Common Weakness Enumeration
CWE-915
AllowedImproperly Controlled Modification of Dynamically-Determined Object Attributes
Abstraction: Base · Status: Incomplete
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
373 vulnerabilities reference this CWE, most recent first.
CVE-2026-116216 (GCVE-0-2026-116216)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment
Summary
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
Severity
5.3 (Medium)
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , ≤ 2026.1000.4056
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member\u0027s avatar and impersonating them."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:48.563Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116216",
"datePublished": "2026-10-26T13:08:48.563Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-10-26T13:08:48.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115933 (GCVE-0-2026-115933)
Vulnerability from cvelistv5 – Published: 2026-10-24 14:17 – Updated: 2026-10-24 14:29
VLAI
EPSS
VEX
Title
Forged signed tokens let any registered user take over other users and organizations
Summary
Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.
A second, narrower route that creates team invitations signs extra fields from the request body in the same way.
Severity
9.9 (Critical)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/gitroomhq/postiz-app | product |
| https://github.com/gitroomhq/postiz-app/releases/… | release-notes |
| https://github.com/gitroomhq/postiz-app/commit/a5… | patch |
| https://gadvisory.org/advisories/PSA-2026-YT2HMH | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GitroomHQ | postiz-app |
Affected:
2.15.0 , < 2.25.3
(semver)
|
Date Public
2026-10-24 14:16
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "postiz-app",
"product": "postiz-app",
"repo": "https://github.com/gitroomhq/postiz-app",
"vendor": "GitroomHQ",
"versions": [
{
"lessThan": "2.25.3",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "The instance must be able to reach api2.skool.com, as any instance using the Skool provider can. No setting has to be changed."
},
{
"lang": "en",
"value": "With Stripe billing configured, the attacker\u0027s own plan must allow one channel and the target organization must not be on the STANDARD tier. The session and password reset tokens are not affected by these limits."
},
{
"lang": "en",
"value": "Self-registration is open unless DISABLE_REGISTRATION is set to true."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Anthropic, PBC"
},
{
"lang": "en",
"type": "coordinator",
"value": "Enno Gelhaus"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nevo David"
}
],
"datePublic": "2026-10-24T14:16:52.748Z",
"descriptions": [
{
"lang": "en",
"value": "Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension channel signed data taken from the request itself and stored the result where the requesting user can read it back. A user could therefore obtain a validly signed token containing any claims they choose, which the application accepts as a session, as an organization invitation with a chosen role, as a password reset or as an enterprise provisioning token.\n\nA second, narrower route that creates team invitations signs extra fields from the request body in the same way."
}
],
"exploits": [
{
"lang": "en",
"value": "Exploitation was demonstrated end to end against an unmodified backend build at commit 3a7d28b7ad96: a second self-registered user became super administrator of another user\u0027s organization and read its API key. Session, password reset, enterprise and subscription tokens obtained the same way were each accepted by their endpoints."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A registered user can obtain a validly signed token with claims of their choosing and use it as a login session for another user, without knowing any identifier of the victim when database filter objects are used as claims."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can join any other organization as super administrator, using an organization id that is exposed by any shared post preview link, read its API key and channel list and schedule posts through its connected social accounts."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can reset the password of a user whose id they know, and can obtain an organization with a lifetime top-tier subscription through the enterprise provisioning endpoint."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "Forged tokens do not expire and cannot be told apart from genuine ones."
}
]
},
{
"descriptions": [
{
"lang": "en",
"value": "The narrower invitation route lets a user who may invite team members repeatedly stop the scheduled posts of a channel of another organization, and lift the channel limit of their own plan."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-345",
"description": "CWE-345",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-24T14:29:17.141Z",
"orgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"shortName": "postiz"
},
"references": [
{
"name": "Postiz",
"tags": [
"product"
],
"url": "https://github.com/gitroomhq/postiz-app"
},
{
"name": "v2.25.3",
"tags": [
"release-notes"
],
"url": "https://github.com/gitroomhq/postiz-app/releases/tag/v2.25.3"
},
{
"name": "a5affe62",
"tags": [
"patch"
],
"url": "https://github.com/gitroomhq/postiz-app/commit/a5affe62c74e39c1e7ac960d50d8418b807d532c"
},
{
"name": "GAdvisory",
"tags": [
"vendor-advisory"
],
"url": "https://gadvisory.org/advisories/PSA-2026-YT2HMH"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-23T17:45:00.000Z",
"value": "Anthropic has disclosed a thorough report of this vulnerability including a working PoC to Postiz"
},
{
"lang": "en",
"time": "2026-10-23T18:00:00.000Z",
"value": "Postiz has reproduced the vulnerability and is working on a fix"
},
{
"lang": "en",
"time": "2026-10-24T13:27:00.000Z",
"value": "Postiz has pushed a fix for this vulnerability and verified it"
},
{
"lang": "en",
"time": "2026-10-24T14:18:00.000Z",
"value": "Postiz has created a release and published the advisory"
}
],
"title": "Forged signed tokens let any registered user take over other users and organizations",
"workarounds": [
{
"lang": "en",
"value": "If you do not use channels that rely on the Postiz browser extension, block POST /integrations/extension-refresh at your reverse proxy. This removes the main signing route; the team invitation route remains."
