Rocky Linux 10.1 [CIQ] Security Update: libudisks2 / libudisks2-debuginfo / libudisks2-devel / udisks2 / etc Multiple Vulnerabilities (crlsa-2026_3476)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20263476 advisory. udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API CVE-2026-26104 udisks: Missing Authorization...

CVE-2026-13720

A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...

CVE-2026-93547

The Vaadin Spreadsheet component (including the Spreadsheet add-on for Vaadin Framework 7 and 8) contains a missing authorization check that allows authenticated users to add or replace cell comments on sheets with enabled protection, including locked cells. The underlying cause is that the handl...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

EUVD-2026-89952

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-93547 Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-95287

A flaw was found in Chromium. A missing authorization check in the navigation mechanism allows a remote attacker who has compromised a renderer process to bypass site isolation protections by convincing a user to load a crafted HTML page. Site isolation is a security boundary that separates web...

PT-2026-99273

Name of the Vulnerable Software and Affected Versions ClawHub versions prior to 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 Description The application backend contains a missing authorization check within the changelog preview feature. An authenticated user can trigger the...

CVE-2026-100388 RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied...

CVE-2026-100388 RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages

RustDesk versions before 1.5.0 fail to properly validate file transfer permissions on incoming file clipboard messages in the Cliprdr message handler on Linux and macOS. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard and retrieve copied...

CVE-2026-56726 Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-56726 Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-100177

The AIL Framework crawler contains an authorization flaw in the api_add_crawler_task API. The application fails to validate organizational boundaries or user roles when a user provides a cookiejar UUID for one-shot or scheduled crawler tasks. Specifically, if a cookiejar's access level is not 0, ...

CVE-2026-67241: Missing Authorization

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

CVE-2026-76648 Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery

CopyAPIView awx/awx/api/generics.py:873 sets permissionclasses = IsAuthenticated,, so DRF's getobject performs no object-level RBAC. The get handler lines 988–991 explicitly guards with request.user.canaccessobj.class, 'read', obj — but post lines 1001–1010 does not. POST only checks:...

EUVD-2026-85043

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-95671 MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

CVE-2026-63342 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflowrun.yaml defines the GET /api/v1/stable/durable-tasks/durable-task endpoint implemented by listDurableEventLog without requiri...

PT-2026-95547

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8 Description An authenticated user can exploit a missing authorization check in the DuplicateRecordsToOtherVehicles endpoint. While the system verifies the destination vehicles, it fails to call the...