46 matches found
CVE-2026-114490
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...
CVE-2026-114476
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...
CVE-2026-114490 Incorrect Authorization in hMailServer
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...
CVE-2026-114490
Progressive Robot hMailServer versions 6.3.4 through 6.3.6 contain an incorrect authorization vulnerability in the COM administration API . The root cause is that the COM API's server-administrator check fails to respect domain restrictions for accounts with the serveradmin role, treating them as...
EUVD-2026-107329
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...
CVE-2026-114490 Incorrect Authorization in hMailServer
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...
CVE-2026-114476
Progressive Robot hMailServer versions 6.3.4 through 6.3.6 are affected by an incorrect authorization vulnerability in the REST administration API . A remote authenticated user with manage_roles permissions (via a full-scope API key) or an account with the serveradmin role can exploit the DELETE ...
CVE-2026-114476 Incorrect Authorization in hMailServer
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...
CVE-2026-114476 Incorrect Authorization in hMailServer
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...
EUVD-2026-107319
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...
PT-2026-120671
Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows an account assigned the serveradmin role with a list of domains - a credential an administrator may create meaning to confine it to those domains - to act as the whole-server...
PT-2026-120654
Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manage roles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmi...
CVE-2026-111906
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...
EUVD-2026-103314
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...
CVE-2026-111906: Cross-Site Request Forgery (CSRF)
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endpoints, which do not validate a CSRF token for the create, drop, and import actions. Attackers can lure a user with CONFIGURATIONED...
EUVD-2026-91832
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...
CVE-2026-105046
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...
CVE-2026-105046
Kentico Xperience 13 versions prior to 13.0.216 are vulnerable to an object-level authorization deficiency. The issue stems from a lack of proper authorization checks for administration API endpoints , which may allow unauthorized access to administrative functions. Specific details regarding the...
