CVE-2026-47102-PoC

CVE-2026-47102 — LiteLLM Privilege Escalation via /user/update LiteLLM v1.83.7 versions before v1.83.10 /user/update endpoint allows low-privileged users with access to this endpoint to modify their own userrole field to proxyadmin when updating their account, achieving unauthorized privilege...

LiteLLM proxy_admin Privesc (CVE-2026-47101)

Post-exploitation variant of CVE-2026-47101: escalates an internaluser API key to proxyadmin via /key/generate wildcard routes and /user/update. Reads host, port, TLS, and keys from the active HTTP session when present. !/usr/bin/env python3 -- coding: utf-8 -- """LiteLLM CVE-2026-47101 — post...

LiteLLM CVE-2026-47101 proxy_admin privesc

CVE-2026-47101: an internaluser API key can call /key/generate with wildcard allowedroutes, then /user/update to escalate to proxyadmin. Supply masterkey to bootstrap an internal user, or an existing userkey. !/usr/bin/env python3 -- coding: utf-8 -- """LiteLLM CVE-2026-47101 internaluser to...

BIT-PARSE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when...

PT-2026-123460

Parse Server before 8.6.99 and 9.0.0 before 9.10.3 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, when...

CVE-2026-112768

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768

Parse Server versions prior to 8.6.99 and 9.0.0 before 9.10.3-alpha.2 are vulnerable to an Information Disclosure vulnerability. The root cause is that the system evaluates checks against a target account during a user update before authorizing the caller, reflecting the outcome in the response. ...

EUVD-2026-104574

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

PT-2026-117619

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.99 Parse Server versions 9.0.0 through 9.10.3-alpha.1 Description An issue exists where the server evaluates checks against a target account during a user update before authorizing the caller and reflects the...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the JobUserController process. An attacker can perform unauthorized actions on user accounts by tricking a victim into submitting malicious requests to the endpoints /user/insert, /user/update, or...

CVE-2026-106708

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

Astra Linux – vulnerability in Zabbix

An authenticated user with API access—for example, a user with the default “User” role—or more specifically, a user with access to the user.update API endpoint—is sufficient to add themselves to any group e.g., Zabbix Administrators. This does not apply to groups that are disabled or have...

CVE-2026-106708

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

CVE-2026-106708: Cross-Site Request Forgery (CSRF)

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

EUVD-2026-102426

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

CVE-2026-106708

XXL-JOB version 3.5.0-SNAPSHOT and earlier is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists in the JobUserController user management controller, specifically on the /user/insert , /user/update , and /user/delete endpoints. These endpoints lack CSRF protection and do not rest...