CVE-2026-71367

An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumeraccess function only enforces access controls for object-level event groups jobevents, workflowevents, adhoccommandevents but does not restrict subscriptions to global broadcast groups such as...

CVE-2026-71367 Awx: websocket broadcast groups leak cross-organization job metadata

An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumeraccess function only enforces access controls for object-level event groups jobevents, workflowevents, adhoccommandevents but does not restrict subscriptions to global broadcast groups such as...

EUVD-2026-124483

An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumeraccess function only enforces access controls for object-level event groups jobevents, workflowevents, adhoccommandevents but does not restrict subscriptions to global broadcast groups such as...

CVE-2026-71367

An incorrect authorization vulnerability exists in the AWX WebSocket consumer. The consumer_access() function fails to restrict subscriptions to global broadcast groups, such as jobs-status_changed, while only enforcing controls for object-level event groups. Consequently, an authenticated user c...

CVE-2026-18276

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

CVE-2026-18276 Missing Authorization in eScriptorium

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

CVE-2026-18276: Missing Authorization

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

PT-2026-68611

Name of the Vulnerable Software and Affected Versions Scripta eScriptorium versions prior to 26.04.2 Description Missing authorization in the websocket consumer allows a remote authenticated user to subscribe to the event stream of any document. This occurs because the object cls and object pk...

PT-2026-55898

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header...