EUVD-2026-49374

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17531

CVE-2026-17531 affects unitedbyai droidclaw up to version 0.5.3. The vulnerability is in an unspecified aspect of file server/src/routes/goals.ts (Unsigned Scheduled Callback) and enables authorization bypass. Remote exploitation is possible, with high complexity and a PROOF-OF-CONCEPT exploit pu...

CVE-2026-17531

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17531 unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17529

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astrmainagent.py. The manipulation of the argument req.functool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available an...

BIT-DOTNET-2026-50528 .NET Security Feature Bypass Vulnerability

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network...

openSUSE 16 Security Update : nginx (openSUSE-SU-2026:21439-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21439-1 advisory. This update for nginx fixes the following issues - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured ...

PT-2026-64974

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr main agent.py. The manipulation of the argument req.func tool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available...

etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

GHSA-XG4H-6GFC-H4M8 etcd: Watch API authorization bypass via open-ended range requests

Impact What kind of vulnerability is it? Who is impacted? A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey an open-ended, "from this key to the end of the keyspace" watch to receive watch events for every key lexicographically greater than...

GHSA-86CX-WWF4-PHQ4 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...

GHSA-P6PH-3JX2-3337 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

Summary An authorization bypass and information disclosure vulnerability exists in the search API of Openlist. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned BasePath restrictions to discover and access metadata of files...

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Summary The /api/fs/batchrename handler validates and authorizes only the requested source directory. It rejects path separators in newname, but it does not validate srcname. The handler concatenates srcdir and attacker-controlled srcname, then passes the result to the filesystem rename layer,...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through improper validation of ownership in the editRecord process. An attacker can modify or overwrite DNS records in zones they do not own by manipulating the rid and zid parameters in ...

GHSA-4QCJ-M5WP-JMF4 Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to Admin.Read but not Admin.Write can call POST /api/v4/admin/policy/oauth/signin and update OneDrive storage policy credentials. The route is inside the admin group...

GHSA-8PVW-JCV7-9CMJ @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Impact @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file o...

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Impact @fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate slashes in the pathname used for file resolution. Non-canonical pathnames such as //file, /./file, or /public/../private/file bypass allowedPath filtering while resolving to the intended file o...

CVE-2026-17039

A flaw was found in pki-core. The certificate authority CA renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without...