PT-2026-84972

Authorization bypass through user-controlled key issue exists in ShizenBox2 edge-app. If exploited, an attacker who can log in to the product may change the other user's password...

PT-2026-85310

🚨 HIGH: CVE-2026-69857 CVSS 8.5 - Authorization bypass in Azure Cosmos DB allows authenticated attackers to perform spoofing over network. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/jpe1VOsLLc...

GO-2026-6313 Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api

Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

CVE-2026-84662

The Jenkins LDAP Plugin (versions 807.809.vd3a_4e5e4ec98 and earlier) is vulnerable to Server-Side Request Forgery (SSRF) due to improper access control in the Stapler data-binding mechanism. The plugin uses the @DataBoundConstructor annotation on a constructor that connects to a specified URL wi...

BIT-GITLAB-2026-4398 Authorization Bypass Through User-Controlled Key in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have assigned compliance frameworks from namespaces they were not authorized to access to their own...

CVE-2026-81846

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

CVE-2026-81846 runZero MCP 'Findings summaries' Data Leak

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

CVE-2026-81846

CVE-2026-81846 is an authorization bypass in the runZero Platform MCP service , classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability allows a low-privilege network attacker to bypass authorization and access findings summaries data, resulting in a limited co...

CVE-2026-81846 runZero MCP 'Findings summaries' Data Leak

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

EUVD-2026-69554

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

CVE-2026-84205

GROWI through 8.0.2 contains an authorization bypass in the GET /_api/v3/revisions/:id endpoint. The vulnerability arises because the endpoint validates access using a query parameter but returns the revision identified by the path parameter without confirming both reference the same page. An aut...

PT-2026-84399

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

Authorization Bypass Through User-Controlled Key

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the feedback PUT and DELETE endpoints in backend/chainlit/server.py. An authenticated attacker can modify or delete other users’ feedback by...

CVE-2026-81267

A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin while continuing to render attacker-controlled content. This vulnerability was fixed in Firefox for iOS 155.0...

MGASA-2026-0350 Updated perl-Plack packages fix a security vulnerability

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting...

Updated perl-Plack packages fix a security vulnerability

Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting...

CVE-2026-53620

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

EUVD-2026-68371

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

CVE-2026-53620

GROWI contains an authorization bypass (CWE-639) in the bookmark folder APIs , caused by a user-controlled key. An authenticated attacker can retrieve, tamper with, or delete another user's bookmark data. The CVSS 3.0 score is 6.3 (Medium) and CVSS 4.0 is 5.3 (Medium) , reflecting network vector,...

CVE-2026-53620

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...