CVE-2026-65897

Grav API Plugin before 1.0.10 is affected. The flaw in InvitationsController::create() fails to validate the groups field, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. When such invitations are accepted, the new account gain...

CVE-2019-19249

Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations...

CVE-2019-19249

Controllers/InvitationsController.cs in QueryTree before 3.0.99-beta mishandles invitations...

CVE-2019-19249

The CVE-2019-19249 entry concerns the QueryTree project: Controllers/InvitationsController.cs mishandling invitations in versions before 3.0.99-beta. Public details in NVD and vendor mirrors identify the affected component as part of QueryTree’s invitation handling, with the issue present prior t...