CVE-2026-111684

Magistrala, versions through 1.0.0 , contains a cross-tenant authorization bypass within its Certs Service . The vulnerability allows authenticated workspace members to access and manipulate certificates belonging to other tenants by providing foreign serials or entity IDs. Specifically, an attac...

CVE-2026-111629

IoTSharp versions through 3.6.1 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the Customers and Devices API handlers. The root cause is a failure to scope database queries to the caller's specific tenant, allowing any authenticated user to access data from other te...

Azure-APIM-Dev-Portal-Signup-Bypass

A proof-of-concept script for bypassing a disabled developer portal signup on Azure API Management APIM by directly invoking the backend registration API. What it does Azure APIM developer portals can be configured to disable self-service signup through the portal UI. In some deployments the...

CVE-2026-111344

APITable versions through 1.14.0-beta are vulnerable to an authorization bypass vulnerability (CWE-639) in the GET /node/{nodeId}/description endpoint. The root cause is that the application fails to perform adequate space membership and node permission checks when processing a user-controlled no...

CVE-2026-6355

Augmentt: Cross-Tenant Access via IDOR Credits This CVE was a collaborative effort between: Raznov – GitHub: https://github.com/basraznov HelloWorld Author– GitHub: https://github.com/Penquinsecq Description A vulnerability in the web application allows unauthorized users to access and manipulate...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO Authentication Bypass Executive Summary FortiCloud Single-Sign-On SSO a factory default enabled feature once you register any FortiGate/FortiManager/FortiAnalyzer contains a critical authentication-bypass flaw. An attacker who owns any FortiCloud account free or pa...

CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloak Overview Apache Camel's KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. This means a token issued by one Keycloak realm is silently accepted by a policy configured for a...

Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM Cross-Tenant Signup Bypass Status 01.12.2025: This vulnerability is still live and exploitable. Microsoft has not patched this issue and considers it "by design." Security Advisory GHSA-vcwf-73jp-r7mv CVE-2025-66390 Summary A security vulnerability in Azure API Management APIM Develope...

CVE-2026-110764 AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since...

CVE-2026-110764

AstronRPA versions through 1.1.6 are vulnerable to a Cross-Tenant File Disclosure via the resource-service /file/download endpoint. The root cause is an Insecure Direct Object Reference (IDOR) in the FileMapper.getFile function, which fails to perform ownership or tenant checks. This allows authe...

CVE-2026-53999

Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses its container resource identifier for...

BIT-ELK-2026-102406 Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kibana's Fleet package installation proces...

CVE-2026-110112 Dockhand before 1.0.50 OIDC Privilege Escalation via Missing Token Claim Validation

Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate th...

CVE-2026-52217-VTEX-Checkout-CrossTenant-IDOR

CVE-2026-52217 Cross-tenant and cross-user authorization flaw IDOR / BOLA in the VTEX Commerce Platform Checkout service. Field| Value ---|--- CVE ID| CVE-2026-52217 Vendor| VTEX Product| VTEX Commerce Platform, Checkout service chk Affected| Observed on chk v2.367.3 and reproduced on v2.374.3. T...

CVE-2026-57830

Helix Ultimate Framework — Unauthenticated Path-Traversal Arbitrary File/Folder Read+Delete This is a confirmed DoS + cross-tenant filesystem access vulnerability, NOT RCE. An RCE-escalation theory delete configuration.php to re-expose the Joomla installer was tested live and disproved — see "RCE...

Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753...

CVE-2026-109343

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create,...

CVE-2026-109334

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method...

CVE-2026-109343 SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create,...

CVE-2026-109343

SurrealDB versions prior to 3.3.0 are vulnerable to a cross-tenant access flaw. The issue stems from the SurrealQL USE statement , which allows a session to switch to any namespace or database without verifying if the caller's authenticated level covers that specific scope. Consequently, authenti...