CVE-2026-105678

Ghost is a Node.js content management system. From 0.5.0 until 6.64.0, staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. This issue is fixed in version 6.64.0...

PT-2026-106209

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description In the create-team-invitations and invitation acceptance paths, a non-owner team administrator can assign the owner role to another account. This occurs because invitation roles are persisted and...

CVE-2026-0920-

CVE-2026-0920- LA-Studio Element Kit para Elementor 📡 El exploit se publica aquí primero. Sigue a @KNxploited en Telegram: tu fuente de élite de CVEs recién divulgados, PoCs funcionales e investigación de seguridad de precisión. Actualizada sin descanso. Diseñada para quienes se mantienen a la...

CVE-2025-6758

Real Spaces - Tema de Directorio de Propiedades de WordPress ≤ 3.6 Escalación de Privilegios No Autenticada a Administrador a través de imicagentregister 📝 Descripción CVE-2025-6758 Puntuación CVSS: 9.8 Crítico El tema Real Spaces - Directorio de Propiedades de WordPress para WordPress es...

CVE-2026-104412

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor ...

CVE-2026-104412

Ghost versions 0.5.0 before 6.64.0 are vulnerable to a privilege escalation flaw due to improper restrictions on staff role assignments. An authenticated user with an Editor or Super Editor role can bypass permission checks to assign their own role to other staff members. Specifically, these user...

CVE-2026-104412 Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor ...

EUVD-2026-91423

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor ...

CVE-2026-104412 Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor ...

CVE-2026-104412 Ghost 0.5.0 before 6.64.0 Privilege Escalation via Staff Role Assignment

Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the Editor or Super Editor role to assign their own role to other staff despite lacking permission to do so. An authenticated Editor or Super Editor can promote Author and Contributor users to Editor ...

CVE-2023-32749-PoC

CVE-2023-32749 | Asignación no autorizada de roles en Pydio Cells Exploit para CVE-2023-32749 que afecta a Pydio Cells 4.1.2 y anteriores. Un usuario autenticado con privilegios bajos puede crear un nuevo usuario externo con todos los roles asignados, lo que otorga acceso a todas las celdas y...

CVE-2026-62183

CVE-2026-62183 — Escalada de privilegios en el autoservicio de usuario de Apache Syncope Gestión inadecuada de privilegios CWE-269 en Apache Syncope. Un usuario autenticado con pocos privilegios puede otorgarse a sí mismo roles arbitrarios y membresías de grupo, recursos externos y un nuevo realm...

CVE-2026-102093

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full...

USN-8854-1 keystone vulnerabilities

Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. CVE-2026-80182 It was discovered that...

PT-2026-103531

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description Improper Privilege Management occurs because the software does not correctly enforce restrictions on role assignment. This allows an authenticated administrative user with limited, non-Sysadmi...

CVE-2026-102129: Incorrect Privilege Assignment

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges...

CVE-2026-100686

Budibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to assign application roles across workspace boundaries. A builder of a single workspace can exploit missing per-app authorization checks to grant...

PT-2026-99282

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.261.1 Description The backend improperly restricts the roles that the apikey manager organization role can assign to new API keys. When an authenticated user with apikey manager permissions specifically org.manage...

WordPress Optima Express IDX plugin <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment vulnerability

Unauthenticated Privilege Escalation to 'ihfclearcache' AJAX Action to Author Role Assignment vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Optima Express + MarketBoost IDX Plugin versions = 8.7.5...

CVE-2026-94609

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...