CVE-2026-80209 Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2026-80209

Fonoster through version 0.22.7 contains an incorrect authorization flaw in the updateWorkspace handler (mods/identity/src/workspaces/createUpdateWorkspace.ts). The handler fires a gRPC PERMISSION_DENIED callback when the caller is not a workspace member but fails to return , allowing execution t...

CVE-2026-81681: Missing Encryption of Sensitive Data

opensslencrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption k...

PT-2026-82582

openssl encrypt pip package openssl-encrypt versions = 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored in cleartext and the derived encryption...

PT-2026-82748

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignore xss filter": 1 in frappe/desk/doctype/workspace link/workspace link.json, and sanitize content in frappe/model/base...

PT-2026-82561

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continue...

CVE-2026-81731: Improper Neutralization of Input During Web Page Generation

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CVE-2026-80209: Incorrect Authorization

The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSIONDENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but it does not return. Execution continues...

CVE-2026-62861

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a...

EUVD-2026-66126

TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts authorizes a caller against a...

CVE-2026-80049

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

EUVD-2026-65701

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-80049

Airbyte Platform through 2.0.0 suffers a cross-workspace authorization bypass. The root cause is that AuthorizationServerHandler extracts a caller-supplied workspaceId from the raw JSON request body and sets it in the X-Airbyte-Workspace-Id header, which AuthenticationHeaderResolver.resolveWorksp...

CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-55540

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, ispathwithindirectory uses os.path.abspath rather than os.path.realpath for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing readfile and other code tools to access files...

GO-2026-6273 Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis

Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation in github.com/runatlantis/atlantis...

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...

GHSA-CH89-H4R2-C8F8 PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...