CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87770

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87689

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export DataDump cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir contains an off-by-one in its path-component walk that skips the first segment...

EUVD-2026-87688

Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 deleteFtpData, queued when an FTP account is deleted, calls FileDir::makeCorrectDir without the $fixedhomedir argument, so the symlink component walk is skipped, a...

EUVD-2026-87661

Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supply a victim tenant's app id to retrie...

EUVD-2026-87709

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris: register におけるロケーション検証前の資格情報発行 CVE-2026-64640 の自己完結型・ワンコマンド再現スクリプトです。Apache Polaris の Iceberg REST register エンドポイントは、呼び出し元が指定したパスに対してクラウドストレージ資格情報を発行し、そのパスをカタログの allowedLocations と照合する前に サーバー側で読み取ります。 自カタログでテーブルを作成する権限しか持たないプリンシパルでも、Polaris...

Azure-APIM-Cross-Tenant-Signup-Bypass

Azure APIM クロステナント登録バイパス ステータス 2025年12月1日: この脆弱性は現在も有効であり、悪用可能です。Microsoft はこの問題を修正しておらず、「仕様 by design」と見なしています。 セキュリティアドバイザリ GHSA-vcwf-73jp-r7mv CVE-2025-66390 概要 Azure API Management APIM Developer Portal のセキュリティ脆弱性により、管理者がポータル UI でユーザー登録を無効にしている場合でも、Basic 認証が有効になっている任意の APIM...

Azure-APIM-Dev-Portal-Signup-Bypass

無効化された開発者ポータルサインアップをバイパスし、バックエンド登録APIを直接呼び出すAzure API Management APIM 用の概念実証スクリプト 概要 Azure APIM 開発者ポータルは、ポータル UI からセルフサービスサインアップを無効化するように構成できます。一部のデプロイでは、UI ボタンが非表示または削除されている場合でも、基盤となる API エンドポイント（/signup）がアクティブで到達可能なままになります。このスクリプトは、以下の方法でそのギャップを悪用します。 1. /v2/captcha-challenge から proof-of-work P...

CVE-2026-6355

Augmentt: IDORによるクロステナントアクセス クレジット このCVEは以下の協力者によって作成されました： Raznov – GitHub: https://github.com/basraznov HelloWorld （著者）– GitHub: https://github.com/Penquinsecq 説明...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO 認証バイパス エグゼクティブサマリー FortiCloud シングルサインオン（SSO）は、FortiGate/FortiManager/FortiAnalyzer を登録するとファクトリーデフォルトで有効になる機能ですが、重大な認証バイパスの欠陥を含んでいます。 任意の FortiCloud アカウント（無料・有料を問わず）を所有する攻撃者は、自身の SSO トークンを再利用して、パスワードを知らなくても他の顧客のアプライアンス（下記のビルド以下）にログインできます。 攻撃後の権限は完全な管理者 GUI と root...

CVE-2026-23552

CVE-2026-23552 - camel-keycloak におけるクロスレルムトークンの受け入れ 概要 Apache Camel の KeycloakSecurityPolicy は、JWT トークンの iss issuer クレームを設定されたレルムに対して検証しません。つまり、ある Keycloak レルムから発行されたトークンが、まったく別のレルム用に設定されたポリシーによって暗黙に受け入れられ、テナントの分離が壊れます。 影響を受けるバージョン: 4.15.0, 4.16.0, 4.17.0 追跡先:...

Linux Distros Unpatched Vulnerability : CVE-2026-67220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange,...

Linux Distros Unpatched Vulnerability : CVE-2026-66076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2,...

automation-controller: automation-controller-container: automation-controller: execution environment credential foreign key is not use-permission checked, allowing an organization execution-environment admin to bind and disclose another organization's container registry credential (cross-tenant credential disclosure)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...

automation-controller: automation-controller-container: automation-controller: host_filter SmartFilter ORM traversal exposes JobEvent/AdHocCommandEvent event_data and stdout to users without permission on the job, enabling blind character-by-character extraction of job output (cross-tenant information disclosure)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The hostfilter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relatio...

automation-controller: automation-controller-container: automation-controller: workflow job template node execute permission check bypassed by creating a node with a null unified_job_template and then patching it, allowing a single workflow-admin to execute any other tenant's job template with the victim's credentials (cross-tenant privilege escalation)

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The execute-permission check on a workflow job template node's unified job template is skipped when the node's currently stored unified job template is empty: the check inspects only the existing value, not the...

automation-controller: automation-controller-container: automation-controller: JobJobEventsChildrenSummary RBAC bypass exposes cross-tenant job event tree structure

JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...