CWE-266
Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CVE-2026-5484 (GCVE-0-2026-5484)
Vulnerability from cvelistv5 – Published: 2026-04-03 19:45 – Updated: 2026-04-08 18:52 X_Open Source
VLAI
Title
BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control
Summary
A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 26.03.1 is able to address this issue. This patch is called 8a59895ba063040cc8dafd82e94024c406df3d04. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/355091 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/355091/cti | signaturepermissions-required |
| https://vuldb.com/submit/781762 | third-party-advisory |
| https://github.com/Ghufran2/CVE-Bookstack/blob/ma… | exploit |
| https://www.bookstackapp.com/blog/bookstack-relea… | related |
| https://github.com/BookStackApp/BookStack/commit/… | patch |
| https://github.com/BookStackApp/BookStack/release… | patch |
| https://github.com/BookStackApp/BookStack/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| BookStackApp | BookStack |
Affected:
26.03
Unaffected: 26.03.1 cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5484",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T18:52:37.756630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T18:52:44.563Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:bookstackapp:bookstack:*:*:*:*:*:*:*:*"
],
"modules": [
"Chapter Export Handler"
],
"product": "BookStack",
"vendor": "BookStackApp",
"versions": [
{
"status": "affected",
"version": "26.03"
},
{
"status": "unaffected",
"version": "26.03.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ghufran Khan (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in BookStackApp BookStack up to 26.03. Affected is the function chapterToMarkdown of the file app/Exports/ExportFormatter.php of the component Chapter Export Handler. Executing a manipulation of the argument pages can lead to improper access controls. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 26.03.1 is able to address this issue. This patch is called 8a59895ba063040cc8dafd82e94024c406df3d04. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-03T19:45:12.967Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-355091 | BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/355091"
},
{
"name": "VDB-355091 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/355091/cti"
},
{
"name": "Submit #781762 | BookstackApp BookStack v25.12.9 Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/781762"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Ghufran2/CVE-Bookstack/blob/main/Permission%20Bypass%20in%20Markdown%20Chapter%20Export"
},
{
"tags": [
"related"
],
"url": "https://www.bookstackapp.com/blog/bookstack-release-v26-03-1/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/BookStackApp/BookStack/commit/8a59895ba063040cc8dafd82e94024c406df3d04"
},
{
"tags": [
"patch"
],
"url": "https://github.com/BookStackApp/BookStack/releases/tag/v26.03.1"
},
{
"tags": [
"product"
],
"url": "https://github.com/BookStackApp/BookStack/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-04-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-03T15:16:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5484",
"datePublished": "2026-04-03T19:45:12.967Z",
"dateReserved": "2026-04-03T13:10:53.751Z",
"dateUpdated": "2026-04-08T18:52:44.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5526 (GCVE-0-2026-5526)
Vulnerability from cvelistv5 – Published: 2026-04-04 22:15 – Updated: 2026-04-06 14:51
VLAI
Title
Tenda 4G03 Pro httpd access control
Summary
A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/355279 | vdb-entry |
| https://vuldb.com/vuln/355279/cti | signaturepermissions-required |
| https://vuldb.com/submit/782052 | third-party-advisory |
| https://www.tenda.com.cn/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tenda | 4G03 Pro |
Affected:
1.0
Affected: 1.1 Affected: 04.03.01.0 Affected: 04.03.01.1 Affected: 04.03.01.2 Affected: 04.03.01.3 Affected: 04.03.01.4 Affected: 04.03.01.5 Affected: 04.03.01.6 Affected: 04.03.01.7 Affected: 04.03.01.8 Affected: 04.03.01.9 Affected: 04.03.01.10 Affected: 04.03.01.11 Affected: 04.03.01.12 Affected: 04.03.01.13 Affected: 04.03.01.14 Affected: 04.03.01.15 Affected: 04.03.01.16 Affected: 04.03.01.17 Affected: 04.03.01.18 Affected: 04.03.01.19 Affected: 04.03.01.20 Affected: 04.03.01.21 Affected: 04.03.01.22 Affected: 04.03.01.23 Affected: 04.03.01.24 Affected: 04.03.01.25 Affected: 04.03.01.26 Affected: 04.03.01.27 Affected: 04.03.01.28 Affected: 04.03.01.29 Affected: 04.03.01.30 Affected: 04.03.01.31 Affected: 04.03.01.32 Affected: 04.03.01.33 Affected: 04.03.01.34 Affected: 04.03.01.35 Affected: 04.03.01.36 Affected: 04.03.01.37 Affected: 04.03.01.38 Affected: 04.03.01.39 Affected: 04.03.01.40 Affected: 04.03.01.41 Affected: 04.03.01.42 Affected: 04.03.01.43 Affected: 04.03.01.44 Affected: 04.03.01.45 Affected: 04.03.01.46 Affected: 04.03.01.47 Affected: 04.03.01.48 Affected: 04.03.01.49 Affected: 04.03.01.50 Affected: 04.03.01.51 Affected: 04.03.01.52 Affected: 04.03.01.53 Affected: 192.168.0.0 Affected: 192.168.0.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5526",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T14:28:18.964474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T14:51:31.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "4G03 Pro",
