11 matches found
CVE-2026-103396
bbs-go through version 4.4.6 is vulnerable to a permission bypass within the AdminMiddleware authorization logic. The root cause is that the dashboard.user.view permission rule incorrectly matches the /api/admin/user/synccount endpoint before the required dashboard.user.update rule is evaluated. ...
CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...
CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...
CVE-2026-103396 bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view...
CVE-2024-37768
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...
CVE-2024-37768: Undefined Security Weakness
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...
CVE-2024-37767: Missing Authentication for Critical Function
Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request...
CVE-2024-37768
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...
CVE-2023-25223
CRMEB =1.3.4 is vulnerable to SQL Injection via /api/admin/user/list...