70654 matches found
CVE-2026-106495 Backstage: Improper access control in backend action invocation
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...
CVE-2026-106495 Backstage: Improper access control in backend action invocation
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...
CVE-2026-106495
The Backstage framework is affected by an improper access control vulnerability in the @backstage/backend-defaults package. Prior to version 0.17.8 , an authenticated user could successfully invoke backend actions that an operator had specifically excluded through action configuration. While exis...
CVE-2026-108923
The 1024-lab smart-admin software (up to version 3.30.0 ) contains an improper access control vulnerability in the Support Config Query component. Specifically, a manipulation of the configKey argument within the /support/config/queryByKey file allows for unauthorized actions. This vulnerability ...
CVE-2026-109285
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
CVE-2026-109285
Open WebUI versions 0.6.0 before 0.11.4 are vulnerable to an improper access control flaw within the has_access_to_file function. The root cause is the retention of stale cached knowledge base references , which allows former collaborators to maintain unauthorized access to files. An attacker wit...
CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
EUVD-2026-97587
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...
CVE-2026-21135
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...
CVE-2026-21139
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...
CVE-2026-21118
Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...
CVE-2026-21139
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...
EUVD-2026-97203
Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device...
CVE-2026-21135
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...
EUVD-2026-97199
Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information...
CVE-2026-21118
An improper access control vulnerability exists in the DownloadProvider component on devices prior to the SMR Oct-2026 Release 1 . This flaw allows local attackers to gain unauthorized access to files located within scoped storage . Exploitation details and specific exploit paths are not provided...
EUVD-2026-97182
Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...
CVE-2026-21117
An improper access control vulnerability exists in the CocktailBarService on Samsung Mobile devices. This flaw allows local attackers to access sensitive information . The vulnerability is present in versions prior to the SMR Oct-2026 Release 1 . No specific details regarding the root cause or ex...