ApostropheCMS: Missing Authorization On Notification PATCH/DELETE Endpoints

Summary The notification module exposes "PATCH" and "DELETE" REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

Summary The notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification. As a result, an unauthenticated attacker who obtains a valid...

CVE-2026-113665

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...

EUVD-2026-105213

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...

CVE-2026-113665 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target...

CVE-2026-113665

The ApostropheCMS open-source Node.js content management system contains a missing authorization vulnerability in its notification module prior to version 4.33.0 . Specifically, the PATCH and DELETE REST endpoints perform operations directly on the underlying MongoDB collection without verifying ...

Huawei HarmonyOS Permission Control Vulnerability (CNVD-2026-37868)

Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei HarmonyOS has a permission control vulnerability, which stems from a flaw in the event notification module’s permission management. Currently, no detailed details about thi...

Huawei HarmonyOS Permission Control Vulnerability

Huawei HarmonyOS is a distributed operating system developed independently by Huawei, designed for various scenarios. Huawei HarmonyOS has a permission control vulnerability. This vulnerability stems from issues with permission control in the event notification module. Attackers can exploit this...

CVE-2026-49310

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

EUVD-2026-74597

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49310

CVE-2026-49310 is a permission control vulnerability in the event notification module affecting Huawei consumer devices , including phones, Vision, wearables, and laptops (per the September 2026 security bulletins). Successful exploitation may affect service confidentiality . The CVSS 3.1 score i...

CVE-2026-49310

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-49311

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

EUVD-2026-74595

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49311

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49311

CVE-2026-49311 is a permission control vulnerability in the event notification module affecting Huawei consumer devices (phones, vision/wearables, and laptops). The CVSS 3.1 score is 6.2 (MEDIUM) with a local attack vector , low complexity , no privileges required , and no user interaction needed...

CVE-2026-49310: Undefined Security Weakness

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-88793

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-88794

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-49311: Undefined Security Weakness

Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability...