CVE-2026-108712

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108712

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

EUVD-2026-96986

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108712

SuiteCRM versions through 7.15.2 and 8.10.2 are affected by a missing authorization vulnerability in the DetailUserRole entry point. This flaw allows authenticated non-admin users to view the ACL data of other non-admin users. An attacker can achieve this by supplying another user's ID in the rec...

CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

PT-2026-110115

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108712: Missing Authorization

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-93811

A flaw was found in the Linux kernel's ksmbd Server Message Block SMB server. When processing access control list ACL data, error-handling routines fail to release memory buffers if decoding fails or if an invalid security descriptor size is encountered. A remote attacker could exploit this...

CVE-2022-49908

CVE-2022-49908 affects the Linux kernel Bluetooth path, where a memory leak could occur in L2CAP/vhci_write: when an ACL fragment lacks the L2CAP length, the HCI core may copy the skb to conn->rx_skb and finish processing without freeing it. The provided patches fix this by releasing the relat...

PT-2024-36897

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue is related to the Bluetooth functionality in the Linux kernel, specifically in the hci core component. It involves a failure to check the length of a socket buffer skb when processing...

NAS Backup to Tape and FLR fails with "Invalid ACL data"

Challenge A File to Tape Backup job e.g., SMB Share to Tape, NFS Share to Tape, or File Server to Tape or a File Restore from Tape fails with the error: Error Invalid ACL data. Error: Unable to find ObjectVersion in cache for the file. File path: X Other symptoms include: A failing file enumerati...

kernel: Bluetooth: L2CAP: Fix memory leak in vhci_write

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix memory leak in vhciwrite Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810d81ac00 size 240: ... hex dump first 32 bytes: 00 00 ...

PT-2025-18625

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak has been identified in the Linux kernel's Bluetooth L2CAP implementation. The issue arises when the HCI core processes ACL data packets without freeing the skb, specificall...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists through inconsistency in the methods for allocating and freeing NFSv4 ACL data; CVE-2010-4250 fix caused a regression; a flaw in nextpidmap and inetdiagbcaudit; flaws in the CAN implementation; a race condition in the memory...

Denial Of Service (DoS)

kernel is vulnerable to denial of service. Inconsistency in the methods for allocating and freeing NFSv4 ACL data and the way mapping expansions were handled could allow a local, unprivileged user to cause a denial of service...

PT-2020-11424

Name of the Vulnerable Software and Affected Versions Android versions Android-10 Description The issue is related to a possible out of bounds read in the l2c rcv acl data function of l2c main.cc. This could lead to local information disclosure, requiring System execution privileges for...

CVE-2016-1575

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory...

Ubuntu 10.10 : linux vulnerabilities (USN-1183-1)

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. CVE-2010-4076, CVE-2010-4077 Neil Horman discovered that NFSv4 did not correctly handle...