Common Weakness Enumeration
CWE-915
Weakness AllowedImproperly Controlled Modification of Dynamically-Determined Object Attributes
Abstraction: Base · Status: Incomplete
The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Relationships and members
Modes of introduction
Architecture and Design
Implementation
If an object contains attributes that were only intended for internal use, then their unexpected modification could lead to a vulnerability.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Notes
Maintenance
The relationships between CWE-502 and CWE-915 need further exploration. CWE-915 is more narrowly scoped to object modification, and is not necessarily used for deserialization.
Content history
Submission: CWE Content Team
· MITRE
· 2013-01-26
· CWE 2.4
Contribution: Dan Amodio, Dave Wichers
· Aspect Security
· 2013-01-26
· CWE 2.4
Suggested adding mass assignment, provided references, and clarified relationship with AutoBinding.
Modification: CWE Content Team
· MITRE
· 2013-07-17
· CWE 2.5
updated References
Modification: CWE Content Team
· MITRE
· 2017-05-03
· CWE 2.11
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated References
Modification: CWE Content Team
· MITRE
· 2019-06-20
· CWE 3.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2020-06-25
· CWE 4.1
updated Alternate_Terms, Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2020-12-10
· CWE 4.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Description, Observed_Examples
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated Detection_Factors, References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2024-02-29
· CWE 4.14
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2024-07-16
· CWE 4.15
updated Observed_Examples
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Applicable_Platforms, Relationships
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Description, Modes_of_Introduction, Observed_Examples
410 vulnerabilities reference this CWE, most recent first.
CVE-2026-129101 (GCVE-0-2026-129101)
Vulnerability from cvelistv5 – Published: 2026-11-13 15:38 – Updated: 2026-11-13 15:38
VLAI
EPSS
VEX
Title
Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment
Summary
Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root.
Severity
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.cudy.com/en-us/pages/download-center/… | release-notes |
| https://d1jvyy13vm72kv.cloudfront.net/device/upgr… | patch |
| https://www.vulncheck.com/advisories/cudy-tr3000-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Shenzhen Cudy Technology Co., Ltd. | TR3000 1.0 |
Affected:
0 , < 2.5.42
(semver)
Unaffected: 2.5.42 (semver) |
Date Public
2026-11-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TR3000 1.0",
"vendor": "Shenzhen Cudy Technology Co., Ltd.",
"versions": [
{
"lessThan": "2.5.42",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.5.42",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-11-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:38:30.889Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Cudy TR3000 1.0 Download Center",
"tags": [
"release-notes"
],
"url": "https://www.cudy.com/en-us/pages/download-center/tr3000-1-0"
},
{
"name": "Cudy TR3000 Firmware 2.5.42",
"tags": [
"patch"
],
"url": "https://d1jvyy13vm72kv.cloudfront.net/device/upgrade/m_upgrade_TR3000_256MB_Flash-R103-2.5.42-20261103-160202-sysupgrade_82672.zip"
},
{
"name": "VulnCheck Advisory: Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/cudy-tr3000-before-2.5.42-authenticated-rce-via-vpn-set-conf-mass-assignment"
}
],
"title": "Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-129101",
"datePublished": "2026-11-13T15:38:30.889Z",
"dateReserved": "2026-11-13T15:31:00.206Z",
"dateUpdated": "2026-11-13T15:38:30.889Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126467 (GCVE-0-2026-126467)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:35 – Updated: 2026-11-13 09:35
VLAI
EPSS
VEX
Title
OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php
Summary
OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter.
