Base de CVEs

CVE-2026-48860 Média · 6.5 CWE-863 10/06/2026

Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN allowlist. The inet_tls_dist:check_ip/1 function, which enforces a LAN allowlist for Erlang distribution over TLS, calls inet:sockname/1 instead of inet:peername/1 to obtain the peer's IP address. Because inet:sockname/1 returns the local socket address, both the local IP and the supposed peer IP resolve to the same value, causing the subnet mask comparison to always succeed regardless of the actual remote address. Any holder of a CA-signed TLS certificate can therefore bypass the LAN restriction and gain full Erlang distribution access to the node, including rpc:call/4 and code:load_binary/3. This vulnerability is associated with program file lib/ssl/src/inet_tls_dist.erl. This issue affects OTP from OTP 26.0 before OTP 27.3.4.13, OTP 28.5.0.2, and OTP 29.0.2, corresponding to ssl from 11.0 before 11.2.12.9, 11.6.0.2, and 11.7.2.

CVE-2026-24724 Alta · 8.1 CWE-863 10/06/2026

File Station 5

An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

CVE-2026-48303 Crítica · 10.0 CWE-863 09/06/2026

Adobe Campaign Classic (ACC) | Autorização incorreta (CWE-863)

O Adobe Campaign Classic (ACC) nas versões 7.4.3 build 9394 e anteriores é afetado por uma vulnerabilidade de Autorização incorreta que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração deste problema não requer interação do usuário. O escopo é alterado.

CVE-2026-47929 Alta · 8.4 CWE-863 09/06/2026

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-47910 Média · 6.3 CWE-863 09/06/2026

Dreamweaver Desktop | Incorrect Authorization (CWE-863)

Dreamweaver Desktop versions 21.7 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

CVE-2026-41852 Média · 5.3 CWE-863 09/06/2026

Spring Framework Arbitrary Method Invocation in SpEL Expressions

A vulnerability in Spring Expression Language (SpEL) evaluation logic allows for arbitrary zero-argument method invocation, even within restricted or read-only contexts, which may allow an attacker to invoke unintended application logic. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

CVE-2026-48507 Alta · 7.1 CWE-863 08/06/2026

Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users

Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` permission to lock every admin out of the instance by editing the `activated` flag (which determines whether or not a user can login) and the `ldap_import` flag, which determines whether or not the user can request a password reset. Version 8.6.0 contains a patch.

CVE-2026-7765 Média · 5.3 CWE-863 08/06/2026

User Messages widget leaked issuer messages on shared dashboards

Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.

CVE-2026-21036 Média · 5.5 CWE-863 05/06/2026

Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to...

Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to access sensitive information.

CVE-2026-21031 Alta · 7.8 CWE-863 05/06/2026

Incorrect Authorization em Samsung Android

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.

CVE-2026-42547 Média · 5.4 CWE-863 04/06/2026

IRIS Alerts Can be Falsely Attributed to Customers

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. In versions prior to 2.4.28, users can create alerts for customers that are not assigned to them. This can be abused to falsely attribute fake alerts to customers. In combination with Cross-Site Scripting, this can also be used to exfiltrate alerts from other customers. Version 2.4.28 contains a patch.

CVE-2026-41235 Alta · 8.6 CWE-863 04/06/2026

Froxlor has an authorization bypass in FTP shell assignment via missing server-side `available_shells` enforcement

Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_shells` as the approved shell list that customers may assign to FTP users. However, the server-side FTP account handlers do not enforce that whitelist when processing add or edit requests. As a result, an authenticated customer with shell delegation enabled can submit an arbitrary shell such as `/bin/bash` even when the panel UI only offers more restricted choices. In deployments that use the default `nssextrausers` integration, the attacker-controlled shell is then propagated into the system account database, leading to real host shell access. Version 2.3.7 fixes the issue.

CVE-2026-50266 Baixa · 2.2 CWE-863 04/06/2026

Incorrect Authorization em OpenStack Neutron

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set device_owner to a value that has "network:" at the beginning ("network:dhcp" for example). The default port RBAC policies incorrectly included PROJECT_MANAGER without requiring network ownership, allowing any project manager to obtain trusted network-service port behavior on shared networks. Depending on backend and deployment, this can bypass anti-spoofing and security group protections, enabling DHCP, MAC, or IP spoofing against other tenants on the shared network. This is a regression of CVE-2015-5240 (OSSA-2015-018).

CVE-2026-10860 Média · 6.5 CWE-863 04/06/2026

MISP CRUDComponent delete validation bypass via operator precedence error

A logic error in the MISP CRUD component delete handler allowed validation failures to be bypassed when requests used the HTTP DELETE method. Due to missing parentheses in the delete condition, the expression was evaluated as ($validationError === null && POST) || DELETE, meaning a DELETE request could proceed even when the delete validation callback had rejected the operation. An authenticated attacker with access to an affected delete endpoint could abuse this flaw to delete records that should have been protected by application-level validation or authorization checks.

