PT-2026-110175

Name of the Vulnerable Software and Affected Versions UnicomAI Wanwu versions prior to 0.6.6 Description An authorization bypass allows authenticated users to mint AppKeys bound to MCP servers belonging to other users. By sending a request to the endpoint "/v1/appspace/app/key" and providing a...

CVE-2026-108856: Authorization Bypass Through User-Controlled Key

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the...

CVE-2026-108853: Authorization Bypass Through User-Controlled Key

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assista...

PT-2026-110145

🚨 CVE-2026-108742 CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with...

PT-2026-110133

Name of the Vulnerable Software and Affected Versions Raven versions 2.0.0 through 3.0.0 Description Missing authorization in legacy methods within raven/api/raven message.py allows authenticated non-members to bypass workspace membership checks. By using predictable channel IDs, an attacker can...

PT-2026-110170

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.11 Description An authorization flaw exists in the MCP server faq search tool. This occurs because the searchDatabase function fails to apply user or group permission checks. Consequently, clients connected to th...

PT-2026-110148

Name of the Vulnerable Software and Affected Versions Vearch versions 3.5.2 through 3.5.9 Description An incorrect authorization issue exists in the HasPermissionForResources function. This flaw allows the system to ignore stored ReadOnly or None privilege levels for resources assigned to a role...

PT-2026-110135

🚨 CVE-2026-108732 Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get account and amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method...

PT-2026-110113

Name of the Vulnerable Software and Affected Versions NornicDB versions prior to 1.4.2 Description Authenticated users can bypass per-database read restrictions. Users with a viewer role who are allowlisted for a database but denied read access can retrieve node IDs, labels, and full property map...

PT-2026-110165

Name of the Vulnerable Software and Affected Versions CoreShop versions prior to 2026.2.3 Description Low-privileged backend users can list permission-restricted resources due to a missing authorization check in the listAction function of the ResourceController. Authenticated Pimcore users withou...

CVE-2026-108730: Missing Authorization

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/ravenmessage.py that skip the workspace membership check. Authenticated non-members can call getmessageswithdates or getallfilessharedinchannel with predictable channel IDs to read Public chann...

CVE-2026-108695: Incorrect Authorization

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108720: Missing Authorization

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...

CVE-2026-108697: Missing Authorization

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403 check. Authenticated Pimcore users lacking resource permissions can request the...

CVE-2026-108712: Missing Authorization

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...

CVE-2026-108746: Incorrect Authorization

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /rol...

CVE-2026-108732: Missing Authorization

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method wit...

CVE-2026-108851: Missing Authorization

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faqsearch tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

CVE-2026-108758: Authorization Bypass Through User-Controlled Key

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...

CVE-2026-108727: Missing Authorization

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a templa...