Severity
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openemr/openemr/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openemr-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "openemr",
"vendor": "openemr",
"versions": [
{
"lessThan": "8.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.5.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Nora-Qiu"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:02.519Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qv6p-57wj-w55p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openemr/openemr/security/advisories/GHSA-qv6p-57wj-w55p"
},
{
"name": "VulnCheck Advisory: OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openemr-before-8.5.0-mass-assignment-via-observation-form-save-php"
}
],
"title": "OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126467",
"datePublished": "2026-11-13T09:35:02.519Z",
"dateReserved": "2026-11-10T21:41:28.743Z",
"dateUpdated": "2026-11-13T09:35:02.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126081 (GCVE-0-2026-126081)
Vulnerability from cvelistv5 – Published: 2026-11-10 21:06 – Updated: 2026-11-14 03:08
VLAI
EPSS
VEX
Title
Action Pack: Possible Strong Parameters bypass in Parameters#each_key
Summary
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of each_key to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag. This is an incomplete fix of CVE-2020-8164, which made each, each_pair and each_value return the Parameters instance but left each_key delegated. An application is affected if it passes the return value of ActionController::Parameters#each_key, called with a block, to mass assignment. Rails itself makes no such call. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-14 03:08 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/2fc88383001… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8ba746e0a78… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.5.2 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.4.1 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126081",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-14T03:08:20.462091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T03:08:30.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rails",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1, \u003c 8.1.4.1"
},
{
"status": "affected",
"version": "\u003c 8.0.5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of each_key to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag. This is an incomplete fix of CVE-2020-8164, which made each, each_pair and each_value return the Parameters instance but left each_key delegated. An application is affected if it passes the return value of ActionController::Parameters#each_key, called with a block, to mass assignment. Rails itself makes no such call. This issue is fixed in versions 8.1.4.1 and 8.0.5.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T21:06:31.425Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3"
},
{
"name": "https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c"
},
{
"name": "https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.5.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.5.2"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.4.1"
}
],
"source": {
"advisory": "GHSA-wm3x-v3qw-4jh3",
"discovery": "UNKNOWN"
},
"title": "Action Pack: Possible Strong Parameters bypass in Parameters#each_key"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-126081",
"datePublished": "2026-11-10T21:06:31.425Z",
"dateReserved": "2026-11-10T17:07:43.285Z",
"dateUpdated": "2026-11-14T03:08:30.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123526 (GCVE-0-2026-123526)
Vulnerability from cvelistv5 – Published: 2026-11-08 01:37 – Updated: 2026-11-09 14:05
VLAI
EPSS
VEX
Title
Vikunja before 2.7.1 Mass Assignment via Team external_id Field
Summary
Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:04 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-befo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
0 , < 2.7.1
(semver)
Unaffected: 2.7.1 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123526",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:04:35.414926Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:05:11.374Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fjrf-gjmg-9v6g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "EclipsSec"
},
{
"lang": "en",
"type": "reporter",
"value": "l1ght-man"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T01:37:35.608Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fjrf-gjmg-9v6g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fjrf-gjmg-9v6g"
},
{
"name": "VulnCheck Advisory: Vikunja before 2.7.1 Mass Assignment via Team external_id Field",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-before-2.7.1-mass-assignment-via-team-external-id-field"
}
],
"title": "Vikunja before 2.7.1 Mass Assignment via Team external_id Field",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123526",
"datePublished": "2026-11-08T01:37:35.608Z",
"dateReserved": "2026-11-06T00:48:01.381Z",
"dateUpdated": "2026-11-09T14:05:11.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123490 (GCVE-0-2026-123490)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-11 03:02
VLAI
EPSS
VEX
Title
Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass
Summary
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-11 03:02 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/craftcms/cms/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/craft-cms-be… | third-party-advisory |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123490",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-11T03:02:18.142212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:02:28.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.11.2",
"status": "affected",
"version": "5.8.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.11.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.2",
"versionStartIncluding": "5.8.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0xkalawy"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:00:51.473Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-r56r-f696-c8w9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-r56r-f696-c8w9"
},
{
"name": "VulnCheck Advisory: Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/craft-cms-before-5.11.2-privilege-escalation-via-getowners-sandbox-bypass"
}
],
"title": "Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123490",
"datePublished": "2026-11-06T15:00:51.473Z",
"dateReserved": "2026-11-06T00:44:37.658Z",
"dateUpdated": "2026-11-11T03:02:28.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-122053 (GCVE-0-2026-122053)
