CVE-2026-108676: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108665: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt...

PT-2026-109934

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the exportXls handler within the AiragPromptsController. This issue allows any authenticated user, including those with low privileges, to export all AI prompts from...

CVE-2026-108669: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to...

CVE-2026-108620: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint,...

CVE-2026-108605: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr...

CVE-2026-108610: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other...

PT-2026-109881

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysPositionController. This issue allows any authenticated user, including those with low privileges, to delete organizational...

PT-2026-109907

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the importExcel handler of the SysCategoryController. This issue allows any authenticated user, including those with low privileges, to upload specially crafted Exce...

CVE-2026-108646: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import category dictionary entries. Low-privileged attackers can upload crafted Excel workbooks to bulk insert arbitrary nodes into the...

PT-2026-109884

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description An authorization flaw exists in the deleteBatch handler of the SysLogController. This issue allows any authenticated user, including those with low privileges, to delete system audit log entries. B...

auto-repeater

AutoRepeater: Ripetizione automatica delle richieste HTTP con Burp Suite tl;dr All'interno di Extender importa AutoRepeater.jar Alcune brevi istruzioni AutoRepeater reinvierà solo le richieste modificate da una sostituzione definita. Quando AutoRepeater riceve una richiesta che corrisponde alle...

CVE-2026-107851

Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Summary A project member with Write permission can delete an admin-tier link share on that project. The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share. Its zero value is Read, so the check falls through to project...

EUVD-2026-78651

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project...

EUVD-2026-78654

Vikunja: API token scopes bypassed via task expand parameter comments, reactions, time entry counts...

EUVD-2026-51992

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide BOLA...

Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

GHSA-V3P6-34MC-HJ7V Vikunja: Scoped API token can mint unrestricted OAuth session credentials

Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: json "oauth":"authorize" can call /api/v1/oauth/authorize, receive an OAuth authorization code, exchange it at /api/v1/oauth/token, and obta...

CVE-2026-107851

The Contao Open Source CMS (versions 5.7.0 through 5.7.12) contains an improper access control vulnerability in the TableAccessVoter::hasAccessToModule() function located in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php. The root cause is that the voter caches authorization de...