"vendor": "Tenda",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1"
},
{
"status": "affected",
"version": "04.03.01.0"
},
{
"status": "affected",
"version": "04.03.01.1"
},
{
"status": "affected",
"version": "04.03.01.2"
},
{
"status": "affected",
"version": "04.03.01.3"
},
{
"status": "affected",
"version": "04.03.01.4"
},
{
"status": "affected",
"version": "04.03.01.5"
},
{
"status": "affected",
"version": "04.03.01.6"
},
{
"status": "affected",
"version": "04.03.01.7"
},
{
"status": "affected",
"version": "04.03.01.8"
},
{
"status": "affected",
"version": "04.03.01.9"
},
{
"status": "affected",
"version": "04.03.01.10"
},
{
"status": "affected",
"version": "04.03.01.11"
},
{
"status": "affected",
"version": "04.03.01.12"
},
{
"status": "affected",
"version": "04.03.01.13"
},
{
"status": "affected",
"version": "04.03.01.14"
},
{
"status": "affected",
"version": "04.03.01.15"
},
{
"status": "affected",
"version": "04.03.01.16"
},
{
"status": "affected",
"version": "04.03.01.17"
},
{
"status": "affected",
"version": "04.03.01.18"
},
{
"status": "affected",
"version": "04.03.01.19"
},
{
"status": "affected",
"version": "04.03.01.20"
},
{
"status": "affected",
"version": "04.03.01.21"
},
{
"status": "affected",
"version": "04.03.01.22"
},
{
"status": "affected",
"version": "04.03.01.23"
},
{
"status": "affected",
"version": "04.03.01.24"
},
{
"status": "affected",
"version": "04.03.01.25"
},
{
"status": "affected",
"version": "04.03.01.26"
},
{
"status": "affected",
"version": "04.03.01.27"
},
{
"status": "affected",
"version": "04.03.01.28"
},
{
"status": "affected",
"version": "04.03.01.29"
},
{
"status": "affected",
"version": "04.03.01.30"
},
{
"status": "affected",
"version": "04.03.01.31"
},
{
"status": "affected",
"version": "04.03.01.32"
},
{
"status": "affected",
"version": "04.03.01.33"
},
{
"status": "affected",
"version": "04.03.01.34"
},
{
"status": "affected",
"version": "04.03.01.35"
},
{
"status": "affected",
"version": "04.03.01.36"
},
{
"status": "affected",
"version": "04.03.01.37"
},
{
"status": "affected",
"version": "04.03.01.38"
},
{
"status": "affected",
"version": "04.03.01.39"
},
{
"status": "affected",
"version": "04.03.01.40"
},
{
"status": "affected",
"version": "04.03.01.41"
},
{
"status": "affected",
"version": "04.03.01.42"
},
{
"status": "affected",
"version": "04.03.01.43"
},
{
"status": "affected",
"version": "04.03.01.44"
},
{
"status": "affected",
"version": "04.03.01.45"
},
{
"status": "affected",
"version": "04.03.01.46"
},
{
"status": "affected",
"version": "04.03.01.47"
},
{
"status": "affected",
"version": "04.03.01.48"
},
{
"status": "affected",
"version": "04.03.01.49"
},
{
"status": "affected",
"version": "04.03.01.50"
},
{
"status": "affected",
"version": "04.03.01.51"
},
{
"status": "affected",
"version": "04.03.01.52"
},
{
"status": "affected",
"version": "04.03.01.53"
},
{
"status": "affected",
"version": "192.168.0.0"
},
{
"status": "affected",
"version": "192.168.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CoreNode (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB Vulnerability Moderation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-04T22:15:14.338Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-355279 | Tenda 4G03 Pro httpd access control",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/355279"
},
{
"name": "VDB-355279 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/355279/cti"
},
{
"name": "Submit #782052 | Tenda Tenda 4G03 Pro V1.0 V04.03.01.53 Authentication Bypass Issues",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/782052"
},
{
"tags": [
"product"
],
"url": "https://www.tenda.com.cn/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-04T08:25:10.000Z",
"value": "VulDB entry last update"
}
],
"title": "Tenda 4G03 Pro httpd access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5526",
"datePublished": "2026-04-04T22:15:14.338Z",
"dateReserved": "2026-04-04T06:19:57.834Z",
"dateUpdated": "2026-04-06T14:51:31.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5529 (GCVE-0-2026-5529)
Vulnerability from cvelistv5 – Published: 2026-04-05 00:15 – Updated: 2026-04-06 19:11
VLAI
Title
Dromara lamp-cloud DefUserController pageUser improper authorization
Summary
A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/355282 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/355282/cti | signaturepermissions-required |
| https://vuldb.com/submit/782103 | third-party-advisory |
| https://github.com/dromara/lamp-cloud/issues/403 | exploitissue-tracking |
| https://github.com/dromara/lamp-cloud/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dromara | lamp-cloud |
Affected:
5.8.0
Affected: 5.8.1 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5529",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T19:11:09.815617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T19:11:19.646Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"DefUserController"