Vulnerability from cvelistv5 – Published: 2026-11-06 16:46 – Updated: 2026-11-06 20:39
VLAI
EPSS
VEX
Title
Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
Summary
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.
ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.
The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 20:39 UTC
CWE
- CWE-915 - Improperly controlled modification of Dynamically-Determined object attributes
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/symfony/symfony/security/advis… | third-party-advisory |
| https://github.com/symfony/symfony/commit/fcaf87a… | patch |
| https://github.com/symfony/symfony/commit/9f73906… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sensiolabs | symfony |
Affected:
5.4.41 , < 5.4.56
(git)
Affected: 6.4.9 , < 6.4.50 (git) Affected: 7.0.9 , < 7.1.0 (git) Affected: 7.1.2 , < 7.4.23 (git) Affected: 8.0.0 , < 8.1.11 (git) cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
Date Public
2026-11-06 16:46
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-122053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T20:39:21.488819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T20:39:54.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/packages/symfony/serializer",
"defaultStatus": "unaffected",
"modules": [
"Symfony\\Component\\Serializer\\Normalizer\\ObjectNormalizer::isAllowedAttribute()"
],
"packageName": "symfony/serializer",
"product": "symfony",
"repo": "https://github.com/symfony/serializer",
"vendor": "sensiolabs",
"versions": [
{
"lessThan": "5.4.56",
"status": "affected",
"version": "5.4.41",
"versionType": "git"
},
{
"lessThan": "6.4.50",
"status": "affected",
"version": "6.4.9",
"versionType": "git"
},
{
"lessThan": "7.1.0",
"status": "affected",
"version": "7.0.9",
"versionType": "git"
},
{
"lessThan": "7.4.23",
"status": "affected",
"version": "7.1.2",
"versionType": "git"
},
{
"lessThan": "8.1.11",
"status": "affected",
"version": "8.0.0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.56",
"versionStartIncluding": "5.4.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.50",
"versionStartIncluding": "6.4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0",
"versionStartIncluding": "7.0.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4.23",
"versionStartIncluding": "7.1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.1.11",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Alexandre Daubois"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nicolas Grekas"
},
{
"lang": "en",
"type": "reporter",
"value": "The PHP Foundation"
}
],
"datePublic": "2026-11-06T16:46:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Symfony Serializer component\u0026nbsp;\u003ccode\u003eObjectNormalizer\u003c/code\u003e\u0026nbsp;treats any attribute name containing\u0026nbsp;\u003ccode\u003e.\u003c/code\u003e\u0026nbsp;(and, from Symfony 6.4,\u0026nbsp;\u003ccode\u003e[\u003c/code\u003e) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their\u0026nbsp;\u003ccode\u003e#[Ignore]\u003c/code\u003e metadata attribute in\u0026nbsp;Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.\u003cbr\u003e\u003ccode\u003eObjectNormalizer::isAllowedAttribute()\u003c/code\u003e accepts such names, and \u003ccode\u003esetAttributeValue()\u003c/code\u003e hands the name straight to \u003ccode\u003ePropertyAccessor::setValue()\u003c/code\u003e, which parses it as a property path and traverses into the nested object. A payload key such as\u0026nbsp;\u003ccode\u003ecustomer.admin\u003c/code\u003e\u0026nbsp;writes to\u0026nbsp;\u003ccode\u003e$order-\u0026gt;customer-\u0026gt;admin\u003c/code\u003e. The\u0026nbsp;\u003ccode\u003e#[Ignore]\u003c/code\u003e\u0026nbsp;metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path.\u0026nbsp;\u003ccode\u003e#[Groups]\u003c/code\u003e\u0026nbsp;restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither \u003ccode\u003e#[Ignore]\u003c/code\u003e nor \u003ccode\u003e#[Groups]\u003c/code\u003e, no allowlist applies and every key of the payload is let through. Because\u0026nbsp;\u003ccode\u003ePropertyAccessor\u003c/code\u003e also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker\u2019s value.\u003cdiv\u003eApplications that bind untrusted input to objects are affected, including controllers using \u003ccode\u003e#[MapRequestPayload]\u003c/code\u003e\u0026nbsp;or\u0026nbsp;\u003ccode\u003e#[MapQueryString]\u003c/code\u003e, whose default normalizer is \u003ccode\u003eObjectNormalizer\u003c/code\u003e. With \u003ccode\u003eOBJECT_TO_POPULATE\u003c/code\u003e, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.\u003c/div\u003e\u003cdiv\u003eThe fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.\u003c/div\u003e"
}
],
"value": "The Symfony Serializer component\u00a0ObjectNormalizer\u00a0treats any attribute name containing\u00a0.\u00a0(and, from Symfony 6.4,\u00a0[) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their\u00a0#[Ignore] metadata attribute in\u00a0Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.\nObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as\u00a0customer.admin\u00a0writes to\u00a0$order-\u003ecustomer-\u003eadmin. The\u00a0#[Ignore]\u00a0metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path.\u00a0#[Groups]\u00a0restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because\u00a0PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker\u2019s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload]\u00a0or\u00a0#[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.\n\nThe fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly controlled modification of Dynamically-Determined object attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:51:02.357Z",
"orgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"shortName": "Checkmarx"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/fcaf87a93c7fa5b7fe9e9e8382d4ed0d0c52c67c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/symfony/symfony/commit/9f7390678a255f7962fb1c81c42b26fa907d3437"
}
],
"source": {
"advisory": "GHSA-hqp2-7rr8-hf26",
"discovery": "UNKNOWN"
},
"title": "Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "596c5446-0ce5-4ba2-aa66-48b3b757a647",
"assignerShortName": "Checkmarx",
"cveId": "CVE-2026-122053",
"datePublished": "2026-11-06T16:46:46.986Z",
"dateReserved": "2026-11-04T16:22:10.624Z",
"dateUpdated": "2026-11-06T20:39:54.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120730 (GCVE-0-2026-120730)
Vulnerability from cvelistv5 – Published: 2026-11-10 10:43 – Updated: 2026-11-12 17:46
VLAI
EPSS
VEX
Title
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
Summary
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.
