CVE-2026-71367

An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumeraccess function only enforces access controls for object-level event groups jobevents, workflowevents, adhoccommandevents but does not restrict subscriptions to global broadcast groups such as...

CVE-2026-63401 Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

CVE-2026-63401

The Coop open source review and moderation tool by ROOST is vulnerable to an authorization bypass (IDOR) in versions prior to 1.0.2 . The addAccessibleQueuesForUser and removeAccessibleQueuesForUser functions fail to scope queueId and userId values to the caller's organization. Consequently, an a...

CVE-2026-63401 Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, addAccessibleQueuesForUser and removeAccessibleQueuesForUser accepted arbitrary queueId and userId values without organization scoping. An authenticated user belonging to one organization and holding MRT queue-edit...

PT-2026-132438

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

CVE-2026-92539

A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API insecure direct object reference. Only Grafana Enterprise instances with SCIM enabled are affected...

CVE-2026-16753 CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-16753

Lowcoder versions up to and including 2.4.10 are vulnerable to a cross-tenant authorization bypass in the LibraryQuery API service layer. The flaw stems from a failure to enforce organization-scope checks, allowing authenticated users with admin or dev roles to execute or retrieve metadata for li...

CVE-2026-16753 CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

EUVD-2026-100524

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-16753 CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-16753

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-16753: Undefined Security Weakness

Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated administrator or developer in one organization to execute a library query belonging to another organization via a crafted request containing the victim...

CVE-2026-107445: Authorization Bypass Through User-Controlled Key

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-78412

Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events from another org for which they have ...

CVE-2026-51904: Improper Access Control

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-51904

SuperAGI versions up to v0.0.14 are vulnerable to an improper access control vulnerability within the agent execution controller. Specifically, the functions create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id but fail to verify...

PT-2026-91938

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.4.1 Description An authorization bypass exists in the '/api/mcp' endpoint. Attackers possessing a valid clientId and clientSecret from any single application can gain unrestricted access to user administration acros...

grafana: Grafana: Unauthorized public dashboard deletion across organizations

A flaw in Grafana's public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard's ID...

TencentOS Server 4: grafana (TSSA-2026:0869)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0869 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...