EUVD-2026-104965

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949 Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

CVE-2026-105949

Cruise Control for Apache Kafka is vulnerable to an authentication bypass due to a misconfiguration in the Jetty ConstraintSecurityHandler . The handler registers security constraints on exact path specifications but fails to use a catch-all wildcard constraint or call setDenyUncoveredHttpMethods...

CVE-2026-105949

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

OffensiveNotion

OffensiveNotion Notion yes, the notetaking app as a C2. A collaboration by: Documentation | Pull Requests | Issues !Pull...

WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Taegyeong Yun in WordPress Plugin Paid Member Subscriptions versions = 3.1.2...

CVE-2026-112068

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site...

CVE-2026-112069

The FAL Protect (fal_protect) extension contains a Broken Access Control vulnerability (CWE-862) when used on websites running TYPO3 14.3 . The extension fails to apply access protection to files within file storages using a non-default relative base path , allowing these files to be served direc...

CVE-2026-112069 Broken Access Control in extension "FAL Protect" (fal_protect)

The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website...

CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...

CVE-2026-112240

The TYPO3 Fluid-Form by coding.ms (fluid_form) extension contains a broken access control vulnerability. The issue stems from a predictable token used in download links for files uploaded via forms, combined with insufficient verification of the file name in requests. This allows an unauthenticat...

CVE-2026-112071 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071

The TYPO3 Shop by coding.ms extension contains a Broken Access Control vulnerability (CWE-862) in its order cancellation function. The application accepts an order identifier from a request and processes the cancellation without verifying if the requester owns the order. Consequently, any site vi...

CVE-2026-113468 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the...

CVE-2026-112239 Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its...

CVE-2026-113468

The TYPO3 Shop by coding.ms extension contains a Broken Access Control vulnerability (CWE-862) in its PayPal payment notification endpoint. The application fails to verify that incoming data originates from the legitimate payment provider, allowing any site visitor to overwrite the stored payment...

CVE-2026-112239

The TYPO3 AI Integration Extension (ns_t3ai) contains a Broken Access Control vulnerability. The extension provides a backend endpoint that writes submitted values into page records without verifying user permissions or limiting which fields can be modified. Consequently, any authenticated backen...

CVE-2026-112070 Broken Access Control in extension "Analytics" (analytics)

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to...

CVE-2026-112070

The Analytics extension (analytics) contains a Broken Access Control vulnerability due to a failure in the AJAX routes , which do not verify if a backend user has permission to access the associated module or dashboard widget. Consequently, any backend user can retrieve analytics data from sites ...