CVE Database

CVE-2026-96806 Unknown CWE-613 Oct 15, 2026

Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: after a user logs out, anyone with later access to the same browser (for example on a shared workstation) can continue to act as that user. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

CVE-2026-94135 Unknown CWE-322 Oct 15, 2026

Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attacker in a machine-in-the-middle position between the triggerer and the SFTP server can impersonate the server and capture the credentials or data exchanged. Users of apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-sftp 7.0.0 or later. This is a separate defect from CVE-2026-94134 (the synchronous SSH hook default, which also affects the SFTP hook); users who applied the fix for one also need this release for the other - apache-airflow-providers-sftp 7.0.0 fixes both.

CVE-2026-94134 Unknown CWE-322 Oct 15, 2026

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

CVE-2026-92228 Unknown CWE-732 Oct 15, 2026

Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team could read other teams' audit events through the UI or the event-log API. Users of apache-airflow-providers-keycloak are recommended to upgrade to apache-airflow-providers-keycloak 0.11.1 or later.

CVE-2026-111369 High · 7.1 CWE-863 Oct 15, 2026

ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

CVE-2026-111364 Medium · 6.5 CWE-639 Oct 15, 2026

MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book and iterate sequential document ids to read markdown and HTML from private books.

CVE-2026-111368 Medium · 6.4 CWE-639 Oct 15, 2026

ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

CVE-2026-111367 Medium · 6.5 CWE-1394 Oct 15, 2026

BillionMail through 4.9 Forgeable JWTs via Default Signing Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.

CVE-2026-111366 High · 7.2 CWE-639 Oct 15, 2026

cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

CVE-2026-111365 Medium · 6.0 CWE-639 Oct 15, 2026

cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access.

CVE-2026-111363 Medium · 6.5 CWE-639 Oct 15, 2026

BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.

CVE-2026-111359 High · 7.1 CWE-639 Oct 15, 2026

CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.

CVE-2026-111358 Medium · 5.4 CWE-639 Oct 15, 2026

SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via the web subscriber form or CSV import to receive victim campaign content and skew victim reports.

CVE-2026-111356 High · 7.4 CWE-307 Oct 15, 2026

MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

CVE-2026-111355 Medium · 6.3 CWE-639 Oct 15, 2026

zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with Dept or Self scope can call UserService and OrgService by-id methods to read, modify, disable, and delete users in other departments.

CVE-2026-111354 Low · 3.1 CWE-639 Oct 15, 2026

crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints

crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.

CVE-2026-111353 Medium · 4.3 CWE-862 Oct 15, 2026

Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.

CVE-2026-111352 High · 8.8 CWE-863 Oct 15, 2026

ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

CVE-2026-111351 Medium · 4.2 CWE-639 Oct 15, 2026

metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

CVE-2026-111350 Medium · 5.0 CWE-862 Oct 15, 2026

Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API

Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room and group identifiers can send DELETE requests, read group links, or rewrite group document permissions across teams.

CVE-2026-111349 Medium · 5.3 CWE-862 Oct 15, 2026

Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.

CVE-2026-111348 Medium · 5.4 CWE-639 Oct 15, 2026

Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel, express, and again actions to read refund and order data, cancel refunds, overwrite return shipment details, or re-open refused refunds.

CVE-2026-111347 Medium · 5.9 CWE-321 Oct 15, 2026

go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse.

CVE-2026-111346 Medium · 5.4 CWE-639 Oct 15, 2026

ZenTao PMS through 22.6 Authorization Bypass via action::editComment

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and documents in products and projects they cannot access, and view targeted comment content and attachments.

CVE-2026-111329 Critical · 9.8 CWE-1392 Oct 15, 2026

JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.