CVE-2026-94414 jshERP through 3.6 Missing Authorization via updateBtnStr

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role...

PT-2026-96226

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.28.4 Description An authorization bypass exists in the admin API where the endpoint "/@warpgate/admin/api/users/:id/roles/:role id" calls the api update user role function in warpgate-admin/src/api/users.rs without...

SUSE CVE-2026-54322

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...

EUVD-2026-38563

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role update and delete endpoints authorized the caller as an owner of the organization named in the request path, but resolved and mutated the targe...

PT-2026-50181

Name of the Vulnerable Software and Affected Versions Daytona versions prior to 0.185.0 Description Organization role update and delete endpoints authorized the caller as an owner of the organization in the request path but mutated the target role using only its identifier without verifying the...

CVE-2015-7862: Undefined Security Weakness

Persistent Accelerite Radia Client Automation formerly HP Client Automation 7.9 through 9.1 before 2015-02-19 improperly implements the Role Based Access Control feature, which might allow remote attackers to modify an account's role assignments via unspecified vectors...

PT-2015-2437

Name of the Vulnerable Software and Affected Versions Accelerite Radia Client Automation formerly HP Client Automation versions 7.9 through 9.1 Description The issue is related to the improper implementation of the Role Based Access Control feature, which might allow remote attackers to modify an...