CVE-2026-92787

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

EUVD-2026-81043

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-92600

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login toke...

CVE-2026-92600

Guns (a Java-based application framework) through version 8.3.5 contains an information disclosure vulnerability in SysUserController . The /sysUser/detail and /sysUser/page endpoints omit the requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authent...

CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC 認可ポリシーのバイパス: :path スラッシュ欠如 認可バイパス 説明 google.golang.org/grpc の authz パッケージは、:path 疑似ヘッダーに対して拒否ルールと許可ルールをマッチングさせる SDK レベルの RBAC 認可を実装しています。HTTP/2 サーバートランスポートは、クライアントから受け取った生の :path 値を、先頭が / で始まることを検証せずに格納します。ルーティング層 handleStream はディスパッチ前にパスを正規化しますが、RBAC エンジンは...

GHSA-QC2Q-P7WX-3PX3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Summary A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies specifically DENY rules by using mixed-case or canonical-case header matchers e.g., X-Role instead of x-role. Additionally, the safety guards introduced by gRFC A...

CVE-2026-62650

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

CVE-2026-62650

Reyrolle 7SR5 (all versions prior to V2.70 ) contains a server-side authorization flaw in its web-based management interface . Role-based access control (RBAC) restrictions can be bypassed by manipulating request data, enabling an authenticated, low-privileged remote attacker to escalate to an ad...

CVE-2026-62650

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

EUVD-2026-72665

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

EUVD-2026-70053

Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read...

GHSA-8XJQ-PR36-CCGF Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Summary The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges ReadPacket when an API request omits specific packet names. As a result, an attacker with a low-privileged account or any authenticated user with zero privileges can dump the entire archive of...

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

CVE-2026-61783

Wazuh versions 4.14.0 through 4.14.6 contain an RBAC logic flaw in the mask_sensitive_config() decorator. The gate that determines whether sensitive values are masked checks only whether a manager:update_config or cluster:update_config rule exists, without evaluating whether that rule's effect is...

CVE-2026-61783 Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...

CVE-2026-71325

A flaw was found in Traefik. This flaw allows a tenant, even when restricted by Role-Based Access Control RBAC to a single namespace, to bypass namespace isolation. By binding their own router to a TraefikService in another namespace, an attacker can expose or reroute that namespace's backend...

Wazuh Server 4.0.0 < 4.14.5 Incorrect Authorization (CVE-2026-44252)

The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.5. It is, therefore, affected by an incorrect authorization vulnerability: - A low-privilege read-only API user with manager:read permission can retrieve the cluster key from ossec.conf. An attacker can use the...

CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...

CVE-2026-47735

Arc (Basekick Labs) is an open-source SQL-native time-series database for telemetry. Prior to 26.06.1 , its user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only read_parquet( and arc_partition_agg( via regex denylist, while the broader DuckDB I/O function family (read_csv_au...

CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...