CVE-2025-30368 Zulip allows the deletion of organization by administrators of a different organization

Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization wa...

TikTok: Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard Activities

A broken access control vulnerability in TikTok Live Backstage allowed low-privilege users to gain unauthorized control over public leaderboard activities belonging to other organizations...

CVE-2024-56335 Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker's...

No Fuss Computing Centurion ERP 安全漏洞

No Fuss Computing Centurion ERP is an open source enterprise resource planning ERP software from No Fuss Computing. A security vulnerability exists in No Fuss Computing Centurion ERP versions prior to 1.3.1, which originated when an authenticated user with work order viewing privileges could view...

The vulnerability of the administration interface of the Fortinet FortiPortal security analysis and management tool allows a perpetrator to interact with resources of other organizations.

The vulnerability of the administration interface of the Fortinet FortiPortal security analysis and management tool involves bypassing authentication using a user-controlled key. Exploiting this vulnerability allows a malicious actor to interact with resources of other organizations by sending...

SUSE CVE-2024-9476

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizatio...

UBUNTU-CVE-2024-9476

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizatio...

SUSE CVE-2024-10452

Organization admins can delete pending invites created in an organization they are not part of...

PT-2024-16292 · Grafana +2 · Grafana +2

Name of the Vulnerable Software and Affected Versions: Grafana affected versions not specified Description: The issue allows organization admins to delete pending invites created in an organization they are not part of. This can be exploited by a Grafana org admin to delete pending invites in...

Lunary 安全漏洞

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in Lunary that stems from improper controls in the saml.ts file, which can be exploited by an attacker to cause unauthorized access and potential account takeover, where a user of an...

PT-2024-37736 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 Description: A broken access control issue exists in the saml.ts file, allowing a user from one organization to update the Identity Provider IDP settings and...

PT-2024-9821 · Fortinet · Fortiedr Manager Api

Name of the Vulnerable Software and Affected Versions: FortiEDR Manager API versions 6.0 through 6.2.2 Description: The issue is related to improper access control, allowing an authenticated admin with REST API permissions, restricted to a specific organization, to access backend logs that includ...

CVE-2024-7266

Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17...

PT-2024-37091 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.4 Description: The issue is caused by an improper access control vulnerability that allows members with team management permissions to manipulate project identifiers in requests. This enables them to invite users ...

grafana: incorrect assessment of permissions across organizations

A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permissions and global role assignments. After successful...

Lunary 安全漏洞

lunary is a production toolkit for LLM. An insecure direct object reference vulnerability exists in lunary, which stems from an endpoint that does not validate that a supplied project ID belongs to a currently authenticated user, and can be exploited by an attacker to cause unauthorized...

UBUNTU-CVE-2024-1313

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

CVE-2024-1313 Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

Users outside an organization can delete a snapshot with its key

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/ using its view key. This functionality is intended to only be available to individuals with the permission to write/edit ...

Fortinet FortiPortal 授权问题漏洞

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. An authorization issue vulnerability exists in Fortinet FortiPortal that stems from the...