CVE-2026-111683

The Allegro Ralph application, through version 20260902.1 , is vulnerable to a missing authorization flaw (CWE-862) in its Data Center Rack API. The root cause is that RalphPermission skips permission checks for views that do not include a queryset. Authenticated staff users can exploit this by c...

CVE-2026-111682

The software EFAK versions 5.0.0 through 5.1.0 is vulnerable to a missing authorization flaw (CWE-862) within the /api/model-config REST API. Authenticated users with low-privilege ROLE_USER accounts can query the /api/model-config/page or /api/model-config/{id} endpoints to retrieve unmasked LLM...

EUVD-2026-102974

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and...

EUVD-2026-102973

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLEUSER account can query /api/model-config/page or /api/model-config/id to retrieve...

EUVD-2026-102972

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLEADMIN,...

CVE-2026-111679

Ekko Studio versions through 0.7.36 are vulnerable to a missing authorization flaw in the /api/auth/locked-ips endpoint. This allows any authenticated non-super_admin user to list and clear server-wide login lockouts. Specifically, an attacker can send a DELETE request without an IP parameter to ...

EUVD-2026-102970

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-superadmin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll, disabling the login ra...

CVE-2026-111674

The software Tbed (versions through 20240319 ) is vulnerable to a missing authorization flaw in the /admin/setImgFileName endpoint. This vulnerability allows any authenticated user to rename images belonging to other users. An attacker can provide a victim's imgname—which is often exposed in publ...

EUVD-2026-102965

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names wi...

EUVD-2026-102963

Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/viewpipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copypipeline...

CVE-2026-111670

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

EUVD-2026-102961

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670 ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module

ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTable...

CVE-2026-111670

ClickVisual versions through 1.1.2 are vulnerable to a missing authorization (CWE-862) flaw within the /api/v2/reports handlers. This security weakness allows authenticated users with low privileges to access ClickHouse instances they are not authorized to view. By iterating the instance-id param...

CVE-2026-111668

The AIHelms application (through version 0.1.25 ) contains a missing authorization vulnerability in the apps/api/v1/efficiency.py component. This flaw allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Consequently, an attacker can access s...

EUVD-2026-102959

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read...

CVE-2026-111667 REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint

REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...

CVE-2026-111667

REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/lis...

CVE-2026-111667

REBUILD through version 4.5.0 contains a missing authorization vulnerability in the TaskCommentController.commentList component. Due to a lack of project membership checks, authenticated low-privileged users can access the /project/comments/list endpoint to retrieve comment content and attachment...