6 matches found
CVE-2026-125750
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js...
CVE-2026-125750 Firekylin through 2.18.1 Improper Authorization via Admin REST API GET Actions
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js...
EUVD-2026-121232
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js...
CVE-2026-125750
Firekylin versions up to and including 2.18.1 are vulnerable to an improper authorization flaw within the admin REST API. The root cause is that the admin API base guard incorrectly permits all GET actions , allowing users with the editor-role to access sensitive administrator-only secrets. Speci...
PT-2026-141746
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js...
CVE-2026-125750: Firekylin: Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read…
Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js...