CVE-2026-72643 Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CVE-2026-72673

Summary: Kibana Synthetics private locations across multiple spaces are vulnerable to unauthorized deletion due to Incorrect Authorization (CWE-863). The ACL check only considered monitors in the requesting user’s own space, allowing a user with Synthetics write privilege in one space to delete a...

CVE-2026-72673

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...

CVE-2026-72673 Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...

EUVD-2026-58260

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-58510

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-24791

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

CVE-2026-24791 Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes

Public-only tokens bypass private-resource restrictions on /api/v1/user self routes...

EUVD-2026-58123

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-58510

The CVE-2026-58510 entry relates to Gitea: the ClearRepoWatches fix was not applied to the API EditRepo path, leaving a secondary code path with stale watches when a repository’s visibility changes from public to private. Affected software: Gitea; vulnerable component: the API EditRepo/watch hand...

CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

CVE-2026-58444

Mode C: CVE-2026-58444 in Gitea enables a token-scope bypass on the repository home page. Root cause: repo.Home does not enforce repository-scoped token checks, so a token without the repository scope (e.g., read:user/public-only) may render private repository data on GET /{owner}/{repo} (README,...

CVE-2026-58443

CVE-2026-58443 concerns Gitea. Public-only write tokens can influence a private PR head branch via a public route, because update operations check the head repo’s normal RBAC permissions rather than validating the API token’s scope. The flow allows a POST to the update endpoint for a PR, which tr...

CVE-2026-58438

CVE-2026-58438 (Gitea) : Cross-repository IDOR in issue-dependency removal. The RemoveDependency path in routers/web/repo/issue_dependency.go fetches the dep issue by ID without repository or permission checks, enabling a user with write access to one repo (ownerA/repoA) to delete a dependency li...

CVE-2026-58434

Gitea CVE-2026-58434 affects private repository metadata exposure after access revocation via the authenticated endpoints GET /api/v1/user/starred and GET /api/v1/user/subscriptions. The issue allows previously authorized users to continue receiving repository metadata (e.g., full_name, descripti...

CVE-2026-58417

Gitea is associated with CVE-2026-58417, where the REST API endpoint /orgs/{org}/public_members/{username} leaks private-organization membership information to unauthorized users. The cited advisories and sources (GHSA-jr5x-6h83-wrxf, related NVD entry, and OSV entries) describe the impact as dis...

CVE-2026-58416

CVE-2026-58416 (Gitea) describes a read-access leak in the Fork-PR Actions path: when a private repo B lists A as a collaborative owner, GetActionsUserRepoPermission on the collaborative-owner branch returns code-read permissions even if the fork PR is involved, enabling an attacker to clone a th...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...