CVE-2026-108726

The GLPI application through version 12.0.0 is vulnerable to a missing authorization vulnerability in the ajax/map.php component. The root cause is the omission of the canView() check, which allows authenticated low-privileged users to search for itemtypes they are not authorized to view. By subm...

EUVD-2026-96893

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a templa...

EUVD-2026-96892

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contrac...

CVE-2026-108727 EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes

EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a templa...

CVE-2026-108727

The software EdgeEver (versions through 1.108.0 ) contains a missing authorization vulnerability within the Hono API memo-template routes . The root cause is that template handlers fail to call requireScopes, allowing holders of scoped API tokens to bypass intended scope restrictions. An attacker...

CVE-2026-108726 GLPI through 12.0.0 Missing Authorization via ajax/map.php

GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView check. Attackers can submit crafted itemtype and search criteria for types like Contact, Supplier, Contrac...

CVE-2026-108720

Versions of phpIPAM through 1.8.3 are vulnerable to a missing authorization flaw (CWE-862). The issue occurs because the customer, location, and NAT pages fail to execute the Subnets::check_permission function. This allows authenticated low-privilege users to access restricted sections by opening...

EUVD-2026-96994

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...

CVE-2026-108720 phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or...

EUVD-2026-96992

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108718

The Rill platform (versions 0.77.0 through 0.90.5 ) contains a missing authorization vulnerability within the admin OAuth server . The flaw allows the server to issue authorization codes to dynamically registered clients without requiring explicit user consent. An attacker can register a maliciou...

CVE-2026-108718 Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the longlivedaccesstoken scope and lure a user to an authorization link,...

CVE-2026-108717

Combodo iTop versions 3.1.0 through 3.3.0 are affected by a missing authorization vulnerability in LinkSetController.php. This flaw allows authenticated console users to bypass profile grants by providing arbitrary class and key parameters. Exploitation enables attackers to access the linkset del...

CVE-2026-108717 Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes t...

EUVD-2026-96991

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete, detach and get-remote-object routes t...

CVE-2026-108713 SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId,...

CVE-2026-108713

SuiteCRM versions through 7.15.2 and 8.x through 8.10.2 are vulnerable to a missing authorization vulnerability (CWE-862). The flaw exists in the setCampaignMarketingAndTemplate entry point, allowing authenticated users with low privileges to create and modify EmailMarketing records. Specifically...

EUVD-2026-96987

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaigns access can post marketingId,...

CVE-2026-108712

SuiteCRM versions through 7.15.2 and 8.10.2 are affected by a missing authorization vulnerability in the DetailUserRole entry point. This flaw allows authenticated non-admin users to view the ACL data of other non-admin users. An attacker can achieve this by supplying another user's ID in the rec...

EUVD-2026-96986

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record parameter to read that user's assigned roles...