CVE-2026-92801

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. While the text message handler applies per-user access controls, the card action handler does not, allowing attackers with low privileges in admitted chats to ...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

EUVD-2026-81061

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801: Incorrect Authorization

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

EUVD-2026-63172

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

EUVD-2026-63165

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76760

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761

CVE-2026-76761 is an OS command injection vulnerability in chenhg5 cc-connect (up to version 1.4.1). The flaw resides in the shellExecCommand function within core/engine.go , part of the Management API component. An attacker can remotely manipulate the exec argument to inject and execute arbitrar...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76760

In chenhg5 cc-connect up to version 1.4.1, the Authenticate function in core/webhook.go injects the attacker-controlled exec argument directly into command execution, enabling unauthenticated remote code injection over the network. CVSS 3.1 rates this HIGH (7.3). No patch version or exploit detai...

CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-76760 chenhg5 cc-connect webhook.go authenticate code injection

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

PT-2026-78839

Name of the Vulnerable Software and Affected Versions chenhg5 cc-connect versions prior to 1.4.2 Description Remote code injection is possible through the manipulation of the exec argument within the Authenticate function located in the core/webhook.go file. Recommendations Update to a version...