],
"product": "lamp-cloud",
"vendor": "Dromara",
"versions": [
{
"status": "affected",
"version": "5.8.0"
},
{
"status": "affected",
"version": "5.8.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "aibot88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUser of the component DefUserController. Performing a manipulation results in improper authorization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T00:15:13.302Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-355282 | Dromara lamp-cloud DefUserController pageUser improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/355282"
},
{
"name": "VDB-355282 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/355282/cti"
},
{
"name": "Submit #782103 | Dromara lamp-cloud 5.8.1 Broken object property level authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/782103"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/dromara/lamp-cloud/issues/403"
},
{
"tags": [
"product"
],
"url": "https://github.com/dromara/lamp-cloud/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-04T08:32:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dromara lamp-cloud DefUserController pageUser improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5529",
"datePublished": "2026-04-05T00:15:13.302Z",
"dateReserved": "2026-04-04T06:26:51.702Z",
"dateUpdated": "2026-04-06T19:11:19.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5569 (GCVE-0-2026-5569)
Vulnerability from cvelistv5 – Published: 2026-04-05 13:15 – Updated: 2026-04-06 16:18
VLAI
Title
Technostrobe HI-LED-WR120-G2 Endpoint access control
Summary
A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/355339 | vdb-entry |
| https://vuldb.com/vuln/355339/cti | signaturepermissions-required |
| https://vuldb.com/submit/783322 | third-party-advisory |
| https://github.com/shiky8/my--cve-vulnerability-r… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Technostrobe | HI-LED-WR120-G2 |
Affected:
5.5.0.1R6.03.30
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5569",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T16:17:54.054807Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T16:18:11.013Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Endpoint"
],
"product": "HI-LED-WR120-G2",
"vendor": "Technostrobe",
"versions": [
{
"status": "affected",
"version": "5.5.0.1R6.03.30"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shiky8 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:W/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-05T13:15:15.167Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-355339 | Technostrobe HI-LED-WR120-G2 Endpoint access control",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/355339"
},
{
"name": "VDB-355339 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/355339/cti"
},
{
"name": "Submit #783322 | Technostrobe HI-LED-WR120-G2 Obstruction Lighting Controller 5.5.0.1R6.03.30 Broken Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/783322"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/shiky8/my--cve-vulnerability-research/blob/main/my_VulnDB_cves/CVE-TECHNOSTROBE-01-BrokenAccessControl.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-04T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-04T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-04T16:46:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "Technostrobe HI-LED-WR120-G2 Endpoint access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5569",
"datePublished": "2026-04-05T13:15:15.167Z",
"dateReserved": "2026-04-04T14:40:50.587Z",
"dateUpdated": "2026-04-06T16:18:11.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5642 (GCVE-0-2026-5642)
Vulnerability from cvelistv5 – Published: 2026-04-06 09:30 – Updated: 2026-04-06 18:32
VLAI
Title
Cyber-III Student-Management-System HTTP POST Request update.php improper authorization
Summary
A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the file /viva/update.php of the component HTTP POST Request Handler. This manipulation of the argument Name causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/355430 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/355430/cti | signaturepermissions-required |
| https://vuldb.com/submit/785857 | third-party-advisory |
| https://github.com/Cyber-III/Student-Management-S… | exploitissue-tracking |
| https://github.com/Cyber-III/Student-Management-System/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cyber-III | Student-Management-System |
Affected:
1a938fa61e9f735078e9b291d2e6215b4942af3f
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5642",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-06T18:31:56.630004Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T18:32:11.791Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"HTTP POST Request Handler"
],
"product": "Student-Management-System",
"vendor": "Cyber-III",
"versions": [
{
"status": "affected",
