CVE-2026-96448

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-96448

A flaw in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak allows for privilege escalation . The vulnerability exists because the system fails to inspect the contents of composite roles when verifying if a delegated administrator has permission to assign a specific role. Consequen...

CVE-2026-96448: Improper Authorization

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 feature of Keycloak, an identity and access management solution. The issue occurs when the system checks if a delegated administrator has permission to assign a specific role to a user. Because the check does not look inside composite...

CVE-2026-97177 Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

EUVD-2026-85793

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

CVE-2026-97177

A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted...

PT-2026-97704

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system does not verify specific password reset authorizations...

UBUNTU-CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

PT-2026-96639

Summary POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the "onboarding already completed?" check and the user-creation write, with no atomic...

CVE-2026-86754: Incorrect Authorization

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

EUVD-2026-65354

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions...

CVE-2026-12878

CVE-2026-12878 affects the Codefresh platform , where an authenticated user can leverage an API endpoint to escalate privileges to Admin . The CVSS 4.0 score is 8.6 (HIGH) , with high impact on confidentiality, integrity, and availability of the vulnerable system. Attack requires high privileges ...

CVE-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter

A flaw was found in the Fine-Grained Admin Permissions FGAP v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a...

keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions FGAP v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not...

PYSEC-2026-3590 Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

CVE-2026-18571

CVE-2026-18571 affects Keycloak’s user creation flow when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. The flaw lets a sub-administrator with permission to create users add those users to any group, including groups the administrator isn’t authorized to manage, potentially enabling una...

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

PT-2026-66591

Name of the Vulnerable Software and Affected Versions Outstatic CMS versions prior to 2.2.0 Description The application contains a hardcoded JSON Web Token JWT signing secret. If the OST TOKEN SECRET environment variable is not configured, the system uses a default secret available in the public...