CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...

CVE-2026-75103

Crawlab 's password-change endpoint (core/controllers/user_v2.go) lacks authorization checks, so any authenticated user can reset any account's password. Combined with account enumeration via the user listing endpoint, attackers can compromise admin credentials to achieve full account takeover an...

PT-2026-76834

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session token session to remain valid for ...

CVE-2026-72831

The CVE concerns the Grav Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11). The vulnerability resides in FlexApiController::update(), which only enforces general Flex directory permissions and omits the stricter checks enforced by Users and Groups APIs (target/field/super-admin). An a...

EUVD-2026-58645

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

PT-2026-72000

Name of the Vulnerable Software and Affected Versions Flex Objects versions 1.0.0 through 1.4.6 Description An incorrect authorization issue exists in the Flex Objects API. The FlexApiController::update function only verifies general Flex directory permissions and fails to apply the target, field...

CVE-2026-72786

Craft CMS versions before 5.10.8 are vulnerable to an authentication bypass in the elements/save action. The root cause is an unprotected newPassword field in the User element save flow, which can be exploited by authenticated users with edit users permission to reset any user’s password (includi...

CVE-2026-73292

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-73292

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-73292

Semaphore UI (web interface for managing DevOps tools) prior to version 2.18.21 is affected by a CSRF vulnerability in the /api/users/{id}/password endpoint. The endpoint accepts a cross-site request using the authenticated user’s session cookie without CSRF protection or current-password confirm...

EUVD-2026-57311

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

PT-2026-71024

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...

CVE-2026-18030

The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...

CVE-2026-17600

Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue...

CVE-2026-17599

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

CVE-2026-17599

Nexus Repository 3 contains an endpoint used to change the administrator password during initial onboarding. The endpoint did not verify that onboarding was still in progress, instead relying on a local onboarding artifact. As a result, an account with nexus:* permission could invoke the endpoint...

CVE-2026-17599

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...

EUVD-2026-54516

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result...