CVE-2026-110773

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

CVE-2026-110773 GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

CVE-2026-110773 GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

CVE-2026-110773 GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

EUVD-2026-101573

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

CVE-2026-110773

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

CVE-2026-110773

GrowChief versions through 0.3.0 are affected by a missing authorization vulnerability in the getAllUsers handler. The root cause is the absence of the IsSuperAdmin guard, which allows any authenticated user—including those with low-privilege, self-registered accounts—to access the GET /users/all...

CVE-2026-110773: Missing Authorization

GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short...

PT-2026-114137

Name of the Vulnerable Software and Affected Versions GrowChief versions prior to 0.3.1 Description An authorization flaw exists in the getAllUsers handler due to the absence of the IsSuperAdmin guard. This allows any authenticated user, including those with low-privilege self-registered accounts...