EUVD-2026-120523

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGEROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator...

CVE-2026-125360

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGEROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator...

CVE-2026-125360: Southclaws storyden: Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant…

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGEROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator...

CVE-2026-125360

Storyden versions through 1.26.16 are affected by a privilege escalation vulnerability. Users possessing the MANAGE_ROLES permission can improperly grant themselves ADMINISTRATOR permissions without actually being administrators. This is achieved by calling AccountAddRole on a controlled account ...

CVE-2026-125360 Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role Assignment

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGEROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator...

EUVD-2026-107319

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...

hMailServer authorization issue vulnerability

hMailServer has an authorization issue vulnerability stemming from improper authorization in its REST management API. The DELETE /api/v1/role-assignments/address endpoint only checks whether the currently held credentials grant sufficient permissions; it fails to verify whether those permissions...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect...