PT-2026-82367

Name of the Vulnerable Software and Affected Versions Entity PDF versions 0.0.0 through 2.1.5 Description Missing authorization in the Entity PDF module allows forceful browsing. The module fails to check entity view access when fetching a PDF route, which may allow a user to access a PDF of an...

PT-2026-82100

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.1 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 Description An improper authorization check allows an authenticated user with reporter-role permissions who authored a merge...

PT-2026-82223

Name of the Vulnerable Software and Affected Versions Midday affected versions not specified Description An authorization flaw exists in the team management logic where the system fails to verify the user role during team deletion and updates. The delete procedure in the...

Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-38474

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

CVE-2026-38470

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...

GO-2026-6287 Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/cloudreve/Cloudreve

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached contexthint in github.com/cloudreve/Cloudreve...

CVE-2026-80049

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

EUVD-2026-65701

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-79788

Dradis Community Edition versions 5.1.0 through 5.2.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability (CVSS 7.1, HIGH). The root cause is that ProvidersController and AgentsController gate their admin_required authorization on defined?(Dradis::Pro), a constant never defined in ...

CVE-2026-55528

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.authtoken but AgentServer.createapp does not check it on any route. A remote caller can subscribe, publish, and perform other actions without a valid bearer token or X-Auth-Token even when...

CVE-2026-69104 Potential unauthorized repository migration in JFrog Artifactory

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-55530 PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, astgreprewrite lacks the @requireapproval decorator used by sibling mutation tools. With dryrun=False, an agent-controlled call can pass --update-all and a broad path to rewrite matching files without the expected...

CVE-2026-79669

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79666

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

CVE-2026-79667

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

BIT-KEYCLOAK-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

BIT-KEYCLOAK-2026-37981 Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint

A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote authenticated user, who owns at least one User-Managed Access UMA resource, to enumerate and harvest personally identifiable information PII for all realm users. By...

EUVD-2026-65441

Ech0 before 4.4.3 protects the PUT /user endpoint with the profile:read scope, a read-only scope, but allows write operations including password changes. An attacker with an admin's profile:read access token can change the admin's password and login to obtain an unrestricted session token that...

EUVD-2026-65442

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...