Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

PT-2026-67585

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

CVE-2026-65897

Grav API Plugin before 1.0.10 is affected. The flaw in InvitationsController::create() fails to validate the groups field, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. When such invitations are accepted, the new account gain...

CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65897

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

EUVD-2026-48247

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

CVE-2026-65897 Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

PYSEC-2026-3540 sh _uid does not drop supplementary groups (incomplete privilege drop)

Impact The uid option performed an incomplete privilege drop on Linux/Unix-like systems. When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

sh _uid does not drop supplementary groups (incomplete privilege drop)

ImpactThe uid option performed an incomplete privilege drop on Linux/Unix-like systems.When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted inputs in InterestGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in InterestGroups in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2026-63977

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

PT-2026-64140

Impact The uid option performed an incomplete privilege drop on Linux/Unix-like systems. When sh was run from a process with elevated privileges, such as root, and a command was launched with uid=, the child process changed its UID and primary GID but did not reset its supplementary groups. As a...

openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group

A key group selection preference flaw has been discovered in OpenSSL. An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the "DEFAULT" keyword. A less preferred key exchange may be used...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

CVE-2026-65603

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

EUVD-2026-47647

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...

CVE-2026-65603 Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

The Grav Login plugin grav-plugin-login versions = 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler processUserProfile, the updateuser task. Unlike the registration handler, this handler does not strip privilege fields 'groups','access' from user-submitt...