Access control issue in AlekSIS-Core

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

PYSEC-2026-767 Access control issue in AlekSIS-Core

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2026-27982 via django-allauth (0.52.0)

django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V...

aleksis (>=2023.6.0b2, <=2023.6.1), aleksis-app-buelleten (>=2.0.0.dev1, <=2.0.0.dev2) +6 more potentially affected by CVE-2026-27982 via django-allauth (0.54.0)

django-allauth PYPI version 0.54.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.6.0b2, =2.0.0.dev1, =3.1.0, =6.0.0rc1, =0.4.2, =4.1.0, =0.6.0, =0.24.0 - nemo-allauth 1.11.0 Source cves:...

aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2025-65431 via django-allauth (0.52.0)

django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2025-65431 Source advisory: OSV:GHSA-8M3C-C723-H...

aleksis (>=2023.6.0b2, <=2023.6.1), aleksis-app-buelleten (>=2.0.0.dev1, <=2.0.0.dev2) +6 more potentially affected by CVE-2025-65431 via django-allauth (0.54.0)

django-allauth PYPI version 0.54.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.6.0b2, =2.0.0.dev1, =3.1.0, =6.0.0rc1, =0.4.2, =4.1.0, =0.6.0, =0.24.0 - nemo-allauth 1.11.0 Source cves:...

aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2025-65430 via django-allauth (0.52.0)

django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2025-65430 Source advisory: OSV:GHSA-QHMC-3MVR-F...

aleksis-core (>=3.0.0b0, <=3.0.0b2), doccano (>=1.8.4, <=1.8.5) +3 more potentially affected by CVE-2025-65431 via django-allauth (0.52.0)

django-allauth PYPI version 0.52.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis-core =3.0.0b0, =1.8.4, =1.8.4.1, =3.11.8, =1.9.0, =1.10.2 Source cves: CVE-2025-65431 Source advisory: OSV:PYSEC-2025-111...

aleksis (>=2023.6.0b2, <=2023.6.1), aleksis-app-buelleten (>=2.0.0.dev1, <=2.0.0.dev2) +6 more potentially affected by CVE-2025-65431 via django-allauth (0.54.0)

django-allauth PYPI version 0.54.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - aleksis =2023.6.0b2, =2.0.0.dev1, =3.1.0, =6.0.0rc1, =0.4.2, =4.1.0, =0.6.0, =0.24.0 - nemo-allauth 1.11.0 Source cves:...

EUVD-2025-7678

Malicious code in bioql PyPI...

EUVD-2022-5974

Malicious code in bioql PyPI...

CVE-2022-29773

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

CVE-2025-25683

AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...

CVE-2025-25683

AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...

Files or Directories Accessible to External Parties

Overview aleksis-core is a This is the core of the AlekSIS framework and the official distribution see below. It bundles functionality for all apps, and utilities for developers and administrators. Affected versions of this package are vulnerable to Files or Directories Accessible to External...

aleksis (>=2023.1.0b0, <=2023.6.0b1), aleksis-app-alsijil (>=2.0.0a3.dev0, <=2.0.0rc7.post0) +9 more potentially affected by CVE-2025-25683 via aleksis-core (>=3.0.0b3, <=3.0.0)

aleksis-core PYPI version =3.0.0b3, =2023.1.0b0, =2.0.0a3.dev0, =1.0.7.dev0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0a1, =1.0.0, =2.0.0b0, =2.1.0.dev1 Source cves: CVE-2025-25683 Source advisory: SNYK:PYTHON-ALEKSISCORE-9486554...

aleksis (>=2023.1.0b0, <=2023.6.0b1), aleksis-app-alsijil (>=2.0.0a3.dev0, <=2.0.0rc7.post0) +9 more potentially affected by CVE-2025-25683 via aleksis-core (>=3.0.0b3, <=3.0.0)

aleksis-core PYPI version =3.0.0b3, =2023.1.0b0, =2.0.0a3.dev0, =1.0.7.dev0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0b0, =2.0.0a1, =1.0.0, =2.0.0b0, =2.1.0.dev1 Source cves: CVE-2025-25683 Source advisory: MEND:CVE-2025-25683...

CVE-2025-25683

AlekSIS-Core is vulnerable to Incorrect Access Control. Unauthenticated users can access all PDF files. This affects AlekSIS-Core 3.0, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0 and 3.2.1...

PT-2025-11108

Name of the Vulnerable Software and Affected Versions: AlekSIS-Core versions 3.0 through 3.2.1 Description: The issue is related to Incorrect Access Control, allowing unauthenticated users to access all PDF files. Recommendations: For AlekSIS-Core versions 3.0 through 3.2.1, consider restricting...

CVE-2025-25683

The aleksis-core package (the core of the AlekSIS framework) is vulnerable to Incorrect Access Control , allowing unauthenticated users to access sensitive PDF files. An attacker can trigger the generation of a PDF file, identify its ID via a GraphQL request , and then iterate through IDs to acce...