A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 17:46 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/nerves-hub/nerves_hub_web/secu… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-120730.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-120730 | related |
| https://github.com/nerves-hub/nerves_hub_web/comm… | related |
| https://github.com/nerves-hub/nerves_hub_web/comm… | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| nerves-hub | nerves_hub_web |
Affected:
1.0.0 , < 2.5.3
(other)
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:* |
|
| nerves-hub | nerves_hub_web |
Affected:
1.0.0 , < 2.5.3
(semver)
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:* |
|
| nerves-hub | nerves_hub_web |
Affected:
f58d58233dbd355c58d3a140107ece18e8863f14 , < c367d7d17d07f843e78a70d15904665616dde964
(git)
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:* |
Date Public
2026-11-10 10:43
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120730",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T17:46:09.344720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T17:46:28.444Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://ghcr.io",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.NervesHubWeb.API.DeviceController\u0027",
"\u0027Elixir.NervesHub.Devices.Device\u0027",
"\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027",
"\u0027Elixir.NervesHubWeb.Live.Devices.New\u0027",
"\u0027Elixir.NervesHubWeb.Live.Org.SigningKeys\u0027",
"\u0027Elixir.NervesHubWeb.Live.Products.New\u0027",
"\u0027Elixir.NervesHub.Devices.CACertificate.JITP\u0027",
"\u0027Elixir.NervesHub.ManagedDeployments\u0027"
],
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/device_controller.ex",
"lib/nerves_hub/devices/device.ex",
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/live/devices/new.ex",
"lib/nerves_hub_web/live/org/signing_keys.ex",
"lib/nerves_hub_web/live/products/new.ex",
"lib/nerves_hub/devices/ca_certificate/jitp.ex",
"lib/nerves_hub/managed_deployments.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.NervesHubWeb.API.DeviceController\u0027:create/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.API.DeviceController\u0027:update/2"
},
{
"name": "\u0027Elixir.NervesHub.Devices.Device\u0027:changeset/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:hooked_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Devices.New\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Org.SigningKeys\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Products.New\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHub.Devices.CACertificate.JITP\u0027:changeset/2"
}
],
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "other"
}
]
},
{
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.NervesHubWeb.API.DeviceController\u0027",
"\u0027Elixir.NervesHub.Devices.Device\u0027",
"\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027",
"\u0027Elixir.NervesHubWeb.Live.Devices.New\u0027",
"\u0027Elixir.NervesHubWeb.Live.Org.SigningKeys\u0027",
"\u0027Elixir.NervesHubWeb.Live.Products.New\u0027",
"\u0027Elixir.NervesHub.Devices.CACertificate.JITP\u0027",
"\u0027Elixir.NervesHub.ManagedDeployments\u0027"
],
"packageName": "nerves_hub",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web\u0026vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/device_controller.ex",
"lib/nerves_hub/devices/device.ex",
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/live/devices/new.ex",
"lib/nerves_hub_web/live/org/signing_keys.ex",
"lib/nerves_hub_web/live/products/new.ex",
"lib/nerves_hub/devices/ca_certificate/jitp.ex",
"lib/nerves_hub/managed_deployments.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.NervesHubWeb.API.DeviceController\u0027:create/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.API.DeviceController\u0027:update/2"
},
{
"name": "\u0027Elixir.NervesHub.Devices.Device\u0027:changeset/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:hooked_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Devices.New\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Org.SigningKeys\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Products.New\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHub.Devices.CACertificate.JITP\u0027:changeset/2"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.NervesHubWeb.API.DeviceController\u0027",
"\u0027Elixir.NervesHub.Devices.Device\u0027",
"\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027",
"\u0027Elixir.NervesHubWeb.Live.Devices.New\u0027",
"\u0027Elixir.NervesHubWeb.Live.Org.SigningKeys\u0027",
"\u0027Elixir.NervesHubWeb.Live.Products.New\u0027",
"\u0027Elixir.NervesHub.Devices.CACertificate.JITP\u0027",
"\u0027Elixir.NervesHub.ManagedDeployments\u0027"
],
"packageName": "nerves-hub/nerves_hub_web",
"packageURL": "pkg:github/nerves-hub/nerves_hub_web",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/device_controller.ex",
"lib/nerves_hub/devices/device.ex",
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/live/devices/new.ex",
"lib/nerves_hub_web/live/org/signing_keys.ex",
"lib/nerves_hub_web/live/products/new.ex",
"lib/nerves_hub/devices/ca_certificate/jitp.ex",
"lib/nerves_hub/managed_deployments.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.NervesHubWeb.API.DeviceController\u0027:create/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.API.DeviceController\u0027:update/2"
},
{
"name": "\u0027Elixir.NervesHub.Devices.Device\u0027:changeset/2"
},
{
"name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:hooked_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Devices.New\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Org.SigningKeys\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHubWeb.Live.Products.New\u0027:handle_event/3"
},
{
"name": "\u0027Elixir.NervesHub.Devices.CACertificate.JITP\u0027:changeset/2"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "c367d7d17d07f843e78a70d15904665616dde964",
"status": "affected",
"version": "f58d58233dbd355c58d3a140107ece18e8863f14",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.5.3",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Josh Kalderimis"
},
{
"lang": "en",
"type": "reporter",
