CVE-2026-70618 Spacebar Server Missing Authorization via member-ids Endpoint

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...

CVE-2026-70618

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership by querying the GET /guilds/guildid/roles/roleid/member-ids endpoint without guild membership verification. Attackers can exploit the...

CVE-2026-70618

Spacebar Server (before commit 51da17c) contains a missing authorization vulnerability in the GET /guilds/{guild_id}/roles/{role_id}/member-ids endpoint. The unprotected route handler lacks permission checks present in sibling endpoints, allowing any authenticated user with a valid bearer token a...

CVE-2026-70617

CVE-2026-70617 — Spacebar Server : A missing authorization flaw exists in Spacebar Server prior to commit dcfd910, enabling any authenticated attacker to add themselves to arbitrary private group DM channels. The attacker can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} e...

CVE-2026-9130

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via sessionid collision. The MemoryComponent.retrievemessages and storemessage methods filter on sessionid without...

CVE-2026-9130

CVE-2026-9130 affects IBM Langflow OSS versions 1.0.0–1.10.3. The root cause is an authorization bypass in the MemoryComponent where session_id is used to filter messages without validating flow_id or user_id ownership, enabling cross‑user information disclosure. This impacts multi‑user deploymen...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.5 Images Security Update

New images are available for Red Hat build of Keycloak 26.6.5 and Red Hat build of Keycloak 26.6.5 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.5 Security Update

New Red Hat build of Keycloak 26.6.5 packages are available from the Customer Portal Red Hat build of Keycloak 26.6.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...

keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak

A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role mappings. This allows a delegated administrato...

keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

CVE-2026-15573

Keycloak has a vulnerability in its Authorization Services where the PathMatcher does not normalize URIs before policy comparison. The issue allows an authenticated user to bypass intended restrictions by adding characters such as a trailing slash or matrix parameters to a URL, causing the system...

CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

CVE-2026-71234 Documize Community - Attachment Download Authorization Bypass via Non-Validated secure Token

Documize Community's attachment download route domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware accepts a query parameter and grants access whenever the parameter is simply non-empty lensecureToken 0, without comparing it to any server-stored valu...

CVE-2026-71234

Documize Community exposes an authentication bypass in the attachment download endpoint: the Download function accepts a non-empty secure query parameter and grants access without validating against a server-stored value. This is inconsistent with sibling handlers (togglePublish, delete) which en...

CVE-2026-4431

The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the createpost function in all versions up to, and including, 2.3.0. This is due to the rbsmsubmitpost AJAX action being registered for unauthenticated users via...

CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

CVE-2026-71214

CVE-2026-71214 (NASA-AMMOS plandev sequencing-server) : The authorization middleware in sequencing-server derives the caller’s Hasura session role via getHasuraSession(), preferring a client-supplied session_variables object from the request body over JWT claims in the Authorization header, witho...