PT-2026-110132

Name of the Vulnerable Software and Affected Versions Corteza versions prior to 2024.9.11 Description An incorrect authorization issue exists in the compose attachment endpoints. Unauthenticated attackers can download private attachments by modifying the URL kind segment to page, icon, or...

PT-2026-110195

🚨 CVE-2026-108873 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its...

CVE-2026-108866: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identif...

CVE-2026-108867: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId parameter to retrieve assigned role codes...

CVE-2026-108884: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notificati...

CVE-2026-108881: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user to read other tenants' product pack membership. Low-privileged attackers can supply a tenantId and fixed packCode values such as superAdmin, accountAdmin or...

CVE-2026-108880: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify low-code application dictionaries. Attackers can supply a dictionary's lowappid, obtained from GET /sys/dict/list, via the lowAppId...

CVE-2026-108872: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batchEditUsers with arbitrary user and...

CVE-2026-108870: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite dataruleids, clearing row-level filte...

CVE-2026-108883: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or...

CVE-2026-108873: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and replace or remove its department heads...

CVE-2026-108871: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and dataRuleIds values to overwrite...

CVE-2026-108869: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser values to deliver forged announcement...

CVE-2026-108868: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a forged fromUser to send notifications ...

CVE-2026-108851: Missing Authorization

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

CVE-2026-108756: Missing Authorization

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...

CVE-2026-108742: Missing Authorization

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen...

CVE-2026-108733: Missing Authorization

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108730: Missing Authorization

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/ravenmessage.py that skip the workspace membership check. Authenticated non-members can call getmessageswithdates or getallfilessharedinchannel with predictable channel IDs to read Public chann...

CVE-2026-108729: Incorrect Authorization

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment i...