"value": "Josh Kalderimis"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Josh Kalderimis"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-11-09T22:45:21.000Z",
"datePublic": "2026-11-10T10:43:48.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted \u003ccode\u003eorg_id\u003c/code\u003e, \u003ccode\u003eproduct_id\u003c/code\u003e and \u003ccode\u003edeployment_id\u003c/code\u003e fields. The device API create and update actions and the dashboard device forms pass the request parameters to \u003ccode\u003eNervesHub.Devices.Device.changeset/2\u003c/code\u003e, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session\u0027s organization into the submitted parameters so that a submitted \u003ccode\u003eorg_id\u003c/code\u003e wins, and the JITP changeset accepts any \u003ccode\u003eproduct_id\u003c/code\u003e. Each request requires the \u003ccode\u003emanage\u003c/code\u003e role only in the user\u0027s own organization, and any account can create one.\u003c/p\u003e\n\u003cp\u003eA device placed on another organization\u0027s deployment group, or moved into its product, is sent that organization\u0027s firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.\u003c/p\u003e\n\u003cp\u003eThis issue affects nerves_hub: from 1.0.0 before 2.5.3.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted `org_id`, `product_id` and `deployment_id` fields. The device API create and update actions and the dashboard device forms pass the request parameters to `NervesHub.Devices.Device.changeset/2`, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session\u0027s organization into the submitted parameters so that a submitted `org_id` wins, and the JITP changeset accepts any `product_id`. Each request requires the `manage` role only in the user\u0027s own organization, and any account can create one.\n\nA device placed on another organization\u0027s deployment group, or moved into its product, is sent that organization\u0027s firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
}
],
"value": "Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session\u0027s organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user\u0027s own organization, and any account can create one.\n\nA device placed on another organization\u0027s deployment group, or moved into its product, is sent that organization\u0027s firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
}
],
"impacts": [
{
"capecId": "CAPEC-77",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny user who manages devices in an organization of their own can attach their device to another organization\u0027s deployment group and receive its firmware, move devices into that organization\u0027s product, add firmware signing keys and products to it, and have a certificate authority provision devices into its product. Devices that already belong to the other organization are not controlled, and no firmware can be uploaded to it.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Any user who manages devices in an organization of their own can attach their device to another organization\u0027s deployment group and receive its firmware, move devices into that organization\u0027s product, add firmware signing keys and products to it, and have a certificate authority provision devices into its product. Devices that already belong to the other organization are not controlled, and no firmware can be uploaded to it."
}
],
"value": "Any user who manages devices in an organization of their own can attach their device to another organization\u0027s deployment group and receive its firmware, move devices into that organization\u0027s product, add firmware signing keys and products to it, and have a certificate authority provision devices into its product. Devices that already belong to the other organization are not controlled, and no firmware can be uploaded to it."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T20:09:55.746Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "Users can receive another organization\u2019s firmware and add devices, signing keys and products to it",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr"
},
{
"name": "EEF CNA record for CVE-2026-120730",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-120730.html"
},
{
"name": "OSV record EEF-CVE-2026-120730",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-120730"
},
{
"name": "Introducing commit f58d582 in nerves-hub/nerves_hub_web",
"tags": [
"related"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/commit/f58d58233dbd355c58d3a140107ece18e8863f14"
},
{
"name": "Fix commit c367d7d in nerves-hub/nerves_hub_web",
"tags": [
"patch"
],
"url": "https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fixed release\u0027s migration takes every device off a deployment group that belongs to a different product and logs each one. Upgrading undoes nothing else done this way. After upgrading, check the database for devices whose organization does not own their product, for signing keys in \u003ccode\u003eorg_keys\u003c/code\u003e whose \u003ccode\u003ecreated_by_id\u003c/code\u003e has never been a member of the key\u0027s organization, and for certificate authorities whose JITP product belongs to another organization, and remove what you do not recognize. A device moved wholly into another organization, and a product added to one, leave nothing that sets them apart, so review your organization\u0027s devices and products as well.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The fixed release\u0027s migration takes every device off a deployment group that belongs to a different product and logs each one. Upgrading undoes nothing else done this way. After upgrading, check the database for devices whose organization does not own their product, for signing keys in `org_keys` whose `created_by_id` has never been a member of the key\u0027s organization, and for certificate authorities whose JITP product belongs to another organization, and remove what you do not recognize. A device moved wholly into another organization, and a product added to one, leave nothing that sets them apart, so review your organization\u0027s devices and products as well."
