EUVD-2026-66631

Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback handler POST field, allowing an authenticated backend user to invoke arbitrary controller methods, including...

CVE-2026-81035

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls...

CVE-2026-81035 Midday Missing Owner Check on Team Deletion

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls...

EUVD-2026-66611

Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the role it records, and the data-layer function it calls...

EUVD-2026-66607

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-81031

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

Summary A Cloudreve WebDAV account stores a uri that defines the account's root folder. The WebDAV request handler stripPrefix in pkg/webdav/webdav.go trims the /dav prefix from the request path and joins the remainder to that root with fs.URI.JoinRaw, but never checks that the joined URI stays...

GHSA-W5FV-7X5Q-G8QP Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account root

Summary A Cloudreve WebDAV account stores a uri that defines the account's root folder. The WebDAV request handler stripPrefix in pkg/webdav/webdav.go trims the /dav prefix from the request path and joins the remainder to that root with fs.URI.JoinRaw, but never checks that the joined URI stays...

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

GHSA-X287-5C68-36WP OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

GHSA-6X9P-4R67-5GJX Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obtain arbitrary S3 pre-signed upload URLs backed by a workspace datasource's stored server-side credentials. The affected endpoint is: POST /api/attachments/:datasourceId/url The calle...

CVE-2026-80204

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

CVE-2026-80203

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...

CVE-2026-80348

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-80346

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens...

CVE-2026-80348

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

EUVD-2026-66387

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-80348

TarsWeb through 3.0.16 has a missing authorization flaw in app/controller/patch/PatchController.js. Four methods—uploadAndPublish , downloadPackage , deletePatchPackage , and setPatchPackageDefault —fail to call the AuthService used for per-application role enforcement. As a result, any authentic...

CVE-2026-19197

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-19197

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...