CVE-2026-101139: Missing Authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-101000: Missing Authorization

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the...

CVE-2026-82377: Missing Authorization

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...

CVE-2026-100879

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-100879

A security flaw exists in zhistaredu StarTraining up to version 3.8.1 . The vulnerability is located in the checkRoleAllowed function within the SysRoleServiceImpl.java file of the dataScope Endpoint component. This flaw leads to missing authorization , which may be triggered via a remote attack ...

CVE-2026-100879 zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-100879 zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

EUVD-2026-88034

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GET /api/station/stationid/file/id/play endpoint. An attacker can access and download media files from stations they do not have permission to view by enumerating sequential IDs and exfiltrating the complet...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the download endpoint. An attacker can access restricted audio content by directly requesting media files using valid media identifiers. Remediation Upgrade azuracast/azuracast to version 0.23.8 or higher...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Liquidsoap API endpoint due to missing internal connection requirements and improper validation of the AutoDJ flag. An attacker can inject arbitrary now-playing metadata, disrupt live broadcasts, and disclo...

CVE-2026-100744

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744

A flaw in coollabsio Coolify versions up to 4.1.2 within the Route-Level Middleware component leads to a missing authorization vulnerability. The issue resides in an unknown function within the app/Http/Middleware/CanUpdateResource.php file. This flaw can be triggered via a remote manipulation at...

EUVD-2026-87817

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100853: Missing Authorization

In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to download media files excluded from On-Demand-enabled playlists. Attackers can bypass the station operator's intended access restrictions by directly...

CVE-2026-100879: Missing Authorization

A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleServiceImpl.java of the component dataScope Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit h...

CVE-2026-100744: Missing Authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...