CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Author: Prakhar Porwal Date: 2026-05-24 Target: Gitea self-hosted Git service Branch tested: main @ b7e95cc48c development build, go1.26.3 Component: routers/api/v1/org/action.go org-level Actions API OWASP: API3:2023 Broken Object Property Level Authorization --- 1. Summary The org-level Actions...

CVE-2026-24766

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an authenticated user with org-level-creator permissions can exploit prototype pollution in the /api/v2/meta/connection/test endpoint, causing all database write operations to fail application-wide until server...

CVE-2025-64431: Authorization Bypass Through User-Controlled Key

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference IDOR attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belongin...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

Authentication flaw

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

Hashicorp Terraform 授权问题漏洞

Hashicorp Terraform is an open source tool for provisioning and managing cloud infrastructure from HashiCorp Hashicorp, USA. A security vulnerability exists in HashiCorp Terraform that stems from a failure to enforce an organization-level setting that requires users within an organization to enab...

CVE-2021-3153: Improper Authentication

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...