20 matches found
CVE-2026-82411
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
CVE-2026-82411
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint "GET...
EUVD-2026-112551
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
CVE-2026-82411 Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
CVE-2026-82411
The Open Object platform is vulnerable to a cross-object-type authorization bypass in the history-detail endpoint (GET /api/v2/objects/{uuid}/{index}). The flaw exists because the history_detail action in src/objects/api/v2/views.py calls self.get_queryset() and get_object_or_404 directly, bypass...
CVE-2026-82411 Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
CVE-2026-82411 Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
Maykin Open Object authorization issue vulnerability
Versions 2.4.3 through 2.5.1, 3.0.0 through 3.6.2, 4.0.0-rc.1 through 4.0.2, and 4.1.0 through 4.1.1 of Maykin Open Object contain an authorization issue vulnerability. This vulnerability arises because the history-detail endpoint fails to perform object-level permission checks. Only valid API...
PT-2026-129225
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
CVE-2026-82411: maykinmedia open-object: Open Object provides an API and admin interface to manage objects and object types
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET...
CVE-2025-66574
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the Open Object in Tree endpoint, allowing attackers to steal session cookies and potentially escalate privileges...
EUVD-2025-201269
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the Open Object in Tree endpoint, allowing attackers to steal session cookies and potentially escalate privileges...
CVE-2025-66574
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the Open Object in Tree endpoint, allowing attackers to steal session cookies and potentially escalate privileges...
CVE-2025-66574
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the Open Object in Tree endpoint, allowing attackers to steal session cookies and potentially escalate privileges...
CVE-2025-66574 TranzAxis 3.2.41.10.26 - Stored Cross-Site Scripting (XSS)
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the Open Object in Tree endpoint, allowing attackers to steal session cookies and potentially escalate privileges...
CVE-2025-66574
Summary: TranzAxis 3.2.41.10.26 is vulnerable to a stored XSS via the Open Object in Tree API endpoint. This authenticated-user vulnerability can lead to session cookie theft and potential privilege escalation. Root cause: stored cross-site scripting in the Open Object in Tree endpoint. Affected ...
CVE-2025-66574: Improper Neutralization of Input During Web Page Generation
TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the Open Object in Tree endpoint, allowing attackers to steal session cookies and potentially escalate privileges...
PT-2025-49150
Name of the Vulnerable Software and Affected Versions TranzAxis version 3.2.41.10.26 Description Authenticated users can inject cross-site scripting through the Open Object in Tree API endpoint. Successful exploitation may allow attackers to steal session cookies and potentially escalate...
Taiko Alethia Cross-Site Scripting Vulnerability
Taiko Alethia is an open source Taiko Labs collection of software for implementing the Ethernet-based ZK-EVM Rollup protocol for the Taiko Layer 2 network. A cross-site scripting vulnerability exists in Taiko Alethia version 3.2.41.10.26, which stems from the presence of cross-site script injecti...