}
],
"value": "The fixed release\u0027s migration takes every device off a deployment group that belongs to a different product and logs each one. Upgrading undoes nothing else done this way. After upgrading, check the database for devices whose organization does not own their product, for signing keys in org_keys whose created_by_id has never been a member of the key\u0027s organization, and for certificate authorities whose JITP product belongs to another organization, and remove what you do not recognize. A device moved wholly into another organization, and a product added to one, leave nothing that sets them apart, so review your organization\u0027s devices and products as well."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAs an admin of organization A, with organization B having an active deployment group whose current release is firmware B:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003e\u003ccode\u003ePOST /api/orgs/\u0026lt;A\u0026gt;/products/\u0026lt;A\u0027s product\u0026gt;/devices\u003c/code\u003e with \u003ccode\u003e{\"identifier\": \"planted\", \"deployment_id\": \u0026lt;B\u0027s deployment group ID\u0026gt;}\u003c/code\u003e. The device is created in A, on B\u0027s deployment group.\u003c/li\u003e\n\u003cli\u003eCreate a device key for it, then connect it, reporting the platform and architecture of firmware B. When the deployment runs, the device is sent an update for firmware B with its download URL.\u003c/li\u003e\n\u003cli\u003eTo move a device instead, \u003ccode\u003ePUT /api/orgs/\u0026lt;A\u0026gt;/products/\u0026lt;A\u0027s product\u0026gt;/devices/\u0026lt;identifier\u0026gt;\u003c/code\u003e with \u003ccode\u003e{\"org_id\": \u0026lt;B\u0027s ID\u0026gt;, \"product_id\": \u0026lt;B\u0027s product ID\u0026gt;}\u003c/code\u003e. The response is \u003ccode\u003e201\u003c/code\u003e, and the device is now in B\u0027s product.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "As an admin of organization A, with organization B having an active deployment group whose current release is firmware B:\n\n1. `POST /api/orgs/\u003cA\u003e/products/\u003cA\u0027s product\u003e/devices` with `{\"identifier\": \"planted\", \"deployment_id\": \u003cB\u0027s deployment group ID\u003e}`. The device is created in A, on B\u0027s deployment group.\n2. Create a device key for it, then connect it, reporting the platform and architecture of firmware B. When the deployment runs, the device is sent an update for firmware B with its download URL.\n3. To move a device instead, `PUT /api/orgs/\u003cA\u003e/products/\u003cA\u0027s product\u003e/devices/\u003cidentifier\u003e` with `{\"org_id\": \u003cB\u0027s ID\u003e, \"product_id\": \u003cB\u0027s product ID\u003e}`. The response is `201`, and the device is now in B\u0027s product."
}
],
"value": "As an admin of organization A, with organization B having an active deployment group whose current release is firmware B:\n\n* POST /api/orgs/\u003cA\u003e/products/\u003cA\u0027s product\u003e/devices with {\"identifier\": \"planted\", \"deployment_id\": \u003cB\u0027s deployment group ID\u003e}. The device is created in A, on B\u0027s deployment group.\n* Create a device key for it, then connect it, reporting the platform and architecture of firmware B. When the deployment runs, the device is sent an update for firmware B with its download URL.\n* To move a device instead, PUT /api/orgs/\u003cA\u003e/products/\u003cA\u0027s product\u003e/devices/\u003cidentifier\u003e with {\"org_id\": \u003cB\u0027s ID\u003e, \"product_id\": \u003cB\u0027s product ID\u003e}. The response is 201, and the device is now in B\u0027s product."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Device API and device forms.\u003c/strong\u003e \u003ccode\u003eNervesHubWeb.API.DeviceController.create/2\u003c/code\u003e sets \u003ccode\u003eorg_id\u003c/code\u003e and \u003ccode\u003eproduct_id\u003c/code\u003e from the route, then hands the rest of the request to \u003ccode\u003eDevice.changeset/2\u003c/code\u003e; \u003ccode\u003eupdate/2\u003c/code\u003e hands the whole request over. The changeset casts \u003ccode\u003eorg_id\u003c/code\u003e, \u003ccode\u003eproduct_id\u003c/code\u003e, \u003ccode\u003edeployment_id\u003c/code\u003e, \u003ccode\u003edeleted_at\u003c/code\u003e and the server-managed update state, so an update can move the device into another organization\u0027s product and either request can place it on another organization\u0027s deployment group. The device settings form in \u003ccode\u003eNervesHubWeb.Components.DevicePage.SettingsTab\u003c/code\u003e and the new device form in \u003ccode\u003eNervesHubWeb.Live.Devices.New\u003c/code\u003e reach the same changeset with the same effect.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Signing key and product forms.\u003c/strong\u003e \u003ccode\u003eNervesHubWeb.Live.Org.SigningKeys\u003c/code\u003e and \u003ccode\u003eNervesHubWeb.Live.Products.New\u003c/code\u003e build their parameters with \u003ccode\u003eEnum.into(submitted, %{\"org_id\" =\u0026gt; session_org_id})\u003c/code\u003e, so a submitted \u003ccode\u003eorg_id\u003c/code\u003e overrides the session\u0027s, and the key or product is created in the organization named by the client.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. JITP settings.\u003c/strong\u003e \u003ccode\u003eNervesHub.Devices.CACertificate.JITP.changeset/2\u003c/code\u003e casts any \u003ccode\u003eproduct_id\u003c/code\u003e, through the API and the dashboard, so devices the certificate authority provisions are created in another organization\u0027s product.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e4. Firmware delivery.\u003c/strong\u003e When a planted device connects, \u003ccode\u003eNervesHub.ManagedDeployments\u003c/code\u003e checks its deployment group membership by firmware version, platform and architecture only, all reported by the device, so it stays on the foreign group and is sent that group\u0027s current release with a download URL.