9627 matches found
CVE-2026-72575 daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...
CVE-2026-72575
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...
CVE-2026-72575 daptin - Authentication Bypass via Null Owner Permission Check on usergroup Objects
An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions CanRead, CanPeek, CanCreate, CanUpdate, CanDelete, CanRefer in server/permission/permission.go return tr...
EUVD-2026-55242
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication
An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
EUVD-2026-55100
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
CVE-2026-21075
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
PT-2026-69448
Name of the Vulnerable Software and Affected Versions fosrl/pangolin versions prior to 1.21.0 Description An improper authorization issue allows an authenticated remote attacker to gain access to any resource within any organization by reusing an access token originally issued for a different...
PT-2026-69905
Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An issue exists in the local branch of the '/docker-container-terminal' endpoint within the docker-container-terminal.ts file. While the system uses validateRequest for authentication, it fails to...
PT-2026-69459
Name of the Vulnerable Software and Affected Versions daptin versions prior to 0.12.35 Description An improper authorization issue allows unauthenticated remote attackers to perform read, create, update, and delete operations on usergroup records. The flaw exists in the...
CVE-2026-21075: Improper Authorization in Handler for Custom URL Scheme
Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information...
PT-2026-69831
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/event id/question/create endpoint. The postCreateEventQuestion method loads the...
CVE-2026-72907: Improper Authorization
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...
PT-2026-69959
Name of the Vulnerable Software and Affected Versions Data Science Pipelines affected versions not specified Description An improper authorization issue exists in the setDefaultServiceAccount function. A restricted user or tenant can bypass authorization checks by specifying a more privileged...
PT-2026-69403
Name of the Vulnerable Software and Affected Versions My Galaxy versions prior to 6.3 Description Improper authorization in the handler for a custom URL scheme allows remote attackers to access sensitive information. Recommendations Update to version 6.3 or later...
Security Bulletin: IBM® Db2® is vulnerable to privilege escalation with a specially crafted query (CVE-2026-10543)
Summary IBM® Db2® is vulnerable to privilege escalation with a specially crafted query. Vulnerability Details CVEID:CVE-2026-10543 DESCRIPTION: IBM Db2 is vulnerable to privilege escalation with a specially crafted query. CWE:CWE-285: Improper Authorization CVSS Source: IBM CVSS Base score: 8.2...