PT-2026-106034

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Two endpoint families fail to verify that nested resource identifiers belong to the workspace and project specified in the URL. An authenticated user can read or modify estimates from another workspace...

PT-2026-106019

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description An authenticated user can retrieve API-token records via the 'GET /api/users/api-tokens/' endpoint. Additionally, the 'PATCH /api/users/api-tokens/token id/' endpoint allows a user to modify the allowe...

CVE-2026-100610

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100610

Flowise versions through 3.1.4 are vulnerable to an authorization bypass in the upsert-history functionality. The application fails to perform route-level permission checks, workspace validation, or ownership verification for the GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history end...

EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

PT-2026-99281

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Insufficient route-level permission checks and a lack of workspace or ownership validation in the backing service allow authenticated low-privilege users or those with a valid API key to access or...

GHSA-VMJQ-HVGQ-2WV4 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for the who...

CVE-2026-63104

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

EUVD-2026-84813

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-63104

Kaneo versions 2.3.12 before 2.12.2 are vulnerable to a missing authorization flaw in the bulk task endpoint . While the system verifies workspace membership, it fails to invoke the role-based permission checks required for other task endpoints. Authenticated workspace members with viewer or memb...

CVE-2026-63104 Kaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

CVE-2026-94462 Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...