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Device API and device forms.** `NervesHubWeb.API.DeviceController.create/2` sets `org_id` and `product_id` from the route, then hands the rest of the request to `Device.changeset/2`; `update/2` hands the whole request over. The changeset casts `org_id`, `product_id`, `deployment_id`, `deleted_at` and the server-managed update state, so an update can move the device into another organization\u0027s product and either request can place it on another organization\u0027s deployment group. The device settings form in `NervesHubWeb.Components.DevicePage.SettingsTab` and the new device form in `NervesHubWeb.Live.Devices.New` reach the same changeset with the same effect.\n\n**2. Signing key and product forms.** `NervesHubWeb.Live.Org.SigningKeys` and `NervesHubWeb.Live.Products.New` build their parameters with `Enum.into(submitted, %{\"org_id\" =\u003e session_org_id})`, so a submitted `org_id` overrides the session\u0027s, and the key or product is created in the organization named by the client.\n\n**3. JITP settings.** `NervesHub.Devices.CACertificate.JITP.changeset/2` casts any `product_id`, through the API and the dashboard, so devices the certificate authority provisions are created in another organization\u0027s product.\n\n**4. Firmware delivery.** When a planted device connects, `NervesHub.ManagedDeployments` checks its deployment group membership by firmware version, platform and architecture only, all reported by the device, so it stays on the foreign group and is sent that group\u0027s current release with a download URL."
}
],
"value": "1. Device API and device forms. NervesHubWeb.API.DeviceController.create/2 sets org_id and product_id from the route, then hands the rest of the request to Device.changeset/2; update/2 hands the whole request over. The changeset casts org_id, product_id, deployment_id, deleted_at and the server-managed update state, so an update can move the device into another organization\u0027s product and either request can place it on another organization\u0027s deployment group. The device settings form in NervesHubWeb.Components.DevicePage.SettingsTab and the new device form in NervesHubWeb.Live.Devices.New reach the same changeset with the same effect.\n\n2. Signing key and product forms. NervesHubWeb.Live.Org.SigningKeys and NervesHubWeb.Live.Products.New build their parameters with Enum.into(submitted, %{\"org_id\" =\u003e session_org_id}), so a submitted org_id overrides the session\u0027s, and the key or product is created in the organization named by the client.\n\n3. JITP settings. NervesHub.Devices.CACertificate.JITP.changeset/2 casts any product_id, through the API and the dashboard, so devices the certificate authority provisions are created in another organization\u0027s product.\n\n4. Firmware delivery. When a planted device connects, NervesHub.ManagedDeployments checks its deployment group membership by firmware version, platform and architecture only, all reported by the device, so it stays on the foreign group and is sent that group\u0027s current release with a download URL."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-120730",
"datePublished": "2026-11-10T10:43:47.924Z",
"dateReserved": "2026-11-03T03:45:01.695Z",
"dateUpdated": "2026-11-12T17:46:28.444Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120448 (GCVE-0-2026-120448)
Vulnerability from cvelistv5 – Published: 2026-11-02 14:29 – Updated: 2026-11-02 17:32
VLAI
EPSS
VEX
Title
DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint
Summary
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key to a victim's id, then act as that victim to modify profiles and publish or delete content.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:16 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/doramart/DoraCMS/commit/ede38e… | patch |
| https://vul.yulun.ac.cn/20261102/doracms/ | exploit |
| https://github.com/doramart/DoraCMS/blob/70cf0fc6… | technical-description |
| https://www.vulncheck.com/advisories/doracms-thro… | third-party-advisory |
Date Public
2026-11-02 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120448",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:16:18.031755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:32:38.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DoraCMS",
"repo": "https://github.com/doramart/DoraCMS",
"vendor": "doramart",
"versions": [
{
"lessThanOrEqual": "3.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wu Yulun"
},
{
"lang": "en",
"type": "remediation developer",
"value": "doramart"
}
],
"datePublic": "2026-11-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user\u0027s account. Attackers can set the userId field on their own key to a victim\u0027s id, then act as that victim to modify profiles and publish or delete content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:29:07.455Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/doramart/DoraCMS/commit/ede38eb06e0becbee9f19190ebf3ada90a369eb0"
},
{
"tags": [
"exploit"
],
"url": "https://vul.yulun.ac.cn/20261102/doracms/"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/doramart/DoraCMS/blob/70cf0fc6dba66ec51747162a3ce71da43baf251b/server/app/service/apiKey.js"
},
{
"name": "VulnCheck Advisory: DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/doracms-through-3.1.0-mass-assignment-via-api-key-update-endpoint"
}
],
"title": "DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120448",
"datePublished": "2026-11-02T14:29:07.455Z",
"dateReserved": "2026-11-02T12:42:19.119Z",
"dateUpdated": "2026-11-02T17:32:38.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119565 (GCVE-0-2026-119565)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 16:20
VLAI
EPSS
VEX
Title
Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update
Summary
