CVE-2026-104867

The admin route "GET /api/admin/users/id/calendar-heatmap" is declared with "@Authenticated permission: Permission.UserRead " instead of "@Authenticated permission: Permission.AdminUserRead, admin: true ", and the service method behind it performs no ownership or role check. Every other endpoint ...

CVE-2025-8549

The CVE-2025-8549 entry concerns atjiu pybbs up to version 6.0.0. The vulnerable component is the update function in src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java, where manipulation leads to weak password requirements. The issue is remotely exploitable with high attack co...

CVE-2025-8549 atjiu pybbs UserAdminController.java update weak password

A vulnerability was found in atjiu pybbs up to 6.0.0. It has been classified as critical. Affected is the function update of the file src/main/java/co/yiiu/pybbs/controller/admin/UserAdminController.java. The manipulation leads to weak password requirements. It is possible to launch the attack...