CVE-2026-82432

Apache Storm Nimbus contains an authorization bypass in its blobstore handling. The topology.blobstore.map field was validated against the calling subject only at topology submission time; the rebalance operation accepted configuration overrides but never re-ran that validation. A caller authoris...

CVE-2026-82432 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides

Description Nimbus validated topology.blobstore.map against the calling subject at submission time only. The rebalance operation accepts configuration overrides and stripped a small set of keys from them, but never re-ran that validation, so a caller authorised to rebalance a topology could...

CVE-2025-29927

CVE-2025-29927 CVE-2025-29927: Next.js Middleware Bypass Vulnerability This repository demonstrates the CVE-2025-29927 vulnerability in Next.js where the internal header x-middleware-subrequest can be used to bypass middleware checks like authentication. Affected Versions root@kitploit: Next.js...

EUVD-2026-77516

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82437

Apache Storm Logviewer fails to enforce its configured logs.users and logs.groups access controls for daemon logs . The root cause is twofold: the access-decision logic discarded the authorizer's result whenever the "daemon log" flag was set, and the daemon log page and download endpoints reached...

CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82920 Mattermost ABAC parent policy bypass via policy update endpoint

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/accesscontrolpolicies...

EUVD-2026-77487

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 fail to enforce authorization boundaries on the access control policy update endpoint which allows a channel or team administrator to detach a system-assigned ABAC parent policy via a crafted PUT /api/v4/accesscontrolpolicies...

CVE-2026-90941

novel-plus through 5.3.3 contains an authorization bypass in the BookController download endpoint , allowing authenticated backend accounts to export complete book text—including paid chapters —by supplying a bookId and bookName , without VIP or purchase verification. The vulnerability bypasses t...

EUVD-2026-77485

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP o...

CVE-2026-8337

CVE-2026-8337 CVE-2026-8337 是 Concrete CMS 中影响 Survey（调查）功能的一个不安全的直接对象引用（IDOR）漏洞。与 CVE-2026-8347（涉及 Express 关联）不同，该漏洞允许未认证攻击者在特定站点配置下参与受限/私有调查。 概述 Concrete CMS 9.5.0 及更早版本在其调查功能中存在授权缺陷。如果网站同时配置了公开调查和受限（私有）调查，攻击者可以将受限调查的 optionID 提交到公开调查端点。 由于应用程序未能正确验证所提交的 optionID...

CVE-2026-73236

Apache Syncope is vulnerable to a cross-realm authorization bypass in its delegated administration feature. Security checks that rely on prefix matching of Realm names fail to distinguish two sibling Realms sharing a common name prefix, allowing an unauthenticated network attacker to gain incorre...

CVE-2026-73236 Apache Syncope: Cross-Realm authorization bypass in delegated administration

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm hierarchy and enforced via prefix matches. Due to incorrect implementation, two sibling Realms whose names begin with the same string cannot be correctly distinguished, resulting i...

CVE-2026-90935

Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

CVE-2022-22978

CVE 2022-22978: RegexRequestMatcher における認証バイパス 🥶 概要 調査した情報によると、これはSpring SecurityフレームワークのRegexRequestMatcher クラスに関連する脆弱性です。具体的には、正規表現にドット.を含むRegexRequestMatcherを使用するアプリケーションは、\r%0a 、\n%0d などの文字によってバイパスされる可能性があり、攻撃者は認証なしで許可されていないパスにアクセスできてしまいます。 脆弱性の影響を受けるSpring Securityフレームワークのバージョン: 5.5.7 より前の...

CVE-2026-73579

This Incorrect Authorization vulnerability in Apache Syncope affects the Realms filter component. When processing non-recursive search requests , the Realms filter can be rendered as empty, effectively voiding all privilege-based restrictions on search results. This allows requesters to potential...

CVE-2026-90935

Froxlor before 2.3.7 contains an authorization bypass in the Mysqls.add API command : the mysql_server parameter is not validated against the customer's allowed_mysqlserver allowlist. A low-privileged attacker can supply a disallowed server index to create MySQL databases and users on forbidden s...

CVE-2026-90935 Froxlor before 2.3.7 Authorization Bypass via Mysqls.add API

Froxlor before 2.3.7 fails to validate the mysqlserver parameter against a customer's allowedmysqlserver allowlist in the Mysqls.add API command. Attackers can supply a disallowed server index to create MySQL databases and users on forbidden servers, bypassing per-customer access controls...

PoC-CVE-2025-29927

PoC-CVE-2025-29927 漏洞是什么？ 该 CVE 报告了标头 x-middleware-subrequest 中的一个缺陷，该标头负责处理 Next.js 中的内部请求，允许攻击者绕过 Next.js 15.0.0 中的授权中间件，从而访问受保护的路由，例如 实际示例 在一个 Web 应用中，存在 /dashboard 路由，只有登录用户才能访问，但是，如果我们使用标头 x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware 发起请求，则可以在无需身份验证的情况下访问该路...

CVE-2025-29927

CVE-2025-29927 ★ CVE-2025-29927 Next.js ミドルウェアバイパス PoC ★ 説明 CVE-2025-29927 : Next.js ミドルウェアバイパス PoC 説明: Next.js は、フルスタック Web アプリケーションを構築するための React フレームワークです。バージョン 1.11.4 以降、および 12.3.5、13.5.9、14.2.25、15.2.3 より前のバージョンでは、認可チェックがミドルウェアで行われている場合に、Next.js...