FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-78433): Gitea -- multiple vulnerabilities

Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a publi...

PT-2026-114291

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The web attachment handler fails to perform cross-repository ownership checks for attachments created before 16 January 2026, instead validating permissions against the repository specified in...

CVE-2026-104875

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875 Ente: Accepted emergency contact can bypass the recovery notice period

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

PT-2026-111969

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-104875: Authorization Bypass Through User-Controlled Key

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...

CVE-2026-109564

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

EUVD-2026-97887

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564

LearnHouse versions prior to 1.4.0 are susceptible to a missing authorization vulnerability (CWE-862) within the POST /api/v1/playgrounds/{uuid}/duplicate endpoint. The flaw occurs because this endpoint bypasses the read-access and draft checks typically enforced by get_playground. Consequently, ...

CVE-2026-109329 Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to membersassignment.php with a foreign role UUID to gain privileged...

CVE-2026-109194

A flaw was found in Red Hat Quay. The build trigger management application programming interface API fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build...

CVE-2026-109195

A flaw in Quay allows an authenticated attacker to perform an Insecure Direct Object Reference (IDOR) to access repository auto-prune configurations from other namespaces. The root cause is a failure to properly enforce namespace scoping when retrieving policy details using a repository name and ...

PT-2026-110940

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by get playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

CVE-2026-109564: Missing Authorization

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...