CVE-2026-112001

ProjectSend versions 2.0.0 before 2.7.0 are vulnerable to an incorrect authorization flaw (CWE-863) within the Users API. Specifically, API token holders with restricted permissions (limited to manage_users and edit_users) can exploit the PATCH /api/v1/users/{user} endpoint to modify the credenti...

EUVD-2026-103454

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-110770

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

EUVD-2026-101570

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

CVE-2026-110770

Databasus versions 3.7.0 through 3.61.0 are vulnerable to an authentication bypass vulnerability. Unauthenticated attackers can exploit the POST /api/v1/users/reset-password endpoint to request a six-digit password reset code for a known email address. Due to a lack of rate limiting, lockout mech...

CVE-2026-110770 Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110216

The youlai-boot software (through version 2.21.1 ) is vulnerable to a missing authorization flaw in the updateUserStatus handler. The root cause is the absence of a @PreAuthorize check, which allows any authenticated user to send PATCH requests to the /api/v1/users/{userId}/status endpoint. This ...

CVE-2026-110216: Missing Authorization

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-68964

An authenticated account marked restricted can retrieve the SSH public keys and GPG keys of a user whose profile visibility is set to Limited, through "GET /api/v1/users/username/keys" and "GET /api/v1/users/username/gpgkeys". The SSH response exposes key titles, public key material and...

CVE-2026-66853

A restricted account can enumerate Limited-visibility organizations and their name, description and avatar by listing the public organization memberships of a known user through "GET /api/v1/users/username/orgs"...

CVE-2026-67577

An authenticated account marked restricted can read the activity feed and contribution heatmap of a Limited-visibility user through "GET /api/v1/users/username/activities/feeds" and "GET /api/v1/users/username/heatmap". The ordinary user-information endpoint and the web/RSS profile routes correct...

Gitea API Disclosure Sensitive Information

The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

CVE-2026-55610

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610

In multi-company installations of InvoiceShelf prior to version 2.4.1 , an Insecure Direct Object Reference (IDOR) vulnerability allows any user with Owner privileges of one company to access other companies' data. The GET/PUT /api/v1/users/{user} endpoints resolve target users by a global primar...

EUVD-2026-85338

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...