Vulnerability-Lookup

CVE-2026-32104 (GCVE-0-2026-32104)

Vulnerability from cvelistv5 – Published: 2026-03-11 20:09 – Updated: 2026-03-12 19:48

Title

StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

Summary

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M

References

URL

Tags

https://github.com/withstudiocms/studiocms/securi…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	withstudiocms	studiocms	Affected: < 0.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32104",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-12T19:47:56.872818Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-12T19:48:05.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "studiocms",
          "vendor": "withstudiocms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user\u0027s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T20:09:44.879Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52"
        }
      ],
      "source": {
        "advisory": "GHSA-9v82-xrm4-mp52",
        "discovery": "UNKNOWN"
      },
      "title": "StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User\u0027s Settings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-32104",
    "datePublished": "2026-03-11T20:09:44.879Z",
    "dateReserved": "2026-03-10T22:02:38.854Z",
    "dateUpdated": "2026-03-12T19:48:05.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-32104\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-11T21:16:16.457\",\"lastModified\":\"2026-03-17T15:35:38.860\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user\u0027s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.\"},{\"lang\":\"es\",\"value\":\"StudioCMS es un sistema de gesti\u00f3n de contenido sin cabeza, nativo de Astro y renderizado en el lado del servidor. Antes de la versi\u00f3n 0.4.3, el endpoint updateUserNotifications acepta un ID de usuario del payload de la solicitud y lo utiliza para actualizar las preferencias de notificaci\u00f3n de ese usuario. Verifica que el llamador ha iniciado sesi\u00f3n, pero nunca verifica que el llamador es propietario de la cuenta objetivo (id !== userData.user.id). Cualquier visitante autenticado puede modificar las preferencias de notificaci\u00f3n para cualquier usuario, incluyendo la desactivaci\u00f3n de las notificaciones de administrador para suprimir la detecci\u00f3n de actividad maliciosa. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.4.3.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.4.3\",\"matchCriteriaId\":\"BD3D1012-B2EE-465F-8398-96C5B01C1399\"}]}]}],\"references\":[{\"url\":\"https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32104\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-12T19:47:56.872818Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-12T19:48:00.284Z\"}}], \"cna\": {\"title\": \"StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User\u0027s Settings\", \"source\": {\"advisory\": \"GHSA-9v82-xrm4-mp52\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"withstudiocms\", \"product\": \"studiocms\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.4.3\"}]}], \"references\": [{\"url\": \"https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52\", \"name\": \"https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user\u0027s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-11T20:09:44.879Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-32104\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-12T19:48:05.180Z\", \"dateReserved\": \"2026-03-10T22:02:38.854Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-11T20:09:44.879Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-9V82-XRM4-MP52

Vulnerability from github – Published: 2026-03-12 14:49 – Updated: 2026-03-12 14:49

Summary

StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings

Details

Summary

The updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity.

Details

The vulnerable handler is in packages/studiocms/frontend/pages/studiocms_api/_handlers/dashboard/users.ts:257-311:

.handle(
    'updateUserNotifications',
    Effect.fn(function* ({ payload: { id, notifications } }) {
        // ...demo mode checks...

        const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);

        // Line 274: Only checks login + visitor level — any authenticated user passes
        if (!userData.isLoggedIn || !userData.userPermissionLevel.isVisitor) {
            return yield* new DashboardAPIError({ error: 'Unauthorized' });
        }

        // Line 280: Uses 'id' from payload — NOT userData.user.id
        const existingUser = yield* sdk.GET.users.byId(id);

        // Line 288: Updates target user using attacker-controlled 'id'
        const updatedData = yield* sdk.AUTH.user.update({
            userId: id,       // ← attacker controls this
            userData: {
                id,            // ← attacker controls this
                name: existingUser.name,
                username: existingUser.username,
                updatedAt: new Date().toISOString(),
                emailVerified: existingUser.emailVerified,
                createdAt: undefined,
                notifications,  // ← attacker controls this
            },
        });
    })
)

For comparison, the updateUserProfile handler in dashboard/profile.ts correctly uses userData.user.id instead of a user-supplied ID, preventing IDOR.

PoC

# 1. Log in as a visitor-role user, obtain session cookie

# 2. Disable all notifications for the admin user
curl -X POST 'http://localhost:4321/studiocms_api/dashboard/update-user-notifications' \
  -H 'Cookie: studiocms-session=<visitor-session-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "id": "<admin-user-id>",
    "notifications": ""
  }'

# Expected: 403 Forbidden
# Actual: 200 {"message":"User notifications updated successfully"}

Impact

Any authenticated visitor can disable notification preferences for admin/owner accounts, suppressing alerts about new user creation, account changes, and user deletions
Enables attack chaining — suppress admin notifications first, then perform other malicious actions with reduced detection risk
Can modify any user's notification preferences (enable unwanted notifications or disable critical ones)

Recommended Fix

Add an ownership check in packages/studiocms/frontend/pages/studiocms_api/_handlers/dashboard/users.ts:

// After the login check at line 274, add:
if (id !== userData.user?.id && !userData.userPermissionLevel.isAdmin) {
    return yield* new DashboardAPIError({
        error: 'Unauthorized: cannot modify another user\'s notification preferences',
    });
}

