": "affected",
"version": "11.0.2.0"
},
{
"status": "affected",
"version": "11.0.2.1"
},
{
"status": "affected",
"version": "11.0.2.2"
},
{
"status": "affected",
"version": "11.0.2.3"
},
{
"status": "affected",
"version": "11.0.2.4"
},
{
"status": "affected",
"version": "11.0.2.5"
},
{
"status": "affected",
"version": "11.0.2.6"
},
{
"status": "affected",
"version": "11.0.2.7"
},
{
"status": "affected",
"version": "11.0.2.8"
},
{
"status": "affected",
"version": "11.0.2.9"
},
{
"status": "affected",
"version": "11.0.2.10"
},
{
"status": "affected",
"version": "11.0.2.11"
},
{
"status": "affected",
"version": "11.0.2.12"
},
{
"status": "affected",
"version": "11.0.2.13"
},
{
"status": "affected",
"version": "11.1.0"
},
{
"status": "affected",
"version": "11.1.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "volksec (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T05:15:11.895Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399435 | projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399435"
},
{
"name": "VDB-399435 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399435/cti"
},
{
"name": "CVE-2026-86274 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-86274"
},
{
"name": "Submit #904871 | projeto-siga siga 11.0.2.10 through 11.1.1 authorization bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/904871"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/projeto-siga/siga/issues/2493"
},
{
"tags": [
"product"
],
"url": "https://github.com/projeto-siga/siga/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-06T15:21:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-86274",
"datePublished": "2026-09-07T05:15:11.895Z",
"dateReserved": "2026-09-06T13:16:19.380Z",
"dateUpdated": "2026-09-08T16:02:56.051Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86271 (GCVE-0-2026-86271)
Vulnerability from cvelistv5 – Published: 2026-09-07 04:30 – Updated: 2026-09-09 14:14
VLAI
EPSS
VEX
Title
FluentCMS PermissionManager.cs GetAccessible authorization
Summary
A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:14 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399430 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399430/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-86271 | third-party-advisory |
| https://vuldb.com/submit/904824 | third-party-advisory |
| https://github.com/fluentcms/FluentCMS/issues/2409 | exploitissue-tracking |
| https://github.com/fluentcms/FluentCMS/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86271",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T14:14:35.198073Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:14:47.102Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fluentcms:fluentcms:*:*:*:*:*:*:*:*"
],
"product": "FluentCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "volksec (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T04:30:11.124Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399430 | FluentCMS PermissionManager.cs GetAccessible authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399430"
},
{
"name": "VDB-399430 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399430/cti"
},
{
"name": "CVE-2026-86271 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-86271"
},
{
"name": "Submit #904824 | FluentCMS 0.0.5 improper authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/904824"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/fluentcms/FluentCMS/issues/2409"
},
{
"tags": [
"product"
],
"url": "https://github.com/fluentcms/FluentCMS/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-06T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-06T14:56:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "FluentCMS PermissionManager.cs GetAccessible authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-86271",
"datePublished": "2026-09-07T04:30:11.124Z",
"dateReserved": "2026-09-06T12:51:03.719Z",
"dateUpdated": "2026-09-09T14:14:47.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86254 (GCVE-0-2026-86254)
Vulnerability from cvelistv5 – Published: 2026-09-06 12:00 – Updated: 2026-09-08 13:33
VLAI
EPSS
VEX
Title
wger Incomplete Authorization Fix Cross-Tenant Account Deletion
Summary
wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case.
