CVE-2026-109173

The yshop-crm software (versions through 2.1.3 ) is susceptible to a missing authorization vulnerability. The flaw resides in the CrmInvoiceController check handler, which lacks the @PreAuthorize annotation and has its approver checks commented out. This allows any authenticated back-office user ...

CVE-2026-109173 yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting...

CVE-2026-109172 yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

CVE-2026-109172

The yshop-crm software, versions through 2.1.3 , is vulnerable to a missing authorization flaw (CWE-862). The issue exists in the POST /admin-api/crm/contract-receivables/check endpoint, where the handler lacks a @PreAuthorize check. Furthermore, the required approver validation within CrmContrac...

EUVD-2026-97376

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @PreAuthorize check and the approver checks in...

EUVD-2026-97375

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...

CVE-2026-109171

The yshop-crm software, version 2.1.3 and below , is vulnerable to a missing authorization flaw. The root cause is that the CrmContractController lacks the @PreAuthorize annotation and has its approver checks commented out. This allows any authenticated back-office user to call the POST /admin-ap...

Apache-APISIX-CVE-2022-24112

Apache APISIX Remote Code Execution CVE-2022-24112 Exploit Summary An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. When the admin key w...

CVE-2026-108831 meetecho janus-gateway Admin API admin.js hard-coded credentials

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been...

CVE-2026-108831

A security vulnerability exists in meetecho janus-gateway versions up to 1.4.2 . The issue resides within the Admin API component, specifically in the html/demos/admin.js file. The root cause is the presence of hard-coded credentials , which allows for remote execution of the attack. Public explo...

EUVD-2026-97356

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been...

Ghost-CMS-Code-Injection-Audit-CVE-2026-26980

Ghost CMS Code Injection Cleaner Removes injected code from every post and page on a Ghost CMS website via the Admin API. Use this to clean up a compromised Ghost site — for example, one affected by the code injection vulnerability CVE-2026-26980 — by stripping attacker-supplied tags and other...

CVE-2026-109237: Deserialization of Untrusted Data

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with apitoken set to an env reference via /config/dump to read SECRETK...

CVE-2026-108114

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

CVE-2026-108114 Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

EUVD-2026-96338

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

CVE-2026-108114

Strapi versions 5.47.0 through 5.57.0 are vulnerable to an improper authorization flaw (CWE-863) involving Admin API tokens. The root cause lies in the reconcileTokenPermissionsToUserCeiling function, which fails to account for token permissions containing omitted or null fields . Consequently, e...

CVE-2026-108114: Incorrect Authorization

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields,...

BIT-GHOST-2026-104416 Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...