CVE-2026-77937

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted userid HTTP header. Attackers can set userid to another tenant's ID, even with LETTASERVERSECURE enabled, to read and modify that user's agents,...

CVE-2026-77937

Letta versions through 0.16.8 are vulnerable to an authentication bypass flaw. The issue allows API callers to perform cross-tenant impersonation by providing a self-asserted user_id HTTP header. This vulnerability persists even when LETTA_SERVER_SECURE is enabled. Successful exploitation allows ...

CVE-2026-77937

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted userid HTTP header. Attackers can set userid to another tenant's ID, even with LETTASERVERSECURE enabled, to read and modify that user's agents,...

PT-2023-20297 · Unknown · Status Powerbpm

Name of the Vulnerable Software and Affected Versions: Status PowerBPM affected versions not specified Description: The issue is related to insufficient authentication in a specific function of Status PowerBPM. A LAN attacker with normal user privileges can exploit this to modify the substitute...