Authorization Bypass Through User-Controlled Key

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the /admin/accounts/users/username endpoint. An attacker can obtain sensitive information...

CVE-2025-13084

The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators...

CVE-2025-13084

The groov View API exposes a users endpoint that returns a list of all users with metadata including their API keys. Access requires an Editor role, but the endpoint reveals API keys for all users, including Administrators, creating potential exposure and confidentiality impact. The issue is docu...

CVE-2025-13084 Opto 22 groov View Exposure of Sensitive Information Through Metadata

The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators...

EUVD-2025-199744

The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators...

CVE-2025-64062

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...

CVE-2025-64064

Primakon Pi Portal 1.0.18 /api/v2/ppusers endpoint fails to adequately check user permissions before processing a PATCH request to modify the PPSECURITYPROFILEID. Because of weak access controls any low level user can use this API and change their permission to Administrator by using...

PT-2025-48162

Name of the Vulnerable Software and Affected Versions groov View affected versions not specified Description The users endpoint within the groov View API reveals a list of all users along with their associated metadata, including API keys. Access to this endpoint is governed by role-based access...

Opto 22 groov View Server 安全漏洞

Opto 22 groov View Server is an industrial automation remote monitoring software from Opto 22, USA. A security vulnerability exists in Opto 22 groov View Server that originates from the users endpoint returning all users and their API keys, which could lead to information disclosure...

PT-2025-48042

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level including standard or low-privileged users, can make a GET request to this endpoint and retrieve a...

Primakon Pi Portal 安全漏洞

Primakon Pi Portal is a project, contract management platform from Primakon Croatia. A security vulnerability exists in Primakon Pi Portal version 1.0.18, which stems from a lack of session authentication in the /api/V2/ppusers?email endpoint, which could lead to elevated privileges...

Primakon Pi Portal 安全漏洞

Primakon Pi Portal is a project, contract management platform from Primakon Croatia. A security vulnerability exists in Primakon Pi Portal version 1.0.18, which stems from insufficient checking of permissions in the /api/v2/ppusers endpoint, which could lead to elevated privileges...

CVE-2025-64061

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level including standard or low-privileged users, can make a GET request to this endpoint and retrieve a...

Primakon Pi Portal 安全漏洞

Primakon Pi Portal is a project, contract management platform from Primakon Croatia. A security vulnerability exists in Primakon Pi Portal version 1.0.18, which stems from insufficient access control in the /api/v2/users endpoint and could lead to unauthorized data disclosure...

CVE-2025-64062

The Primakon Pi Portal 1.0.18 /api/V2/ppusers?email endpoint is used for user data filtering but lacks proper server-side validation against the authenticated session. By manipulating the email parameter to an arbitrary value e.g., [email protected], an attacker can assume the session and gain...

CVE-2025-64064

CVE-2025-64064 affects Primakon Pi Portal 1.0.18 via the /api/v2/pp_users endpoint. A PATCH request that modifies PP_SECURITY_PROFILE_ID can bypass permissions checks, allowing a low-privilege user to elevate to Administrator. Core issue is weak access control around the PP_SECURITY_PROFILE_ID pa...

NVIDIA AIStore AuthN users Missing Authentication for Critical Function Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NVIDIA AIStore. Authentication is not required to exploit this vulnerability. The specific flaw exists within the users endpoint. The issue results from the lack of authentication prior to...

CVE-2025-64683

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API...

CVE-2025-64683

In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API...

PT-2025-46152

Name of the Vulnerable Software and Affected Versions JetBrains Hub versions prior to 2025.3.104432 Description An information disclosure issue exists in JetBrains Hub. This allows for the potential disclosure of information via the Users API. The API endpoint involved is the Users API...