CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-82276

StarRocks through 4.0.13 contains an authentication bypass in the Frontend (FE) where five REST handler classes override execute() directly instead of implementing executeWithoutPassword(), thereby bypassing the base class authentication gate. As a result, six unauthenticated endpoints on the fro...

CVE-2026-82276 StarRocks Frontend REST Handlers Bypass the Base Class Authentication Gate

StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute directly instead of implementing executeWithoutPassword. Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database...

CVE-2026-52892 Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST,...

CVE-2026-52892: Missing Authorization

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST,...

Authentication Bypass

github.com/blevesearch/bleve is vulnerable to authentication bypass. The vulnerability exists due to the missing role-based access control for rest handlers in indexcreate.go and indexdelete.go, allowing an attacker to recursively write and delete any directory in the server by using the same...

CVE-2016-3406

Multiple cross-site request forgery CSRF vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the Client uploader extension or 2 extension REST handlers, aka bugs 104294 and 104456...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the Client uploader extension or 2 extension REST handlers, aka bugs 104294 and 104456...

CVE-2016-3406

Multiple cross-site request forgery CSRF vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the Client uploader extension or 2 extension REST handlers, aka bugs 104294 and 104456...

CVE-2016-3406: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecified victims via vectors involving 1 the Client uploader extension or 2 extension REST handlers, aka bugs 104294 and 104456...

PT-2017-8386

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions prior to 8.7.0 Description The issue involves multiple cross-site request forgery CSRF vulnerabilities that allow remote attackers to hijack the authentication of victims. This is achieved through vectors involvin...