CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce --no-delete on the WebDAV MOVE verb. MOVE deletes the source file rename removes it from its original path, and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w...

GHSA-HQ33-8JGP-8QQ3 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Summary The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce --no-delete on the WebDAV MOVE verb. MOVE deletes the source file rename removes it from its original path, and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w...

CVE-2026-64863 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-64863 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-64863

Summary: CVE-2026-64863 affects goshs, a single-binary file server. Prior to version 2.1.4, the httpserver/server.go wdGuard treated WebDAV MOVE as a write operation without enforcing --no-delete, allowing WebDAV clients to delete or overwrite files by MOVE with Overwrite: T. This could enable un...

CVE-2026-64863 goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

CVE-2026-57510

SuperPlane before 0.27.0 suffers a broken object-level authorization flaw in the CanvasService gRPC handlers. Authenticated users with viewer-level access to one organization can access resources from other organizations by supplying arbitrary canvas or queue UUIDs without proper organization sco...

CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-49258

Nebula Mesh Web UI contains ownership checks gaps in versions ≤ 0.3.5, allowing authenticated non-admin operators to access, block, or delete resources across operators via endpoints such as /ui/hosts/{id}/block, /ui/hosts/{id}, /ui/hosts, /ui/networks, and /ui/events. The root cause is improper ...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751 Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751

CVE-2026-66751 affects Let’s Chat 0.3.0–0.4.8. The issue is an improper authorization in the server’s room deletion flow: any authenticated user can archive any room by sending a DELETE to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing end...

EUVD-2026-49878

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-66751

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...

CVE-2026-7521

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-7521

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

CVE-2026-14821

The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...

EUVD-2026-49700

The Quiz and Survey Master QSM WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates...