EUVD-2026-60761

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7...

CVE-2026-73499

A flaw was found in etcd, a distributed key-value store. A user with READ permission on a single key can bypass authorization checks in the Watch gRPC API by using open-ended range requests. This allows them to receive watch events for keys beyond their authorized scope, leading to information...

CVE-2026-75853

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75845

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the setserversetting MCP server-level tool. SetServerSettingTool.execute gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-roo...

CVE-2026-75839

ArcadeDB com.arcadedb:arcadedb-server versions = 26.7.3 contain an insecure direct object reference IDOR vulnerability in the Raft cluster-info endpoints GetClusterHandler and PostBootstrapStateHandler, which authenticate but do not authorize access. On an ArcadeDB HA cluster only reachable when...

CVE-2026-75832

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0 before version 1.0.14 fixed in 1.0.15 contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope. The method gates the users/ scope on the account's raw super-admin ACL flag access.api.super instead ...

CVE-2026-75835

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75836

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

CVE-2026-74904

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

CVE-2026-74906

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from...

CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75853 ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database

ArcadeDB's Gremlin wire-protocol plugin com.arcadedb:arcadedb-gremlin in versions = 26.7.3 enforces authentication SASL PLAIN but performs no authorization: it never checks database access permissions canAccessToDatabase and never binds the authenticated principal into the engine. As a result, an...

CVE-2026-75853

The com.arcadedb:arcadedb-gremlin plugin (≤26.7.3) enforces SASL PLAIN authentication but skips authorization: it never calls canAccessToDatabase or binds the principal, so any valid credential can read, write, and drop data in any database via a traversal-source alias, bypassing all per-type/rea...

EUVD-2026-60612

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

CVE-2026-75846 ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATESCHEMA check. Any...

CVE-2026-75845

ArcadeDB 26.4.2–26.7.3's SetServerSettingTool.execute() checks only the global allowAdmin flag without verifying the caller's role, letting authenticated read-only users modify GlobalConfiguration in MCP deployments. CVSS 6.3 (MEDIUM); no exploitation observed. Fixed in 26.8.1.{

CVE-2026-75845 ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the setserversetting MCP server-level tool. SetServerSettingTool.execute gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-roo...

EUVD-2026-60609

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the setserversetting MCP server-level tool. SetServerSettingTool.execute gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-roo...

CVE-2026-75845 ArcadeDB 26.4.2 before 26.8.1 Authorization Bypass via set_server_setting

ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the setserversetting MCP server-level tool. SetServerSettingTool.execute gates only on the global allowAdmin flag and never checks the caller's role, so in an MCP deployment with allowAdmin=true and a non-roo...

CVE-2026-75843

ArcadeDB versions before 26.8.1 fail to bind the authenticated principal on the gRPC transaction executor thread during beginTransaction, letting authenticated readers bypass scripting authorization and execute arbitrary JavaScript that creates server-wide admin accounts. Patch to 26.8.1 or later...