EUVD-2026-97608

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

CVE-2026-109306 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

CVE-2026-109306 Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to...

CVE-2026-109306

Craft CMS versions 5.0.0 before 5.10.14 are vulnerable to a missing authorization flaw in the AppController::actionSwitchToLicensedEdition() function. This flaw allows any authenticated user to modify the installed edition of the software. Specifically, low-privileged front-end users can trigger ...

CVE-2026-109296 Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing route...

CVE-2026-109296 Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing route...

EUVD-2026-97598

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing route...

CVE-2026-109296

Open WebUI versions prior to 0.11.4 are vulnerable to a missing authorization flaw (CWE-639) in the model routes. This vulnerability allows authenticated users to access disabled model provider backends by providing an explicit backend index as a path segment or query parameter on Ollama and Open...

CVE-2026-109202

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since...

CVE-2026-109201

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP...

CVE-2026-109203

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its version...

CVE-2026-109203 LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its version...

EUVD-2026-97442

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its version...

CVE-2026-109203

LogicalDOC Community Edition through version 9.3 is vulnerable to a missing authorization flaw in the ConvertPdf servlet (CWE-862). This vulnerability allows authenticated users to bypass access controls and download restricted PDF documents from folders they are not authorized to view. Attackers...

CVE-2026-109203 LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its version...

CVE-2026-109202 LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since...

EUVD-2026-97443

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since...

CVE-2026-109202 LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since...

CVE-2026-109202

LogicalDOC Community Edition (through version 9.3) contains a missing authorization vulnerability within the zip-export servlet . The root cause is that the ZipExport.addFolderDocuments() method fails to perform necessary READ and DOWNLOAD permission checks. Consequently, an authenticated user ca...

CVE-2026-109201 LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP...