PT-2026-84598

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia Premium versions 8.0 through 9.6.2 Description Insufficient validation of the type parameter in the customer update endpoint allows unauthenticated attackers to escalate privileges. By...

CVE-2026-75458

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

CVE-2026-82869 ToolJet Database before v3.16.44 Privilege Escalation via join_tables

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the jointables endpoint that grants JOINTABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by...

CVE-2026-47101-PoC

CVE-2026-47101 — LiteLLM Privilege Escalation via /key/generate + /user/update LiteLLM v1.82.6（v1.83.14 之前版本）的 /key/generate 端点允许低权限的 internaluser 请求带通配符路由 "/" 的 API key，随后通过 /user/update 端点将自身角色提升为 proxyadmin，实现未授权的权限提升。 Field| Value ---|--- CVE| CVE-2026-47101 CVSS v3.1| 8.8 HIGH —...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82240

Budibase versions before 3.41.3 contain a privilege escalation vulnerability in the public user create and update endpoints. The application fails to validate app-scoped builder role assignments , allowing an authenticated app-scoped builder to submit crafted requests containing builder.apps fiel...

CVE-2026-19423

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

EUVD-2026-67570

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated...

PT-2026-82876

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 2.13.0 Description An issue exists where the plugin fails to validate role selection when it cannot resolve the set of roles permitted by a profile form. Instead of checking against the form's...

MongoDB 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-124355)

The version of MongoDB installed on the remote host is 8.0.x prior to 8.0.28 or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory,...

EUVD-2026-49066

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise...

PT-2026-63471

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This failure in...

EUVD-2026-44897

The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the digupdatewpwccustomfields function. This makes it possible for authenticat...

EUVD-2026-38701

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: avoid use of uninit sender vars batadvtprecvack and batadvtpstop are only valid for tpvars in the BATADVTPSENDER role. When called with a BATADVTPRECEIVER role, it proceeds to read sender-only members that we...

EUVD-2026-38463

NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can approve or reject privileged actions like package installation by submitting approval response...

CVE-2026-27604 FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions

FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API role handling allows unauthenticated access to privileged /api/system/ endpoints. Because system resolves to the cron admin identity,...

Improper Authorization

Open WebUI is vulnerable to improper authorization. The vulnerability is due to improper validation of authorized user roles in the API, which allows a pending user account to bypass intended access restrictions and gain unauthorized access to the web application...

CVE-2026-31070

The LalanaChami Pharmacy Management System commit 5c3d028 allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body...

CVE-2026-31070

The LalanaChami Pharmacy Management System commit 5c3d028 allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role during registration. The /api/user/signup endpoint fails to validate the role parameter in the request body...

Pharmacy Management System 安全漏洞

The Pharmacy Management System MPMS is a multilingual pharmacy management system developed by Mayuri K. The Pharmacy Management System 5c3d028 version has a security vulnerability. This vulnerability stems from the /api/user/signup endpoint, which fails to validate the role parameter in the reque...