EUVD-2026-115364

Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...

CVE-2026-119733

Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...

CVE-2026-119733 Munshi Missing Authorization in Company Deletion API

Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...

CVE-2026-119733

The Munshi platform (by Petpooja) versions prior to 2026-07-07 is vulnerable to a missing authorization flaw in its company deletion workflow at DELETE /api/companies/{company_id}. The application fails to verify company ownership or enforce the company_delete permission. This allows an authentic...

CVE-2026-119733 Munshi Missing Authorization in Company Deletion API

Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...

CVE-2026-84798

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798

Craft CMS versions 5.0.0-RC1 through 5.10.10 contain an authorization bypass in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and performs the deletion authorization check only against the user's own provisional draft (verifying draft...

EUVD-2026-69910

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798 Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

PT-2026-84671

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-84798: Missing Authorization

Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...

CVE-2026-56423

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports,...

CVE-2026-56423: Missing Authorization

MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authorized deletion using broad role-level permissions instead of validating authorization for each selected object. For Event Reports,...