"version": "1a938fa61e9f735078e9b291d2e6215b4942af3f"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "xhh400plus (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This affects an unknown function of the file /viva/update.php of the component HTTP POST Request Handler. This manipulation of the argument Name causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-06T09:30:14.060Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-355430 | Cyber-III Student-Management-System HTTP POST Request update.php improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/355430"
},
{
"name": "VDB-355430 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/355430/cti"
},
{
"name": "Submit #785857 | Cyber-III Student-Management-System 1.0 Insecure Direct Object Reference",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/785857"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Cyber-III/Student-Management-System/issues/236"
},
{
"tags": [
"product"
],
"url": "https://github.com/Cyber-III/Student-Management-System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-05T22:41:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "Cyber-III Student-Management-System HTTP POST Request update.php improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5642",
"datePublished": "2026-04-06T09:30:14.060Z",
"dateReserved": "2026-04-05T20:36:07.502Z",
"dateUpdated": "2026-04-06T18:32:11.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-5999 (GCVE-0-2026-5999)
Vulnerability from cvelistv5 – Published: 2026-04-10 01:45 – Updated: 2026-04-10 17:05
VLAI
Title
JeecgBoot SysAnnouncementController improper authorization
Summary
A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/356553 | vdb-entry |
| https://vuldb.com/vuln/356553/cti | signaturepermissions-required |
| https://vuldb.com/submit/793656 | third-party-advisory |
| https://github.com/jeecgboot/JeecgBoot/issues/9508 | exploitissue-tracking |
| https://github.com/jeecgboot/JeecgBoot/issues/950… | issue-tracking |
| https://github.com/jeecgboot/JeecgBoot/ | product |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-5999",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T17:04:52.678246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T17:05:03.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"SysAnnouncementController"
],
"product": "JeecgBoot",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "3.9.0"
},
{
"status": "affected",
"version": "3.9.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "XinX (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T01:45:14.036Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-356553 | JeecgBoot SysAnnouncementController improper authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/356553"
},
{
"name": "VDB-356553 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/356553/cti"
},
{
"name": "Submit #793656 | jeecgboot web 3.9.1 Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/793656"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jeecgboot/JeecgBoot/issues/9508"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jeecgboot/JeecgBoot/issues/9508#issuecomment-4199090102"
},
{
"tags": [
"product"
],
"url": "https://github.com/jeecgboot/JeecgBoot/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-09T15:08:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "JeecgBoot SysAnnouncementController improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-5999",
"datePublished": "2026-04-10T01:45:14.036Z",
"dateReserved": "2026-04-09T13:03:06.047Z",
"dateUpdated": "2026-04-10T17:05:03.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6105 (GCVE-0-2026-6105)
Vulnerability from cvelistv5 – Published: 2026-04-11 22:00 – Updated: 2026-04-13 17:41
VLAI
Title
perfree go-fastdfs-web doInstall InstallController.java improper authorization
Summary
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/356964 | vdb-entry |
| https://vuldb.com/vuln/356964/cti | signaturepermissions-required |
| https://vuldb.com/submit/781598 | third-party-advisory |
| https://gitee.com/ying-xiujie/cve/issues/IGB6M9 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| perfree | go-fastdfs-web |
Affected:
1.3.0
Affected: 1.3.1 Affected: 1.3.2 Affected: 1.3.3 Affected: 1.3.4 Affected: 1.3.5 Affected: 1.3.6 Affected: 1.3.7 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T17:41:35.538403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T17:41:44.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"doInstall Interface"
],
"product": "go-fastdfs-web",
"vendor": "perfree",
"versions": [
{
"status": "affected",
"version": "1.3.0"
},
{
"status": "affected",
"version": "1.3.1"
},
{
"status": "affected",
"version": "1.3.2"
},
{
"status": "affected",
"version": "1.3.3"
},
{
"status": "affected",
"version": "1.3.4"
},
{
"status": "affected",
"version": "1.3.5"
},
{
"status": "affected",
"version": "1.3.6"
},
{
"status": "affected",
"version": "1.3.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yingxiujie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-11T22:00:24.856Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-356964 | perfree go-fastdfs-web doInstall InstallController.java improper authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/356964"
