CVE-2026-80348

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-80348 TarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-80348

TarsWeb through 3.0.16 has a missing authorization flaw in app/controller/patch/PatchController.js. Four methods—uploadAndPublish , downloadPackage , deletePatchPackage , and setPatchPackageDefault —fail to call the AuthService used for per-application role enforcement. As a result, any authentic...

EUVD-2026-66387

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...