Missing Authorization

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Missing Authorization in the setapisignUp process. An attacker can gain unauthorized permissions by supplying crafted parameters during account registration,...

Missing Authorization

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Missing Authorization via the restoreexistingsession path in the WebSocket session restoration. An attacker can gain unauthorized access to another user's session and assume their permissions and...

CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934 Cross-Project Information Leakage in Google App Engine UI

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

CVE-2026-8934

The CVE-2026-8934 describes a Missing Authorization vulnerability in a GraphQL private API operation within Google App Engine Cloud Console, enabling an unauthenticated attacker to leak sensitive App Engine request logs from other projects via a crafted request. Affected component: Google Cloud C...

EUVD-2026-38262

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched ...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

Missing Authorization

Overview org.apache.nifi:nifi-runtime-manifest-core is an Apache NiFi is an easy to use, powerful, and reliable system to process and distribute data. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

Missing Authorization

Overview org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

Missing Authorization

Overview org.apache.nifi:nifi-framework-cluster is a clustering software for NiFi. Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization when replacing Process Groups containing components marked with the Restricted annotation. An attacker can gain unauthorized access to restricted components by submitting requests to replace Process Groups without...

CVE-2026-44914

Apache NiFi versions 1.12.0–2.9.0 are vulnerable to missing authorization when replacing Process Groups that include extension components with the Restricted annotation. The Restricted annotation signals higher privileges, but framework authorization did not enforce restricted status during repla...

CVE-2026-44914 Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not...

CVE-2026-56384

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview...

CVE-2026-56396 phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser and updateUserRights endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edituser permission can set issuperadmin flag or grant arbitrary rights to escalate to SuperAdm...

CVE-2026-56396

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser and updateUserRights endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edituser permission can set issuperadmin flag or grant arbitrary rights to escalate to SuperAdm...

CVE-2026-56396 phpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser and updateUserRights endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edituser permission can set issuperadmin flag or grant arbitrary rights to escalate to SuperAdm...

CVE-2026-56396

CVE-2026-56396 (phpMyFAQ) affects phpMyFAQ versions before 4.1.4. The issue is missing authorization in editUser() and updateUserRights(), allowing authenticated administrators with edit_user to set the is_superadmin flag or grant arbitrary rights, escalating to SuperAdmin. This leads to high-imp...