},
{
"name": "VDB-356964 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/356964/cti"
},
{
"name": "Submit #781598 | perfree go-fastdfs-web v1.3.7 Unauthorized takeover of the platform Vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/781598"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://gitee.com/ying-xiujie/cve/issues/IGB6M9"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-11T09:19:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "perfree go-fastdfs-web doInstall InstallController.java improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-6105",
"datePublished": "2026-04-11T22:00:24.856Z",
"dateReserved": "2026-04-11T07:14:44.771Z",
"dateUpdated": "2026-04-13T17:41:44.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6201 (GCVE-0-2026-6201)
Vulnerability from cvelistv5 – Published: 2026-04-13 19:00 – Updated: 2026-04-16 13:26
VLAI
Title
CodeAstro Online Job Portal Delete Job Posting job-delete.php access control
Summary
A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/357123 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/357123/cti | signaturepermissions-required |
| https://vuldb.com/submit/797515 | third-party-advisory |
| https://github.com/Xmyronn/CodeAstro-Online-Job-P… | exploit |
| https://codeastro.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CodeAstro | Online Job Portal |
Affected:
1.0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6201",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-16T13:21:00.957059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T13:26:40.778Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Delete Job Posting Handler"
],
"product": "Online Job Portal",
"vendor": "CodeAstro",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "imad alvi (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /jobs/job-delete.php of the component Delete Job Posting Handler. Such manipulation of the argument ID leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T19:00:18.544Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-357123 | CodeAstro Online Job Portal Delete Job Posting job-delete.php access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/357123"
},
{
"name": "VDB-357123 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/357123/cti"
},
{
"name": "Submit #797515 | CodeAstro Online Job Portal Project in PHP MySQL 1.0 Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/797515"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Xmyronn/CodeAstro-Online-Job-Portal-IDOR.git"
},
{
"tags": [
"product"
],
"url": "https://codeastro.com/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-13T10:55:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "CodeAstro Online Job Portal Delete Job Posting job-delete.php access control"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-6201",
"datePublished": "2026-04-13T19:00:18.544Z",
"dateReserved": "2026-04-13T08:50:36.262Z",
"dateUpdated": "2026-04-16T13:26:40.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6564 (GCVE-0-2026-6564)
Vulnerability from cvelistv5 – Published: 2026-04-19 09:30 – Updated: 2026-04-20 16:09
VLAI
Title
EMQ EMQX Enterprise Session Handling improper authorization
Summary
A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/358201 | vdb-entry |
| https://vuldb.com/vuln/358201/cti | signaturepermissions-required |
| https://vuldb.com/submit/789924 | third-party-advisory |
| https://github.com/cailiujia/CVE | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| EMQ | EMQX Enterprise |
Affected:
6.0
Affected: 6.1.0 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6564",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-20T16:09:36.204385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T16:09:52.702Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Session Handling"
],
"product": "EMQX Enterprise",
"vendor": "EMQ",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "CCCaaa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-19T09:30:15.159Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-358201 | EMQ EMQX Enterprise Session Handling improper authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/358201"
},
{
"name": "VDB-358201 | CTI Indicators (IOB, IOC, TTP)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/358201/cti"
},
{
"name": "Submit #789924 | EMQ Technologies Inc. EMQX Enterprise 6.1.0 Improper Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/789924"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/cailiujia/CVE"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-18T18:12:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "EMQ EMQX Enterprise Session Handling improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-6564",
"datePublished": "2026-04-19T09:30:15.159Z",
"dateReserved": "2026-04-18T16:06:43.207Z",
"dateUpdated": "2026-04-20T16:09:52.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6572 (GCVE-0-2026-6572)
Vulnerability from cvelistv5 – Published: 2026-04-19 12:15 – Updated: 2026-04-20 16:11
