CVE-2026-113733 Password hash disclosure to "view only" admin users with custom user models

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...

CVE-2026-113733

An issue exists in Django 6.1 before 6.1.3 and 6.0 before 6.0.10 involving the django.contrib.admin.utils.display_for_field() function. The function fails to obfuscate the password field for user models other than AUTH_USER_MODEL, or for models inheriting a password field through multi-table inhe...

EUVD-2026-116022

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...

CVE-2024-45058

CVE-2024-45058 PoC for CVE-2024-45058 Broken Access Control, allowing any user with view permission in the user configuration section to become an administrator changing their own user type. Grab the desired nivelusuario ID and run the exploit. Usage usage: CVE-2024-45058.py -h -t TARGET -u...

EUVD-2026-102875

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data...

CVE-2026-108862

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query...

BIT-AUTHENTIK-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

UBUNTU-CVE-2026-102297

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 are vulnerable to a path traversal vulnerability within the files view. The root cause is the improper validation of the path parameter before it is passed to the output_file function. This allows authenticated users with Events view permission to read arb...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2026-94611

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

EUVD-2026-86277

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611

The open-source identity provider authentik is vulnerable to unauthorized credential exposure in versions prior to 2026.2.7 , 2026.5.7 , and 2026.8.2 . The authentik API serializers incorrectly return stored credentials when a user possesses view permission on an affected configuration, even if t...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611: Exposure of Sensitive Information to an Unauthorized Actor

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

PT-2026-98034

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.7 authentik versions prior to 2026.5.7 authentik versions prior to 2026.8.2 Description API serializers return stored credentials when an account possesses view permission on specific configurations, regardle...

PT-2026-96130

Name of the Vulnerable Software and Affected Versions GoCD versions 18.7.0 through 26.0.x Description The Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. This allows an authenticated user with low privileges to bypass view permission...