NPM: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

NPM: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user vulnerability discovered by ? in WordPress Npm apostrophe versions 4.34.0...

ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

GHSA-RW26-WWFC-9WVM ApostropheCMS: Missing Authentication in `cleanExport` Route

Summary The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly...

EUVD-2026-105172

ApostropheCMS: Missing Authentication in cleanExport Route...

CVE-2026-114477

Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to read the server-wide traffic history. GET /api/v1/metrics/history returns the server's traffic counters over th...

CVE-2026-114476

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...

CVE-2026-114476

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...

EUVD-2026-107319

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...

CVE-2026-114476 Incorrect Authorization in hMailServer

Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential holds the manageroles permission in named domains - a full-scope API key issued for those domains, or an account assigned the serveradmin...

CVE-2026-114399

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

CVE-2026-114401

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114395

Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed...

CVE-2026-114393

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or...

CVE-2026-114392

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the...

CVE-2026-114401

The Trudesk application (versions through 1.2.11 ) is vulnerable to a regular expression injection flaw in the POST /api/v1/login endpoint. This vulnerability allows unauthenticated attackers to perform username enumeration by submitting specific regex patterns, such as (admin|root) or a.*. By an...

CVE-2026-114401 Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

EUVD-2026-107248

Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like admin|root or a. and distinguish 'Invalid User' from...

CVE-2026-114399

The Trudesk application (versions through 1.2.11 ) is vulnerable to a path traversal vulnerability (CWE-22) within its backup and restore APIs. Specifically, the DELETE /api/v1/backup/:backup endpoint allows administrators to delete arbitrary files by providing encoded traversal sequences. Additi...

CVE-2026-114399 Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

CVE-2026-114399 Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...