CVE-2026-84805 Kimai 2.61.0 before 2.63.0 Authentication Bypass via API

Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/id/preferences endpoint. Although the web interface gates these employment-contract fields behind the contractotherprofile admin permission, the...

CVE-2026-84804

Kimai before version 2.65.0 contains an authorization bypass in its Team Activity API endpoints. The root cause is a missing permissions_activity check when removing team access to activities, projects, and customers: authenticated users holding only the edit_team permission can revoke team acces...

CVE-2026-84803 SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and...

EUVD-2026-69916

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

CVE-2026-84804 Kimai before 2.65.0 Authorization Bypass via Team Activity API

Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with editteam permission can revoke team access without the required permissionsactivity check, bypassing authorization controls...

CVE-2026-84801

Craft CMS versions from 5.0.0-RC1 up to 5.10.11 are affected by an authentication bypass in the actionGetPasswordResetUrl endpoint, which fails to validate the caller's admin status. A non-admin user holding the administrateUsers permission can mint a password-reset URL for any administrator acco...

CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

CVE-2026-84801 Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new...

EUVD-2026-69911

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

CVE-2026-84799 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798

Craft CMS versions 5.0.0-RC1 through 5.10.10 contain an authorization bypass in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and performs the deletion authorization check only against the user's own provisional draft (verifying draft...

EUVD-2026-69908

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

EUVD-2026-69909

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

CVE-2026-84797 Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user...

CVE-2026-84796 Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments. Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing...

CVE-2026-84797

Craft CMS versions 5.0.0-RC1 through before 5.10.11 are affected by an authorization bypass in ElementsController::actionDuplicate(). The vulnerability stems from missing authorization checks on the deleteProvisionalDraft parameter, allowing any authenticated user holding the createEntries permis...