},
{
"lang": "en",
"value": "Set DISABLE_REGISTRATION=true. The attacker needs an ordinary account, so closing self-registration limits exposure to people who already hold one. This reduces reach, it does not close the issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4cdc9741-f887-419a-a2fd-acbbd2729276",
"assignerShortName": "postiz",
"cveId": "CVE-2026-115933",
"datePublished": "2026-10-24T14:17:05.755Z",
"dateReserved": "2026-10-23T21:21:06.893Z",
"dateUpdated": "2026-10-24T14:29:17.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112305 (GCVE-0-2026-112305)
Vulnerability from cvelistv5 – Published: 2026-10-19 15:28 – Updated: 2026-10-19 17:40
VLAI
EPSS
VEX
Title
Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override
Summary
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:38 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/semaphoreui/semaphore/pull/3888 | issue-trackingtechnical-descriptionpatch |
| https://github.com/semaphoreui/semaphore/blob/v2.… | technical-description |
| https://github.com/semaphoreui/semaphore/blob/v2.… | technical-description |
| https://github.com/semaphoreui/semaphore | product |
| https://www.vulncheck.com/advisories/semaphore-ui… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| semaphoreui | Semaphore UI |
Affected:
0 , ≤ 2.19.16
(semver)
|
Date Public
2026-05-25 15:23
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:38:35.032280Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:40:14.094Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/semaphoreui/semaphore",
"defaultStatus": "unaffected",
"product": "Semaphore UI",
"repo": "https://github.com/semaphoreui/semaphore",
"vendor": "semaphoreui",
"versions": [
{
"lessThanOrEqual": "2.19.16",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "aditya-manit"
},
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani"
}
],
"datePublic": "2026-05-25T15:23:46.000Z",
"descriptions": [
{
"lang": "en",
"value": "Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:28:55.694Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking",
"technical-description",
"patch"
],
"url": "https://github.com/semaphoreui/semaphore/pull/3888"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go#L395-L431"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go#L39-L75"
},
{
"tags": [
"product"
],
"url": "https://github.com/semaphoreui/semaphore"
},
{
"name": "VulnCheck Advisory: Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-override"
}
],
"title": "Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112305",
"datePublished": "2026-10-19T15:28:55.694Z",
"dateReserved": "2026-10-19T14:14:28.042Z",
"dateUpdated": "2026-10-19T17:40:14.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112295 (GCVE-0-2026-112295)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 16:34
VLAI
EPSS
VEX
Title
FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update
Summary
FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:36 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/sunkaifei/FlyCms/issues/19 | issue-tracking |
| https://github.com/sunkaifei/FlyCms/blob/edfdf724… | technical-description |
| https://github.com/sunkaifei/FlyCms/blob/edfdf724… | technical-description |
| https://github.com/sunkaifei/FlyCms/blob/edfdf724… | technical-description |
| https://www.vulncheck.com/advisories/flycms-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-19 09:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:36:10.890664Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:34:17.549Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/sunkaifei/FlyCms",
"defaultStatus": "unaffected",
"product": "FlyCms",
"repo": "https://github.com/sunkaifei/FlyCms",
"vendor": "sunkaifei",
"versions": [
{
"lessThanOrEqual": "edfdf724c3b944310f60c29aa755d03a00a75837",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ikram-4"
}
],
"datePublic": "2026-10-19T09:43:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account\u0027s username, email or mobile to break that victim\u0027s login."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:36.176Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/sunkaifei/FlyCms/issues/19"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/web/front/UserController.java"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/java/com/flycms/module/user/service/UserService.java"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sunkaifei/FlyCms/blob/edfdf724c3b944310f60c29aa755d03a00a75837/backend/src/main/resources/mapper/user__UserDao.xml"
},
{
"name": "VulnCheck Advisory: FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/flycms-through-commit-edfdf724-mass-assignment-via-ucenter-account-update"
}
],
"title": "FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112295",
"datePublished": "2026-10-19T13:55:36.176Z",
"dateReserved": "2026-10-19T13:25:35.388Z",
"dateUpdated": "2026-10-19T16:34:17.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112239 (GCVE-0-2026-112239)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 15:45
VLAI
EPSS
VEX
Title
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
Summary
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:45 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "TYPO3 AI Integration Extension" |
Affected:
0 , < 14.0.2
(semver)
|
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:45:40.097139Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:45:50.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "nitsan/ns-t3ai",
"product": "Extension \"TYPO3 AI Integration Extension\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "14.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sven Wappler"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nitsan"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user\u0027s permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them."
