CVE-2026-100871 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-100871

Sylius versions before 1.12.25 , 1.13.17 , 1.14.20 , 2.1.16 , and 2.2.9 are vulnerable to a JWT audience confusion flaw. The application fails to include firewall identification in JWT tokens issued by the Admin and Shop API endpoints. An attacker can register a shop customer account using an adm...

CVE-2026-100871 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-100871: Improper Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-77825

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

CVE-2026-77825

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

CVE-2026-77825

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 is vulnerable to a path traversal flaw in the Admin API log-download endpoint (GET /v1/admin/logs/file). The vulnerability stems from the use of str.startswith() for path confinement, which lacks proper boundary validation. This allows an ...

CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

EUVD-2026-86011

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

Security Bulletin: IBM ContextForge MCP Gateway is affected by path traversal

Summary IBM ContextForge MCP Gateway Admin API contains a path traversal vulnerability in the administrative log download handler /v1/admin/logs/file where an authenticated user with administrative privileges can retrieve files from sibling directories sharing a common path prefix with the log...

CVE-2026-77825: Improper Limitation of a Pathname to a Restricted Directory

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

PT-2026-97837

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement chec...

CVE-2026-77426

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are missing the write-scope enforcement that their neighboring endpoints correctly apply. Specifically, the WOPI configuration fetch endpoint and the SMTP test/mail endpoint can both be...

GHSA-W89X-C962-C44G Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are missing the write-scope enforcement that their neighboring endpoints correctly apply. Specifically, the WOPI configuration fetch endpoint and the SMTP test/mail endpoint can both be...

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

CVE-2026-77426

The Unleash feature management platform (versions prior to 8.0.3 ) contains five authorization vulnerabilities in its admin API. A critical flaw in src/lib/features/segment/segment-controller.ts fails to await the hasPermission() call, allowing authenticated users to bypass permission checks and ...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...