CVE-2026-5465

CVE-2026-5465: Повышение привилегий в плагине Amelia WordPress ⚠️ Краткое резюме Критическая уязвимость Небезопасных прямых ссылок на объекты IDOR в плагине Amelia, которая позволяет аутентифицированному пользователю с ролью Сотрудника Provider повысить привилегии вплоть до полного захвата контрол...

CVE-2026-14311

Amelia (Premium) is a WordPress booking plugin vulnerable through version 2.4.4 . The root cause is a missing ownership verification on the /users/customers/ endpoint, allowing any authenticated user with the wpamelia-provider role to view and modify arbitrary customer records, including password...

Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-35q8-9mj6-wjmf. This link is maintained to preserve external references. Original Description n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO...

CVE-2026-65016

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...

CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning path maps an IdP-asserted role claim to an n8n global role but does not prevent assignment of the global:owner role unlike the token-exchang...