Security Bulletin: Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths

Summary A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may...

CVE-2026-75542

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-77923

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75542

CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...

EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client\credentials grant,...

Sakai Profile Image Deletion has an IDOR

Summary The Sakai REST API endpoint DELETE /api/users/userId/profile/image does not verify that the requesting user is authorized to modify the target user's profile. Any authenticated user can delete the profile image of any other user, including administrators, by supplying a different userId i...

CVE-2026-77923

Dolibarr versions 21.0.0 through 24.0.0 (exclusive) contain an authorization bypass in the clonetasks mass action handler (htdocs/core/actions_massactions.inc.php). An inverted boolean condition (!in_array()) in the private-project membership check allows any authenticated user with project creat...

CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

EUVD-2026-65087

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actionsmassactions.inc.php. Authenticated users with project creation permission bu...

CVE-2026-71509

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2026-71508

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

CVE-2026-71507

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71506

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...

CVE-2026-71504

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply...

CVE-2026-71505

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71509 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2026-71509

Dolibarr versions before 24.0.0 contain an improper authorization vulnerability in the expense report REST API update endpoint. Authenticated users holding only expense-creation rights can directly set approval status and approver identity fields via the API, effectively bypassing the approval wo...