CVE-2026-120209

The AJ-Report software (through version 1.7.1) is vulnerable to an authentication bypass leading to remote code execution (RCE) . The root cause is the use of a hard-coded JWT secret to sign share tokens, which allows attackers to forge valid tokens offline. By minting a token with the reportCode...

CVE-2026-120209 AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code...

CVE-2026-104189

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

CVE-2026-104189 3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

EUVD-2026-111082

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

CVE-2026-104189

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

PT-2026-126616

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

PT-2026-118054

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

CVE-2026-61843

Versions of FileRise prior to 3.18.0 are vulnerable to an unauthenticated file overwrite. The software fails to reject destination filenames that already exist within upload-enabled shared folders or upload-only links. An unauthenticated visitor with a valid share token and password can upload a ...

CVE-2026-61843 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and an...

GHSA-VFXW-3X8P-2VJR Vikunja: Link-share token can enumerate users through the v2 API

Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...

Vikunja: Link-share token can enumerate users through the v2 API

Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach. The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't. As a result, anyone with a share...

GHSA-RJ9J-8772-4H6C Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Summary The task-collection endpoint GET /api/v1/projects/project/views/view/tasks loads the requested project view straight from the URL path without verifying the caller is authorized for it. For a link-share token, the task query is correctly pinned to the share's own project, but the view is...

Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfxw-3x8p-2vjr. This link is maintained to preserve external references. Original Description Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints...

GHSA-VCGV-7RVM-M3VP Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vfxw-3x8p-2vjr. This link is maintained to preserve external references. Original Description Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints...

CVE-2026-91981 Vikunja before 2.6.0 User Enumeration via v2 API

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint...

CVE-2026-91981

Vikunja , a self-hosted task management application, is affected by a user enumeration vulnerability in versions before 2.6.0 . The root cause is improper validation of link-share tokens in the v2 API user search endpoints. An attacker holding a read-only share link can enumerate project members ...

CVE-2026-78887 liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorization

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high...

CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

EUVD-2026-63639

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...