CVE-2026-53627

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

UBUNTU-CVE-2026-53627

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-53627 GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-53627

The asset and IT management software GLPI versions 11.0.0 through 11.0.8 is vulnerable to an authorization bypass. A low-privileged authenticated user can exploit the API (v2) to perform update operations that are restricted through the standard user interface. This occurs because the API update ...

EUVD-2026-87273

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-53627 GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-53627 GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

UBUNTU-CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

CVE-2026-96448

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

EUVD-2026-86588

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-96448 Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-96448 Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-96448

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846 Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

EUVD-2026-86530

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...

CVE-2026-97846 Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this...