}
],
"value": "The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user\u0027s permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:30:46.019Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-035"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"TYPO3 AI Integration Extension\" (ns_t3ai)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112239",
"datePublished": "2026-10-20T09:30:46.019Z",
"dateReserved": "2026-10-19T11:29:07.528Z",
"dateUpdated": "2026-10-20T15:45:50.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110804 (GCVE-0-2026-110804)
Vulnerability from cvelistv5 – Published: 2026-10-16 13:45 – Updated: 2026-10-16 15:08
VLAI
EPSS
VEX
Summary
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:08 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Devolutions | Server |
Affected:
0 , < 2026.3.10
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-110804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:08:51.366584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:08:54.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Server",
"vendor": "Devolutions",
"versions": [
{
"lessThan": "2026.3.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request."
}
],
"value": "Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T13:45:38.143Z",
"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"shortName": "DEVOLUTIONS"
},
"references": [
{
"url": "https://devolutions.net/security/advisories/DEVO-2026-0036/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
"assignerShortName": "DEVOLUTIONS",
"cveId": "CVE-2026-110804",
"datePublished": "2026-10-16T13:45:38.143Z",
"dateReserved": "2026-10-14T18:00:44.944Z",
"dateUpdated": "2026-10-16T15:08:54.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109186 (GCVE-0-2026-109186)
Vulnerability from cvelistv5 – Published: 2026-10-12 13:10 – Updated: 2026-10-18 12:13
VLAI
EPSS
VEX
Title
jshERP through 3.6 Mass Assignment via PUT /user/update
Summary
jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 12:01 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/AnkesKasty/cve-request-poc/blo… | exploit |
| https://github.com/jishenghua/jshERP/blob/8f28e7c… | technical-description |
| https://github.com/jishenghua/jshERP/blob/8f28e7c… | technical-description |
| https://www.vulncheck.com/advisories/jsherp-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jishenghua | jshERP |
Affected:
0 , ≤ 3.6
(custom)
cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:* |
Date Public
2026-10-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109186",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T12:01:04.507575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:13:30.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/jishenghua/jshERP",
"product": "jshERP",
"repo": "https://github.com/jishenghua/jshERP",
"vendor": "jishenghua",
"versions": [
{
"lessThanOrEqual": "3.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yaqi Chao"
}
],
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users\u0027 password hashes for account takeover."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T13:10:45.663Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Proof of Concept",
"tags": [
"exploit"
],
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/jshERP/poc_identity_privilege_write.py"
},
{
"name": "Vulnerable Code (3.6)",
"tags": [
"technical-description"
],
"url": "https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/controller/UserController.java#L97-L103"
},
{
"name": "Vulnerable Code (3.6)",
"tags": [
"technical-description"
],
"url": "https://github.com/jishenghua/jshERP/blob/8f28e7c2fe54d54de3621a414f5df1833dc5a55f/jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java#L176-L192"
},
{
"name": "VulnCheck Advisory: jshERP through 3.6 Mass Assignment via PUT /user/update",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jsherp-through-3.6-mass-assignment-via-put-user-update"
}
],
"title": "jshERP through 3.6 Mass Assignment via PUT /user/update",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109186",
"datePublished": "2026-10-12T13:10:45.663Z",
"dateReserved": "2026-10-12T12:57:38.482Z",
"dateUpdated": "2026-10-18T12:13:30.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108948 (GCVE-0-2026-108948)
Vulnerability from cvelistv5 – Published: 2026-10-13 01:15 – Updated: 2026-10-15 14:51 X_Freeware
VLAI
EPSS
VEX
Title
code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes
Summary
A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 14:51 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416772 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416772/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108948 | third-party-advisory |
| https://vuldb.com/submit/997820 | third-party-advisory |
| https://github.com/thuong2206/Online-Reviewer-Sys… | exploit |
| https://code-projects.org/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| code-projects | Online Reviewer System |
Affected:
1.0
cpe:2.3:a:code-projects:online_reviewer_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108948",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T14:51:13.435654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T14:51:41.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thuong2206/Online-Reviewer-System-Privilege-Escalation"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:code-projects:online_reviewer_system:*:*:*:*:*:*:*:*"
],
"modules": [
"User Profile Update Handler"
],
"product": "Online Reviewer System",
"vendor": "code-projects",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "thuong2206 (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "thuong2206 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-913",
