37 matches found
PT-2026-109131
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...
CVE-2026-104974
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...
CVE-2026-104974 Plane: Disabled User Auto-Reactivation on Login
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...
CVE-2026-104974
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...
EUVD-2026-92528
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...
CVE-2026-104974 Plane: Disabled User Auto-Reactivation on Login
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...
CVE-2026-104974
The open-source project management tool Plane is vulnerable to unauthorized account reactivation in versions prior to 1.4.0 . An attacker can log in using credentials associated with a deactivated account (where is_active=False). The authentication process silently updates the is_active status ba...
CVE-2026-104974 Plane: Disabled User Auto-Reactivation on Login
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...
CVE-2026-104974: Improper Access Control
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting isactive=False can still log in with existing credentials. Successful authentication silently changes isactive back to True, reactivating the account without notifying the...
PT-2026-106053
Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is active=False can still log in with existing credentials. Successful authentication silently changes is active back to True, reactivating the account without notifying the...
CVE-2026-103268
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the user.py process. An attacker can permanently delete user accounts, lock users out by deactivation, or reactivate previously deactivated accounts by exploiting improper gym affiliation checks when the gym...
CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-55987
The software Gitea is vulnerable to an incorrect authorization flaw where an OAuth2 sign-in reactivates an account that was previously deactivated by an administrator on authentication sources, specifically when refresh tokens are not used. This issue is an incomplete fix for bug #38009. Exploita...
EUVD-2026-58141
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...
CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...