Severity
6.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:32 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/wger-project/wger/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/wger-incompl… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wger-project | wger |
Affected:
0 , ≤ master
(custom)
cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:* |
Date Public
2026-05-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86254",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:32:54.776180Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:33:31.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-mw8f-w6p8-xrf4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/wger",
"product": "wger",
"vendor": "wger-project",
"versions": [
{
"lessThanOrEqual": "master",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wger:wger:*:*:*:*:*:*:*:*",
"versionEndIncluding": "master",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "HiyokoSauna37"
}
],
"datePublic": "2026-05-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations by exploiting the None != None comparison edge case."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T12:00:28.899Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-mw8f-w6p8-xrf4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/wger-project/wger/security/advisories/GHSA-mw8f-w6p8-xrf4"
},
{
"name": "VulnCheck Advisory: wger Incomplete Authorization Fix Cross-Tenant Account Deletion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wger-incomplete-authorization-fix-cross-tenant-account-deletion"
}
],
"title": "wger Incomplete Authorization Fix Cross-Tenant Account Deletion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86254",
"datePublished": "2026-09-06T12:00:28.899Z",
"dateReserved": "2026-09-06T11:35:19.316Z",
"dateUpdated": "2026-09-08T13:33:31.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86194 (GCVE-0-2026-86194)
Vulnerability from cvelistv5 – Published: 2026-09-05 12:09 – Updated: 2026-09-05 12:09
VLAI
EPSS
VEX
Title
Grav Form Plugin before 9.1.22 Cross-Page Form Execution
Summary
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form's name to trigger save, upload, email, or call actions without authentication.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/getgrav/grav/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/grav-form-pl… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getgrav | grav-plugin-form |
Affected:
0 , < 9.1.22
(semver)
Unaffected: 9.1.22 (semver) cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* |
Date Public
2026-08-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "grav-plugin-form",
"vendor": "getgrav",
"versions": [
{
"lessThan": "9.1.22",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "9.1.22",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.1.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "1K0CT"
}
],
"datePublic": "2026-08-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a restricted form\u0027s name to trigger save, upload, email, or call actions without authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T12:09:08.147Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-33m4-m988-5fvh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-33m4-m988-5fvh"
},
{
"name": "VulnCheck Advisory: Grav Form Plugin before 9.1.22 Cross-Page Form Execution",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/grav-form-plugin-before-9.1.22-cross-page-form-execution"
}
],
"title": "Grav Form Plugin before 9.1.22 Cross-Page Form Execution",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86194",
"datePublished": "2026-09-05T12:09:08.147Z",
"dateReserved": "2026-09-05T11:51:31.102Z",
"dateUpdated": "2026-09-05T12:09:08.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86182 (GCVE-0-2026-86182)
Vulnerability from cvelistv5 – Published: 2026-09-06 08:45 – Updated: 2026-09-08 13:55
VLAI
EPSS
VEX
Title
diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery
Summary
A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:54 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/399314 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/399314/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-86182 | third-party-advisory |
| https://vuldb.com/submit/896154 | third-party-advisory |
| https://github.com/diem-project/diem/issues/449 | exploitissue-tracking |
| https://github.com/diem-project/diem/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| diem-project | diem |
Affected:
5.1.0
Affected: 5.1.1 Affected: 5.1.2 Affected: 5.1.3 cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86182",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:54:06.107980Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:55:02.173Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*"
],
"modules": [
"dmConsole"
],
"product": "diem",
"vendor": "diem-project",
"versions": [
{
"status": "affected",
"version": "5.1.0"
},
{
"status": "affected",
"version": "5.1.1"
},
{
"status": "affected",
"version": "5.1.2"
},
{
"status": "affected",
"version": "5.1.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yingxiujie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm_command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-06T08:45:07.507Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-399314 | diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/399314"
},
{
"name": "VDB-399314 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/399314/cti"
},
{
"name": "CVE-2026-86182 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-86182"
},
{
"name": "Submit #896154 | diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad Cross-Site Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/896154"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/diem-project/diem/issues/449"
},
{
"tags": [
"product"
],
"url": "https://github.com/diem-project/diem/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-05T13:01:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-86182",
"datePublished": "2026-09-06T08:45:07.507Z",
"dateReserved": "2026-09-05T10:56:48.083Z",
"dateUpdated": "2026-09-08T13:55:02.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86178 (GCVE-0-2026-86178)
Vulnerability from cvelistv5 – Published: 2026-09-05 11:01 – Updated: 2026-09-08 17:21
VLAI
EPSS
VEX
Title
Pixelfed through 0.12.9 Unauthorized Story Access via API
Summary
Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:20 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/geo-chen/oss/blob/main/Pixelfed.md | third-party-advisoryexploit |
| https://github.com/pixelfed/pixelfed/blob/v0.12.9… | technical-description |
| https://github.com/pixelfed/pixelfed/blob/v0.12.9… | technical-description |
| https://github.com/pixelfed/pixelfed/blob/v0.12.9… | technical-description |
| https://github.com/pixelfed/pixelfed | product |
| https://www.vulncheck.com/advisories/pixelfed-thr… | third-party-advisory |
Impacted products
Date Public
