candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

candlepin: candlepin: broken object-level authorization via VerifyAuthorizationFilter multi-@Verify hasAccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object ca...

CVE-2026-86322

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefinduser resolves the target account using User.findparams:userid without applying the required parent-user authorization check. An attacker with the createpersonalaccesstokens permission ca...

PT-2026-146048

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAwarefind user resolves the target account using User.findparams:user id without applying the required parent-user authorization check. An attacker with the create personal access tokens permissi...

CVE-2024-10542

Poc Of CVE-2024-10542 and CVE-2024-10781 Broken Authentication in Spam protection, AntiSpam, FireWall by CleanTalk Plugin = 6.43.2 Disclaimer: The information provided in this document regarding for CVE-2024-10542 is for learning and educational purposes only. We do not encourage or authorize the...

CVE-2026-8347

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...

CVE-2025-25618

CVE-2025-25618 Unifiedtransform v2.0 is vulnerable to Incorrect Access Control, allowing teachers to change the Section Name and Room Number — permissions that should be restricted to administrators. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to th...

CVE-2026-119663

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-119663 Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

EUVD-2026-114079

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-119663 Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-119663

The cloud sync API in Tamery (formerly Conar) versions 0.32.0 before 0.99.0 is vulnerable to a broken authorization flaw in the connectionsResources.create handler. This vulnerability allows authenticated users to attach resources to connections owned by other users. Specifically, an attacker who...

PT-2026-133593

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-119663: wannabespace tamery: Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API…

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

SolarWinds Observability Self-Hosted < 2026.4 Multiple Vulnerabilities

The version of SolarWinds Observability Self-Hosted installed on the remote host is prior to 2026.4. It is, therefore, affected by multiple vulnerabilities: - A broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

CVE-2026-28328

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

CVE-2026-28328 SolarWinds Observability Self-Hosted broken authorization schema

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

CVE-2026-28328

SolarWinds Observability Self-Hosted is impacted by a broken authorization schema (CWE-863). This vulnerability allows low-privileged users to access and modify information that falls outside of their assigned permissions. The issue results in a HIGH base severity (CVSS 3.1 score of 8.8), with si...

CVE-2026-28328 SolarWinds Observability Self-Hosted broken authorization schema

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...

EUVD-2026-105175

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions...