CVE-2026-79788

In Dradis Community Edition, the ProvidersController and AgentsController gate their adminrequired beforeaction on "defined?Dradis::Pro", a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...