CVE-2026-112001

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001

ProjectSend versions 2.0.0 before 2.7.0 are vulnerable to an incorrect authorization flaw (CWE-863) within the Users API. Specifically, API token holders with restricted permissions (limited to manage_users and edit_users) can exploit the PATCH /api/v1/users/{user} endpoint to modify the credenti...

EUVD-2026-103454

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-97859: Missing Authorization

Seven Gitea API routes under /api/v1/users/username followers, following, following/target, starred, subscriptions, keys and gpgkeys were registered without the individualPermsChecker middleware that enforces the visibility of the target user. An authenticated user could therefore read the...

CVE-2026-112001: Incorrect Authorization

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-110770

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

EUVD-2026-101570

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

CVE-2026-110770

Databasus versions 3.7.0 through 3.61.0 are vulnerable to an authentication bypass vulnerability. Unauthenticated attackers can exploit the POST /api/v1/users/reset-password endpoint to request a six-digit password reset code for a known email address. Due to a lack of rate limiting, lockout mech...

CVE-2026-110770 Databasus 3.7.0 through 3.61.0 Account Takeover via Password Reset Brute-Force

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

CVE-2026-110770: Improper Restriction of Excessive Authentication Attempts

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a known email, then guess it without rate limiting, lockout, o...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-110216

The youlai-boot software (through version 2.21.1 ) is vulnerable to a missing authorization flaw in the updateUserStatus handler. The root cause is the absence of a @PreAuthorize check, which allows any authenticated user to send PATCH requests to the /api/v1/users/{userId}/status endpoint. This ...

PT-2026-111840

Name of the Vulnerable Software and Affected Versions youlai-boot versions prior to 2.21.2 Description A missing authorization issue allows any authenticated user to enable or disable accounts. This occurs because the updateUserStatus handler lacks a @PreAuthorize check, which is a security...

CVE-2026-110216: Missing Authorization

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-68964

An authenticated account marked restricted can retrieve the SSH public keys and GPG keys of a user whose profile visibility is set to Limited, through "GET /api/v1/users/username/keys" and "GET /api/v1/users/username/gpgkeys". The SSH response exposes key titles, public key material and...

CVE-2026-66853

A restricted account can enumerate Limited-visibility organizations and their name, description and avatar by listing the public organization memberships of a known user through "GET /api/v1/users/username/orgs"...

CVE-2026-67577

An authenticated account marked restricted can read the activity feed and contribution heatmap of a Limited-visibility user through "GET /api/v1/users/username/activities/feeds" and "GET /api/v1/users/username/heatmap". The ordinary user-information endpoint and the web/RSS profile routes correct...