SUSE CVE-2026-16491

Grafana's RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted...

CVE-2026-16491

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted...

EUVD-2026-111233

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Versions 7.7.1.0 through 8.7 of Dell PowerProtect Data Domain, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20 contain a privilege escalation vulnerability related to permission management and access control. Th...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Versions 7.7.1.0 through 8.7 of Dell PowerProtect Data Domain, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20 contain a vulnerability related to permission and access control issues. This vulnerability stems fr...

Cisco Cyber Vision Permission Licensing and Access Control Vulnerabilities

Cisco Cyber Vision 3.0.0 to 5.8.1 versions have vulnerabilities related to permission management and access control. These vulnerabilities stem from improper permission management, which may lead to unauthorized privilege escalation...

Artifex Software Ghostscript: Permissions, Licenses, and Access Control Vulnerabilities

Artifex Software Ghostscript has vulnerabilities related to permission management and access control. These vulnerabilities stem from insufficient protection for the privileged forceput operation during the .charkeys process. Processing specially crafted PostScript files can bypass the -dSAFER...

Oracle JD Edwards EnterpriseOne Tools: Vulnerabilities in permission management and access control mechanisms

Oracle JD Edwards EnterpriseOne Tools versions 9.2.0.0 to 9.2.26.5 have security vulnerabilities. These vulnerabilities stem from issues with the Monitoring and Diagnostics SEC component. They may allow high-privilege attackers to access critical data through the HTTP network, unauthorized access...

IBM Sterling Connect Direct permission licensing and access control vulnerabilities

IBM Sterling Connect Direct for Unix versions 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 have vulnerabilities related to permission management and access control. These vulnerabilities stem from improper permission management, which may allow local attackers to gain elevated privileges...

WordPress Essential Addons for Elementor: Permission and access control issues

WordPress Essential Addons for Elementor 6.8.5 and earlier versions have vulnerabilities related to permission management and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

WordPress miniOrange OTP Login, Verification, and SMS Notifications: Permission Issues and Access Control Vulnerabilities

WordPress miniOrange OTP Login, Verification, and SMS Notifications: Versions prior to 5.5.7 have vulnerabilities related to permission management and access control. These vulnerabilities stem from improper permission allocation, which may lead to unauthorized privilege escalation...

GHSA-WJWR-XFP9-R66P Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes

Summary A user who is demoted from admin by an identity provider keeps admin-level read and write access to every user's notes, over any Socket.IO connection that was already open when the demotion happened. Open WebUI caches the user's role on the socket at connection time, and the two SSO...

CVE-2026-87014

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-84807

Kimai kimai/kimai through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team;...

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

More info at https://contao.org/en/security-advisories/non-admin-users-can-self-grant-permissions-that-implicitly-make-them-administrators...

CVE-2026-59233

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

EUVD-2026-55618

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

CVE-2026-59233

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

CVE-2026-59233 Missing Authorization in Prospero Flow CRM permission save endpoint allows privilege escalation

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...

CVE-2026-59233: Authorization Bypass Through User-Controlled Key

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no...