EUVD-2026-63115

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language version 2 SPL2 modules belonging to other users through the data management orchestrator interface. The vulnerability does not affect Splunk...

CVE-2026-76263

Splunk Enterprise versions below 10.4.2 and 10.2.6 have a broken object-level authorization flaw in the data management orchestrator REST API, allowing low-privilege users to delete SPL2 modules owned by other users. CVSS 5.4 (MEDIUM). Patch to 10.4.2 or 10.2.6; see advisory SVD-2026-0801. No in-...

CVE-2026-76238

stigmem before 0.9.0a12 has a BOLA flaw in the decay sweep endpoint. Authenticated attackers with write access to one tenant can POST with ttl_seconds=0 to expire facts across all tenants, or use dry_run to retrieve cross-tenant fact counts and existence data. CVSS 4.0 scores 7.2 HIGH (integrity ...

EUVD-2026-62478

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

CVE-2026-76237

stigmem-node before 0.9.0a12 has a cross-tenant BOLA flaw in quarantine review endpoints: list/count queries and _get_quarantined_fact in routes/quarantine.py lack a tenant_id predicate, and the garden lookup is not tenant-scoped, allowing a low-privilege tenant admin to read, admit, or reject ot...

EUVD-2026-62477

stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...

CVE-2026-55106

authentik's LDAP Source API diagnostic action bypasses object-level read-authorization, letting unauthenticated clients trigger upstream LDAP queries using the source's bind credentials. The response exposes DNs and attribute names (not values), revealing directory structure, naming conventions, ...

CVE-2026-72689

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-72689 OpenSignLabs opensignserver - Broken Object Level Authorization

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and...

CVE-2026-72689

OpenSignLabs opensignserver prior to 2.37.0 is affected by a Broken Object-Level Authorization issue. The getDocument Parse cloud function fetches documents using useMasterKey, bypassing object ACLs and returning full contract records, including sender and signer PII and a pre-signed document dow...

foreUP golf management platform's web API contains multiple vulnerabilities

Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check...

CVE-2026-57510

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

CVE-2026-65709

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709

CVE-2026-65709 concerns sysPass up to version 3.2.11, with a missing object-level authorization vulnerability in the JSON-RPC API. The issue allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access checks. ...

EUVD-2026-47745

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

CVE-2026-65013

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and...

CVE-2026-16454

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

CVE-2026-16454 Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...