CVE-2026-108499 WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0...

EUVD-2026-102252

Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0...

CVE-2026-108499

The WordPress Knowledge Base plugin (versions 3.2.0 and below ) is vulnerable to a Broken Access Control issue (CWE-862 ). Specifically, a Missing Authorization vulnerability in the knowledgebase component allows attackers to exploit incorrectly configured access control security levels. This vul...

WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by myhappyhoon in WordPress Plugin Knowledge Base versions = 3.2.0...

CVE-2026-108499: Missing Authorization

Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0...

CVE-2026-110775

Nexent through 2.7.0 contains a missing authorization vulnerability in checkfileaccess that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledgebase/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage f...

CVE-2026-110775

Nexent versions up to and including 2.7.0 are vulnerable to a missing authorization flaw within the check_file_access function. The root cause is the failure to perform tenant comparisons during knowledge_base/ reads, which allows authenticated users in multi-tenant environments to access data be...

CVE-2026-110775 Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Nexent through 2.7.0 contains a missing authorization vulnerability in checkfileaccess that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledgebase/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage f...

CVE-2026-110775 Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Nexent through 2.7.0 contains a missing authorization vulnerability in checkfileaccess that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledgebase/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage f...

July 14, 2026—KB5099414 (OS Build 22631.7376)

None None...

July 14, 2026—KB5099444 (Monthly Rollup)

None None...

July 14, 2026—KB5099539 (OS Builds 19045.7548 and 19044.7548)

None None...

July 14, 2026—KB5099538 (OS Build 17763.9020)

None None...

July 14, 2026—KB5101649 (OS Build 28000.2525)

None None...

CVE-2026-109285

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...

CVE-2026-109287

Open WebUI versions 0.9.6 before 0.11.4 are vulnerable to an information disclosure flaw due to an authorization oversight. The application fails to verify that a supplied directory_id belongs to the requested knowledge base when accessing GET /api/v1/knowledge/{id}/files . An attacker with read ...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109287 Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directoryid belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET...

CVE-2026-109285 Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in hasaccesstofile that lets former knowledge base collaborators keep file access via stale cached knowledge base references. Attackers with read or write grants can download removed files through the file conte...