CVE-2026-123518

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...

CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...

CVE-2026-123518

Vikunja versions prior to 2.7.1 are vulnerable to an authorization bypass in the TaskBucket.CanUpdate function. The root cause is a failure to verify that both a task and its target kanban bucket belong to the same project. Consequently, an authenticated user with write access to two separate pro...

EUVD-2026-119403

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...

CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...

PT-2026-139799

Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a ta...

CVE-2026-107363

A flaw was found in OpenStack Zaqar. In deployments utilizing the WebSocket transport, the service fails to bind subsequent communication requests to the project associated with the authenticated user's token. An authenticated remote attacker can substitute a target project's identifier to inspec...

CVE-2026-121631

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUui...

security-research

Security Research Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 29 CVEs across 15 projects , 2023 to 2026. I also wrote the remediation for 84 more that other people found - not a credit of mine, and listed separately in the third...

CVE-2026-85299

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data. This vulnerability was patched on 31 August...

EUVD-2026-105772

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs...

OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

Summary The OpenChoreo API server authorized PUT .../workflowruns/runName against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried...

GHSA-46R4-Q7WV-32FC OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

Summary The OpenChoreo API server authorized PUT .../workflowruns/runName against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree. A WorkflowRun's membership in a project and component is carried...

CVE-2026-93856

In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the...

JetBrains YouTrack < 2026.2.19575 / 2026.3.x < 2026.3.16075 Missing Authorization (CVE-2026-111092)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.19575, or 2026.3.x prior to 2026.3.16075. It is, therefore, affected by a missing authorization vulnerability: - In JetBrains YouTrack before 2026.2.19575, 2026.3.16075, 2026.3.16397, 2026.3.16402 mail rules allowed...

CVE-2026-113727

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...

CVE-2026-113727

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...

CVE-2026-113727 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...

CVE-2026-113727 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...

CVE-2026-113727 OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs

OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/runName update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the...