169448 matches found
EUVD-2026-85534
/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...
CVE-2026-71460 Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/
/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...
GHSA-VMJQ-HVGQ-2WV4 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
Summary The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the...
NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
NPM: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...
GHSA-6MWV-4MRM-5P3M 9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
Summary The Kiro API-key validation endpoint builds an upstream URL using a user-controlled region value. By supplying a crafted region such as kiro-canary.local:8443, an authenticated attacker can cause 9router to send the Kiro validation request to an attacker-controlled host under the...
EUVD-2026-42929
9router: Image prefetch DNS rebinding allows SSRF to internal services...
EUVD-2026-85524
JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...
CVE-2026-71459
The Red Hat Ansible Automation Platform (automation-controller ) is vulnerable to a cross-tenant job event data exposure due to a missing RBAC check in the JobJobEventsChildrenSummary view. The underlying cause is that the view lacks a model/parent_model definition, causing ModelAccessPermission....
CVE-2026-71461
HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...
CVE-2026-71460
/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...
CVE-2026-71459
JobJobEventsChildrenSummary view has no model/parentmodel. ModelAccessPermission.checkgetpermissions falls through returns True for any authenticated user. The view uses raw getobjector404Job, pk without DRF object-level permission check. Zero-privilege user reads event tree structure,...
CVE-2026-55632 GoCD is vulnerable to authorization bypass via pipeline structure API
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...
CVE-2026-55632 GoCD is vulnerable to authorization bypass via pipeline structure API
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...
EUVD-2026-85517
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...
CVE-2026-55632
The continuous delivery server GoCD is affected by an authorization bypass vulnerability in the internal pipeline structure API (versions 20.2.0 through 26.1.0). The API, which is used for autocompletion when editing configurations like pipelines, templates, environments, and user preferences, in...
CVE-2026-55632 GoCD is vulnerable to authorization bypass via pipeline structure API
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...
EUVD-2026-85516
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...
CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...