2026-09-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:20:50.838883Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:21:02.225Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pixelfed/pixelfed",
"product": "pixelfed",
"vendor": "pixelfed",
"versions": [
{
"lessThanOrEqual": "0.12.9",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pixelfed:pixelfed:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.12.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-09-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author information without following the account."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T11:01:28.748Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Advisory",
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/Pixelfed.md"
},
{
"name": "StoryComposeController react",
"tags": [
"technical-description"
],
"url": "https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L487-L501"
},
{
"name": "StoryComposeController comment",
"tags": [
"technical-description"
],
"url": "https://github.com/pixelfed/pixelfed/blob/v0.12.9/app/Http/Controllers/StoryComposeController.php#L566-L580"
},
{
"name": "Story react and comment routes",
"tags": [
"technical-description"
],
"url": "https://github.com/pixelfed/pixelfed/blob/v0.12.9/routes/web-api.php#L154-L155"
},
{
"tags": [
"product"
],
"url": "https://github.com/pixelfed/pixelfed"
},
{
"name": "VulnCheck Advisory: Pixelfed through 0.12.9 Unauthorized Story Access via API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pixelfed-through-0.12.9-unauthorized-story-access-via-api"
}
],
"title": "Pixelfed through 0.12.9 Unauthorized Story Access via API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86178",
"datePublished": "2026-09-05T11:01:28.748Z",
"dateReserved": "2026-09-05T10:40:41.710Z",
"dateUpdated": "2026-09-08T17:21:02.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86177 (GCVE-0-2026-86177)
Vulnerability from cvelistv5 – Published: 2026-09-05 11:01 – Updated: 2026-09-08 18:14
VLAI
EPSS
VEX
Title
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
Summary
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:13 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/pterodactyl/panel/commit/913b3… | patch |
| https://github.com/geo-chen/oss/blob/main/panel.md | third-party-advisoryexploit |
| https://github.com/pterodactyl/panel/blob/v1.14.0… | technical-description |
| https://github.com/pterodactyl/panel/blob/v1.14.0… | technical-description |
| https://github.com/pterodactyl/panel/releases/tag… | release-notes |
| https://github.com/pterodactyl/panel | product |
| https://www.vulncheck.com/advisories/pterodactyl-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pterodactyl | panel |
Affected:
0 , < 1.14.1
(semver)
Unaffected: 1.14.1 (semver) cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:* |
Date Public
2026-09-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86177",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:13:59.381722Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:14:11.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/pterodactyl/panel",
"product": "panel",
"vendor": "pterodactyl",
"versions": [
{
"lessThan": "1.14.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.14.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.14.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-09-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T11:01:28.077Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd0fa6"
},
{
"name": "Researcher Advisory",
"tags": [
"third-party-advisory",
"exploit"
],
"url": "https://github.com/geo-chen/oss/blob/main/panel.md"
},
{
"name": "StoreTaskRequest permission and rules",
"tags": [
"technical-description"
],
"url": "https://github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.php#L10-L25"
},
{
"name": "RunTaskJob action dispatch",
"tags": [
"technical-description"
],
"url": "https://github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.php#L60-L75"
},
{
"name": "Pterodactyl Panel v1.14.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/pterodactyl/panel/releases/tag/v1.14.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/pterodactyl/panel"
},
{
"name": "VulnCheck Advisory: Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-escalation-via-schedule-tasks"
}
],
"title": "Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86177",
"datePublished": "2026-09-05T11:01:28.077Z",
"dateReserved": "2026-09-05T10:40:41.335Z",
"dateUpdated": "2026-09-08T18:14:11.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86118 (GCVE-0-2026-86118)
Vulnerability from cvelistv5 – Published: 2026-09-05 09:59 – Updated: 2026-09-08 13:06
VLAI
EPSS
VEX
Title
gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint
Summary
gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 13:06 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/sentriz/gonic/security/advisor… | vendor-advisory |
| https://github.com/sentriz/gonic/blob/v0.21.0/ser… | technical-description |
| https://github.com/sentriz/gonic/blob/v0.21.0/ser… | technical-description |
| https://github.com/sentriz/gonic/releases/tag/v0.22.0 | release-notes |
| https://github.com/sentriz/gonic | product |
| https://www.vulncheck.com/advisories/gonic-before… | third-party-advisory |
Date Public
2026-07-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86118",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T13:06:32.894121Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T13:06:48.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/go.senan.xyz/gonic",
"product": "gonic",
"repo": "https://github.com/sentriz/gonic",
"vendor": "sentriz",
"versions": [
{
"lessThan": "0.22.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-07-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service on multi-user instances."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T09:59:08.059Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-453r-pgfw-h3pq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/sentriz/gonic/security/advisories/GHSA-453r-pgfw-h3pq"
},
{
"name": "ServeStartScan without an admin check",
"tags": [
"technical-description"
],
"url": "https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/handlers_common.go"
},
{
"name": "/startScan registered on the plain auth chain",
"tags": [
"technical-description"
],
"url": "https://github.com/sentriz/gonic/blob/v0.21.0/server/ctrlsubsonic/ctrl.go"
},
{
"name": "gonic v0.22.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/sentriz/gonic/releases/tag/v0.22.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/sentriz/gonic"
},
{
"name": "VulnCheck Advisory: gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gonic-before-0.22.0-missing-administrator-check-on-the-subsonic-startscan-endpoint"
}
],
"title": "gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86118",
"datePublished": "2026-09-05T09:59:08.059Z",
"dateReserved": "2026-09-05T01:59:21.710Z",
"dateUpdated": "2026-09-08T13:06:48.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.