"description": "Dynamically-Managed Code Resources",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T01:15:20.404Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416772 | code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416772"
},
{
"name": "VDB-416772 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416772/cti"
},
{
"name": "CVE-2026-108948 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108948"
},
{
"name": "Submit #997820 | Fabian Ros (Code-Projects) Online Reviewer System 1.0 Privilege Escalation / Broken Access Control / Mass Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/997820"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/thuong2206/Online-Reviewer-System-Privilege-Escalation"
},
{
"tags": [
"product"
],
"url": "https://code-projects.org/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T10:21:53.000Z",
"value": "VulDB entry last update"
}
],
"title": "code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108948",
"datePublished": "2026-10-13T01:15:20.404Z",
"dateReserved": "2026-10-11T19:03:26.252Z",
"dateUpdated": "2026-10-15T14:51:41.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108740 (GCVE-0-2026-108740)
Vulnerability from cvelistv5 – Published: 2026-10-11 12:19 – Updated: 2026-10-13 13:28
VLAI
EPSS
VEX
Title
GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
Summary
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:25 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind03/goatcounter-user-pref-… | third-party-advisory |
| https://github.com/arp242/goatcounter/blob/7e91d8… | technical-description |
| https://github.com/arp242/goatcounter/blob/7e91d8… | technical-description |
| https://github.com/arp242/goatcounter | product |
| https://www.vulncheck.com/advisories/goatcounter-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| arp242 | GoatCounter |
Affected:
0 , ≤ 2.7.0
(semver)
|
Date Public
2026-10-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108740",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:25:32.903321Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:28:05.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/arp242/goatcounter",
"product": "GoatCounter",
"repo": "https://github.com/arp242/goatcounter",
"vendor": "arp242",
"versions": [
{
"lessThanOrEqual": "2.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:19:44.911Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind03/goatcounter-user-pref-access-mass-assignment-20261011"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/handlers/settings_user.go#L33-L99"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/user.go#L191-L218"
},
{
"tags": [
"product"
],
"url": "https://github.com/arp242/goatcounter"
},
{
"name": "VulnCheck Advisory: GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/goatcounter-through-2.7.0-privilege-escalation-via-user-pref-mass-assignment"
}
],
"title": "GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108740",
"datePublished": "2026-10-11T12:19:44.911Z",
"dateReserved": "2026-10-11T01:52:55.041Z",
"dateUpdated": "2026-10-13T13:28:05.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106100 (GCVE-0-2026-106100)
Vulnerability from cvelistv5 – Published: 2026-10-06 16:56 – Updated: 2026-10-06 17:28
VLAI
EPSS
VEX
Title
Payload: Field-level write access bypass in Payload on MongoDB
Summary
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:28 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/payloadcms/payload/security/ad… | x_refsource_CONFIRM |
| https://github.com/payloadcms/payload/commit/2a69… | x_refsource_MISC |
| https://github.com/payloadcms/payload/commit/8f77… | x_refsource_MISC |
| https://github.com/payloadcms/payload/releases/ta… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| payloadcms | payload |
Affected:
< 3.87.0
Affected: >= 4.0.0-canary.0, < 4.0.0-canary.20 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106100",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:28:47.529744Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:28:55.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "payload",
"vendor": "payloadcms",
"versions": [
{
"status": "affected",
"version": "\u003c 3.87.0"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:56:55.715Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-4ww4-68q3-h7g5"
},
{
"name": "https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/payloadcms/payload/commit/2a69863deb0e3c87e36c1b3b17ab2d5b02fcb941"
},
{
"name": "https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/payloadcms/payload/commit/8f77dffa9552885ec2710768cfee15b57e389935"
},
{
"name": "https://github.com/payloadcms/payload/releases/tag/v3.87.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/payloadcms/payload/releases/tag/v3.87.0"
}
],
"source": {
"advisory": "GHSA-4ww4-68q3-h7g5",
"discovery": "UNKNOWN"
},
"title": "Payload: Field-level write access bypass in Payload on MongoDB"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-106100",
"datePublished": "2026-10-06T16:56:55.715Z",
"dateReserved": "2026-10-06T15:33:55.332Z",
"dateUpdated": "2026-10-06T17:28:55.961Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
- If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
- For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
Mitigation
Architecture and Design
Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
Implementation
Strategy: Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
Mitigation
Implementation
Architecture and Design
Strategy: Refactoring
Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
No CAPEC attack patterns related to this CWE.