CVE-2026-111672

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

CVE-2026-111671

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....

CVE-2026-111672

Cube-studio through version 2026.09.01 is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the myapp/views/view_pipeline.py component. Due to a missing authorization check, authenticated users can view or copy pipelines belonging to other project groups by providing a speci...

CVE-2026-111672 Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

EUVD-2026-102963

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

CVE-2026-111671 Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....

EUVD-2026-102962

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in viewnotebook.py, viewinferenceserving....

CVE-2026-111671

Versions of Cube-studio up to and including 2026.09.01 are vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The vulnerability exists in the view_notebook.py , view_inferenceserving.py , and view_serving.py files, where lifecycle endpoints fail to properly validate ownership. This al...

PT-2026-116070

Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view notebook.py, view...

PT-2026-116071

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy pipeline...