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.4.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "studiocms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32104"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T14:49:41Z",
    "nvd_published_at": "2026-03-11T21:16:16Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `updateUserNotifications` endpoint accepts a user ID from the request payload and uses it to update that user\u0027s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (`id !== userData.user.id`). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity.\n\n## Details\n\nThe vulnerable handler is in `packages/studiocms/frontend/pages/studiocms_api/_handlers/dashboard/users.ts:257-311`:\n\n```typescript\n.handle(\n    \u0027updateUserNotifications\u0027,\n    Effect.fn(function* ({ payload: { id, notifications } }) {\n        // ...demo mode checks...\n\n        const [sdk, userData] = yield* Effect.all([SDKCore, CurrentUser]);\n\n        // Line 274: Only checks login + visitor level \u2014 any authenticated user passes\n        if (!userData.isLoggedIn || !userData.userPermissionLevel.isVisitor) {\n            return yield* new DashboardAPIError({ error: \u0027Unauthorized\u0027 });\n        }\n\n        // Line 280: Uses \u0027id\u0027 from payload \u2014 NOT userData.user.id\n        const existingUser = yield* sdk.GET.users.byId(id);\n\n        // Line 288: Updates target user using attacker-controlled \u0027id\u0027\n        const updatedData = yield* sdk.AUTH.user.update({\n            userId: id,       // \u2190 attacker controls this\n            userData: {\n                id,            // \u2190 attacker controls this\n                name: existingUser.name,\n                username: existingUser.username,\n                updatedAt: new Date().toISOString(),\n                emailVerified: existingUser.emailVerified,\n                createdAt: undefined,\n                notifications,  // \u2190 attacker controls this\n            },\n        });\n    })\n)\n```\n\nFor comparison, the `updateUserProfile` handler in `dashboard/profile.ts` correctly uses `userData.user.id` instead of a user-supplied ID, preventing IDOR.\n\n## PoC\n\n```bash\n# 1. Log in as a visitor-role user, obtain session cookie\n\n# 2. Disable all notifications for the admin user\ncurl -X POST \u0027http://localhost:4321/studiocms_api/dashboard/update-user-notifications\u0027 \\\n  -H \u0027Cookie: studiocms-session=\u003cvisitor-session-token\u003e\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\n    \"id\": \"\u003cadmin-user-id\u003e\",\n    \"notifications\": \"\"\n  }\u0027\n\n# Expected: 403 Forbidden\n# Actual: 200 {\"message\":\"User notifications updated successfully\"}\n```\n\n## Impact\n\n- Any authenticated visitor can disable notification preferences for admin/owner accounts, suppressing alerts about new user creation, account changes, and user deletions\n- Enables attack chaining \u2014 suppress admin notifications first, then perform other malicious actions with reduced detection risk\n- Can modify any user\u0027s notification preferences (enable unwanted notifications or disable critical ones)\n\n## Recommended Fix\n\nAdd an ownership check in `packages/studiocms/frontend/pages/studiocms_api/_handlers/dashboard/users.ts`:\n\n```typescript\n// After the login check at line 274, add:\nif (id !== userData.user?.id \u0026\u0026 !userData.userPermissionLevel.isAdmin) {\n    return yield* new DashboardAPIError({\n        error: \u0027Unauthorized: cannot modify another user\\\u0027s notification preferences\u0027,\n    });\n}\n```",
  "id": "GHSA-9v82-xrm4-mp52",
  "modified": "2026-03-12T14:49:41Z",
  "published": "2026-03-12T14:49:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32104"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withstudiocms/studiocms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User\u0027s Settings"
}

FKIE_CVE-2026-32104

Vulnerability from fkie_nvd - Published: 2026-03-11 21:16 - Updated: 2026-03-17 15:35

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	studiocms	studiocms	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:studiocms:studiocms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD3D1012-B2EE-465F-8398-96C5B01C1399",
              "versionEndExcluding": "0.4.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user\u0027s notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account (id !== userData.user.id). Any authenticated visitor can modify notification preferences for any user, including disabling admin notifications to suppress detection of malicious activity. This vulnerability is fixed in 0.4.3."
    },
    {
      "lang": "es",
      "value": "StudioCMS es un sistema de gesti\u00f3n de contenido sin cabeza, nativo de Astro y renderizado en el lado del servidor. Antes de la versi\u00f3n 0.4.3, el endpoint updateUserNotifications acepta un ID de usuario del payload de la solicitud y lo utiliza para actualizar las preferencias de notificaci\u00f3n de ese usuario. Verifica que el llamador ha iniciado sesi\u00f3n, pero nunca verifica que el llamador es propietario de la cuenta objetivo (id !== userData.user.id). Cualquier visitante autenticado puede modificar las preferencias de notificaci\u00f3n para cualquier usuario, incluyendo la desactivaci\u00f3n de las notificaciones de administrador para suprimir la detecci\u00f3n de actividad maliciosa. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.4.3."
    }
  ],
  "id": "CVE-2026-32104",
  "lastModified": "2026-03-17T15:35:38.860",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-11T21:16:16.457",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-9v82-xrm4-mp52"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-32104 (GCVE-0-2026-32104)

GHSA-9V82-XRM4-MP52

Summary

Details

PoC

Impact

Recommended Fix

FKIE_CVE-2026-32104

Tags

Sightings

Nomenclature