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:20 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/plausible/analytics/blob/v3.2.… | technical-description |
| https://github.com/plausible/analytics/blob/v3.2.… | technical-description |
| https://abraxaslabs.tech/research/plausible-traff… | third-party-advisory |
| https://github.com/plausible/analytics | product |
| https://www.vulncheck.com/advisories/plausible-an… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Plausible | Plausible Analytics |
Affected:
0 , ≤ 3.2.1
(semver)
|
Date Public
2026-10-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119565",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T16:20:12.560587Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:20:23.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Plausible Analytics",
"repo": "https://github.com/plausible/analytics",
"vendor": "Plausible",
"versions": [
{
"lessThanOrEqual": "3.2.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site\u0027s primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site\u0027s traffic alerts and visitor figures."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:12.420Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible/site/traffic_change_notification.ex#L21"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/plausible/analytics/blob/v3.2.1/lib/plausible_web/controllers/site_controller.ex#L481-L494"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/plausible-traffic-notify"
},
{
"tags": [
"product"
],
"url": "https://github.com/plausible/analytics"
},
{
"name": "VulnCheck Advisory: Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/plausible-analytics-through-3.2.1-mass-assignment-via-traffic-change-notification-update"
}
],
"title": "Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119565",
"datePublished": "2026-10-30T11:31:12.420Z",
"dateReserved": "2026-10-30T10:53:31.573Z",
"dateUpdated": "2026-10-30T16:20:23.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118538 (GCVE-0-2026-118538)
Vulnerability from cvelistv5 – Published: 2026-10-28 22:00 – Updated: 2026-10-29 17:21
VLAI
EPSS
VEX
Title
a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
Summary
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:29 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/428015 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/428015/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118538 | third-party-advisory |
| https://vuldb.com/submit/1020095 | third-party-advisory |
| https://github.com/a2ui-project/a2ui/issues/3076 | issue-tracking |
| https://github.com/a2ui-project/a2ui/pull/3107 | issue-trackingpatch |
| https://github.com/a2ui-project/a2ui/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2ui-project | a2ui |
Affected:
0.1
Affected: 0.2 Affected: 0.3 Affected: 0.4 Affected: 0.5 Affected: 0.6 Affected: 0.7 Affected: 0.8 Affected: 0.9 Affected: 0.10 Affected: 0.11 Affected: 0.12.0 cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118538",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:29:53.517109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T17:21:05.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:*"
],
"modules": [
"Renderer"
],
"product": "a2ui",
"vendor": "a2ui-project",
"versions": [
{
"status": "affected",
"version": "0.1"
},
{
"status": "affected",
"version": "0.2"
},
{
"status": "affected",
"version": "0.3"
},
{
"status": "affected",
"version": "0.4"
},
{
"status": "affected",
"version": "0.5"
},
{
"status": "affected",
"version": "0.6"
},
{
"status": "affected",
"version": "0.7"
},
{
"status": "affected",
"version": "0.8"
},
{
"status": "affected",
"version": "0.9"
},
{
"status": "affected",
"version": "0.10"
},
{
"status": "affected",
"version": "0.11"
},
{
"status": "affected",
"version": "0.12.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ez-lbz (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-913",
"description": "Dynamically-Managed Code Resources",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T22:00:18.460Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-428015 | a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/428015"
},
{
"name": "VDB-428015 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/428015/cti"
},
{
"name": "CVE-2026-118538 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118538"
},
{
"name": "Submit #1020095 | a2ui-project a2ui \u003c=0.12.0 CWE-915",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1020095"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/a2ui-project/a2ui/issues/3076"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2ui-project/a2ui/pull/3107"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2ui-project/a2ui/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-28T16:55:01.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118538",
"datePublished": "2026-10-28T22:00:18.460Z",
"dateReserved": "2026-10-28T15:49:52.145Z",
"dateUpdated": "2026-10-29T17:21:05.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
- If available, use features of the language or framework that allow specification of allowlists of attributes or fields that are allowed to be modified. If possible, prefer allowlists over denylists.
- For applications written with Ruby on Rails, use the attr_accessible (allowlist) or attr_protected (denylist) macros in each class that may be used in mass assignment.
Mitigation
Architecture and Design
Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
Mitigation
Implementation
Strategy: Input Validation
For any externally-influenced input, check the input against an allowlist of internal object attributes or fields that are allowed to be modified.
Mitigation
Implementation
Architecture and Design
Strategy: Refactoring
Refactor the code so that object attributes or fields do not need to be dynamically identified, and only expose getter/setter functionality for the intended attributes.
No CAPEC attack patterns related to this CWE.