CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-50165

alf.io , an open-source ticket reservation system, contains an Improper Access Control flaw in its organization and event "single configuration" endpoints. These endpoints require only organization or event ownership but accept an arbitrary configuration key, performing a lookup that includes sys...

EUVD-2026-75140

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

CVE-2026-26012

CVE-2026-26012 - Proof of Concept Authentified Organization Collection Permissions Bypass & Cipher Enumeration Vaultwarden NVD Reference: CVE-2026-26012...

grafana: Grafana: Unauthorized public dashboard deletion across organizations

A flaw in Grafana's public dashboard deletion endpoint lacks organization isolation, allowing an Organization Administrator to delete public dashboards in other organizations using the target dashboard's ID...

CVE-2026-86491

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

CVE-2026-86489

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

CVE-2026-86489

JetBrains YouTrack before version 2026.2.18634 contains an IDOR (Insecure Direct Object Reference) vulnerability in the user profile API , allowing an attacker with low-level privileges to disclose private issues and starred folders across organizations via the network. The CVSS 3.1 score is 6.5 ...

EUVD-2026-72505

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

EUVD-2026-72507

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

CVE-2026-86489

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

CVE-2026-86491

JetBrains YouTrack versions prior to 2026.2.18634 were affected by a stored XSS vulnerability exploitable through project and organization icon uploads . An attacker with high privileges (e.g., an authenticated user with project or organization admin rights) could inject malicious scripts that ex...

CVE-2026-86489

In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations...

CVE-2026-86491

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

CVE-2026-86491

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads...

Malicious Package

Overview btree-range-store is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @quantixfinance/config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @quantixfinance/sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-11817

In multi-organization deployments, an Org Admin in one organization could call GET /api/access-control/users/permissions/search with actionPrefix=dashboards: and obtain dashboard and folder UIDs plus per-user permission mappings from other organizations. Single-organization deployments are not...