CVE-2026-41283 Crítica · 9.9 CWE-863 04/06/2026

OpenStack Mistral: Autorização Incorreta Levando a Execução Remota de Código

O OpenStack Mistral até 22.0.0 permite Execução Remota Arbitrária de Código quando a API está exposta. Existem endpoints que permitem execução de código, o que pode levar à exfiltração de credenciais de serviço.

CVE-2025-14774 Alta · 7.4 CWE-863 03/06/2026

Communication analysis between the Card Reader and TP2CardReaderService daemon

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVE-2026-44654 Alta · 8.1 CWE-863 02/06/2026

LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file records through `DELETE /api/files` that the owner has reused across multiple agents. The deletion removes the file globally — not just from the shared agent — breaking the owner's other private agents that reference the same `file_id`. The private agent retains a stale `file_id` reference that no longer resolves. A shared-agent editor can destroy files that the owner uses across multiple agents. The owner's private agents — which the attacker has no access to — break silently with stale `file_id` references. This is a cross-agent integrity violation: editing access to one agent should not affect another. Version 0.8.4 contains a patch.

CVE-2026-35482 Crítica · 9.1 CWE-863 02/06/2026

alf.io has an Authenticated RCE via Extension Script Sandbox Escape

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.

CVE-2026-3514 Alta · 7.5 CWE-863 02/06/2026

Authentication Bypass in prefecthq/prefect

In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allows an attacker to create resources with names ending in 'health' or 'ready' and access them without authentication. Affected endpoints include those for variables, flows, work pools, work queues, and deployments. This vulnerability can lead to unauthorized access to sensitive information, such as API keys and database credentials, stored in Prefect Variables.

CVE-2026-9048 Média · 4.3 CWE-863 01/06/2026

Slider Revolution 7.0.0 - 7.0.14 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure

The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 - 7.0.14, via the 'slider.get.full' AJAX Action. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw social media API credentials: the Instagram OAuth token, Flickr API key, YouTube Data API key, and Facebook App ID, stored in any configured slider's settings.

CVE-2025-32348 Alta · 7.8 CWE-863 01/06/2026

Incorrect Authorization em Google Android

In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-45426 Baixa · 3.1 CWE-863 01/06/2026

Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access

Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's `str.lstrip()` to the requested path segment when verifying the JWT's `sub` claim. `str.lstrip()` strips any of a *set* of characters from the left (not a prefix), so a JWT issued for a Dag named e.g. `dag_a` would authorize log access to any other Dag whose name began with any subset of the characters `{d, a, g, _}` (e.g. `dag_attacker`, `aaaa_target`, `_dag_secret`). Such an authenticated worker could enumerate and read worker logs of other Dags whose names happened to share that character-class prefix, leaking task output and error traces beyond the documented per-Dag isolation boundary. Affects deployments relying on per-Dag log-access scoping (multi-team, shared-executor, shared-worker topologies). Users are advised to upgrade to `apache-airflow` 3.2.2 or later.

CVE-2026-49376 Média · 6.5 CWE-863 29/05/2026

Incorrect Authorization em Jetbrains Teamcity

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

CVE-2026-49369 Média · 4.3 CWE-863 29/05/2026

Incorrect Authorization em Jetbrains Youtrack

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages

CVE-2026-48501 Crítica · 9.1 CWE-863 29/05/2026

Exposição de tokens no GitHub CLI pelos comandos gh attestation

A GitHub CLI (gh) é a ferramenta oficial de linha de comando do GitHub. Antes da versão 2.93.0, a GitHub CLI inclui incorretamente o cabeçalho de autorização em requisições de API enviadas a espelhos de repositórios TUF por meio dos comandos gh attestation, gh release verify e gh release verify-asset. A CLI usa um cliente HTTP compartilhado com uma camada de autenticação que anexa automaticamente tokens às requisições de saída. Essa camada não possui detecção precisa de host e pode atribuir incorretamente o host de destino, fornecendo-lhe um token que nunca deveria receber. Especificamente, a lógica de normalização de host reduz qualquer subdomínio de *.github.com para github.com, de modo que uma requisição para tuf-repo.github.com (um site do GitHub Pages, não um endpoint da API do GitHub) é tratada como uma requisição para github.com e recebe o token github.com do usuário. Para hosts que não correspondem a github.com nem a uma instância GHES conhecida, o resolvedor recorre a GH_ENTERPRISE_TOKEN, caso definido. Os comandos gh attestation, gh release verify e gh release verify-asset buscam dados de vários hosts externos como parte de sua operação normal (metadados TUF de tuf-repo.github.com e tuf-repo-cdn.sigstore.dev, pacotes de artefatos do Azure Blob Storage). Como essas requisições passam pelo mesmo cliente HTTP autenticado, o token é enviado a todos eles. Esta vulnerabilidade foi corrigida na versão 2.93.0.