CVE-2026-80209 Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2026-80209

Fonoster through version 0.22.7 contains an incorrect authorization flaw in the updateWorkspace handler (mods/identity/src/workspaces/createUpdateWorkspace.ts). The handler fires a gRPC PERMISSION_DENIED callback when the caller is not a workspace member but fails to return , allowing execution t...

CVE-2026-80209 Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2026-47879 Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

CVE-2026-47879 Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

CVE-2026-47879 Spring Cloud Gateway SSRF and native file access with gRPC

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier...

CVE-2026-80209: Incorrect Authorization

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

PT-2026-82561

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continue...

GO-2026-6261 Dgraph Alpha group stores can be replaced via unauthenticated external snapshot import in github.com/dgraph-io/dgraph

Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port without authentication or authorization. An unauthenticated network client can call StreamExtSnapshot and send Badger stream data to replace a target group's store, which drops and replaces the existing databa...

GHSA-6CCX-9C9F-327W gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compressed frame that decompresses to gigabytes, exhausting the BEAM node's heap and triggering an OOM kill denial of service. Introduced in...

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compressed frame that decompresses to gigabytes, exhausting the BEAM node's heap and triggering an OOM kill denial of service. Introduced in...

GHSA-Q8GF-9RVJ-GMGJ gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

Summary 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':readfullbody/3 accumulates every received chunk into a single growing binary with no size cap. When the client omits the grpc-timeout header, the read timeout resolves to :infinity, allowing a slow-trickle attacker to hold the connection open...

gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

Summary 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':readfullbody/3 accumulates every received chunk into a single growing binary with no size cap. When the client omits the grpc-timeout header, the read timeout resolves to :infinity, allowing a slow-trickle attacker to hold the connection open...

GHSA-MWR4-5G34-J5CQ gRPC Erlang package's path bindings are overridable by query string and request body

Summary In the HTTP-to-gRPC transcoding layer of the grpc Hex package, query-string and request-body parameters can silently overwrite path-bound fields when building the decoded protobuf request struct. An authenticated attacker who can reach a transcoded endpoint can substitute any path-bound...

gRPC Erlang package's path bindings are overridable by query string and request body

Summary In the HTTP-to-gRPC transcoding layer of the grpc Hex package, query-string and request-body parameters can silently overwrite path-bound fields when building the decoded protobuf request struct. An authenticated attacker who can reach a transcoded endpoint can substitute any path-bound...

GHSA-GRP7-V8XH-RJ7H gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

Summary GRPC.Codec.Erlpack.decode/2 calls :erlang.binarytoterm/1 directly on the raw gRPC message body without the :safe option. Any unauthenticated peer that can reach a gRPC endpoint with Content-Type: application/grpc+erlpack can crash the entire BEAM node via atom table exhaustion or, if a...

EUVD-2026-37015

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads...

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

Summary GRPC.Codec.Erlpack.decode/2 calls :erlang.binarytoterm/1 directly on the raw gRPC message body without the :safe option. Any unauthenticated peer that can reach a gRPC endpoint with Content-Type: application/grpc+erlpack can crash the entire BEAM node via atom table exhaustion or, if a...

CVE-2026-71485

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...

CVE-2026-71485 Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.9.0, Centrifugo copies the client-controlled protocol.ConnectRequest.headers map through OnClientConnecting in internal/client/handler.go, ConnectEvent.Headers, and SetEmulatedHeadersToContext. The requestHeaders path in...