VLAI
Title
Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization
Summary
A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper authorization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/358206 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/358206/cti | signaturepermissions-required |
| https://vuldb.com/submit/789988 | third-party-advisory |
| https://vulnplus-note.wetolink.com/share/PLCI4v0BWaF8 | broken-linkexploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Collabora | KodExplorer |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 Affected: 4.9 Affected: 4.10 Affected: 4.11 Affected: 4.12 Affected: 4.13 Affected: 4.14 Affected: 4.15 Affected: 4.16 Affected: 4.17 Affected: 4.18 Affected: 4.19 Affected: 4.20 Affected: 4.21 Affected: 4.22 Affected: 4.23 Affected: 4.24 Affected: 4.25 Affected: 4.26 Affected: 4.27 Affected: 4.28 Affected: 4.29 Affected: 4.30 Affected: 4.31 Affected: 4.32 Affected: 4.33 Affected: 4.34 Affected: 4.35 Affected: 4.36 Affected: 4.37 Affected: 4.38 Affected: 4.39 Affected: 4.40 Affected: 4.41 Affected: 4.42 Affected: 4.43 Affected: 4.44 Affected: 4.45 Affected: 4.46 Affected: 4.47 Affected: 4.48 Affected: 4.49 Affected: 4.50 Affected: 4.51 Affected: 4.52 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-20T16:11:11.770230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T16:11:35.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"fileUpload Endpoint"
],
"product": "KodExplorer",
"vendor": "Collabora",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
},
{
"status": "affected",
"version": "4.9"
},
{
"status": "affected",
"version": "4.10"
},
{
"status": "affected",
"version": "4.11"
},
{
"status": "affected",
"version": "4.12"
},
{
"status": "affected",
"version": "4.13"
},
{
"status": "affected",
"version": "4.14"
},
{
"status": "affected",
"version": "4.15"
},
{
"status": "affected",
"version": "4.16"
},
{
"status": "affected",
"version": "4.17"
},
{
"status": "affected",
"version": "4.18"
},
{
"status": "affected",
"version": "4.19"
},
{
"status": "affected",
"version": "4.20"
},
{
"status": "affected",
"version": "4.21"
},
{
"status": "affected",
"version": "4.22"
},
{
"status": "affected",
"version": "4.23"
},
{
"status": "affected",
"version": "4.24"
},
{
"status": "affected",
"version": "4.25"
},
{
"status": "affected",
"version": "4.26"
},
{
"status": "affected",
"version": "4.27"
},
{
"status": "affected",
"version": "4.28"
},
{
"status": "affected",
"version": "4.29"
},
{
"status": "affected",
"version": "4.30"
},
{
"status": "affected",
"version": "4.31"
},
{
"status": "affected",
"version": "4.32"
},
{
"status": "affected",
"version": "4.33"
},
{
"status": "affected",
"version": "4.34"
},
{
"status": "affected",
"version": "4.35"
},
{
"status": "affected",
"version": "4.36"
},
{
"status": "affected",
"version": "4.37"
},
{
"status": "affected",
"version": "4.38"
},
{
"status": "affected",
"version": "4.39"
},
{
"status": "affected",
"version": "4.40"
},
{
"status": "affected",
"version": "4.41"
},
{
"status": "affected",
"version": "4.42"
},
{
"status": "affected",
"version": "4.43"
},
{
"status": "affected",
"version": "4.44"
},
{
"status": "affected",
"version": "4.45"
},
{
"status": "affected",
"version": "4.46"
},
{
"status": "affected",
"version": "4.47"
},
{
"status": "affected",
"version": "4.48"
},
{
"status": "affected",
"version": "4.49"
},
{
"status": "affected",
"version": "4.50"
},
{
"status": "affected",
"version": "4.51"
},
{
"status": "affected",
"version": "4.52"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "vulnplusbot (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown functionality of the file /app/controller/share.class.php of the component fileUpload Endpoint. The manipulation of the argument fileUpload leads to improper authorization. Remote exploitation of the attack is possible. The attack\u0027s complexity is rated as high. The exploitation is known to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.1,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-19T12:15:14.167Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-358206 | Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/358206"
},
{
"name": "VDB-358206 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/358206/cti"
},
{
"name": "Submit #789988 | KodExplorer 4.52 Business Logic Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/789988"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://vulnplus-note.wetolink.com/share/PLCI4v0BWaF8"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-18T21:12:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-6572",
"datePublished": "2026-04-19T12:15:14.167Z",
"dateReserved": "2026-04-18T19:07:07.145Z",
"dateUpdated": "2026-04-20T16:11:35.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation ID: MIT-1
Phases: Architecture and Design, Operation
Description:
- Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation ID: MIT-17
Phases: Architecture and Design, Operation
Strategy: Environment Hardening
Description:
- Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.