PT-2026-110571

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description An incorrect authorization issue exists in the GET '/supplier/exportExcel' endpoint. This allows authenticated users to bypass role data scope restrictions that are normally enforced by the...

CVE-2026-109182: Incorrect Authorization

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-108708

WukongHRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards an...

CVE-2026-108708

WukongHRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards an...

CVE-2026-108708 Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil

WukongHRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards an...

PT-2026-109999

Wukong HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards a...

CVE-2026-108708: Missing Authorization

WukongHRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards an...

CVE-2026-94496

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

EUVD-2026-84047

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-76901 CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/id in PoolClueController.get and GET /pool/account/get/id in PoolCustomerController.get use bare pool-read permission checks without the CsPermission...

CVE-2026-92594

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...

PT-2026-92113

Name of the Vulnerable Software and Affected Versions SmartAdmin API Java17 SpringBoot3 version 3.30.0 Description An improper authorization issue exists in the '/employee/queryAll' endpoint. The system fails to enforce necessary function-level permissions or data-scope authorization, which enabl...

CVE-2026-88620: Missing Authorization

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

CVE-2026-88620

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

CVE-2026-88620

The SmartAdmin API running on Java17 SpringBoot3 version 3.30.0 is affected by an improper authorization vulnerability in the /employee/queryAll endpoint. The root cause is a failure to enforce necessary function-level permissions or data-scope authorization . Consequently, an authenticated low-p...

EUVD-2026-78812

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

CVE-2026-90941

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to export complete book text including paid chapters. Attackers can supply a bookId and bookName to retrieve all chapter content without VIP o...

CVE-2026-90939: Missing Authorization

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticated attackers can retrieve password hashes and personal data including email addresses and phone numbers for users within their data scope,...

PT-2026-91245

Name of the Vulnerable Software and Affected Versions novel-plus versions prior to 5.3.4 Description An authorization bypass exists in the download endpoint of the BookController. This issue allows authenticated backend accounts to export the complete text of a book, including paid chapters, by...