CVE-2026-110216 youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests to /api/v1/users/userId/status to disable root or admin...

CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

EUVD-2026-92488

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2026-104893

The project management tool Plane is vulnerable to improper validation in its API. Prior to version 1.4.0 , an authenticated user can use the PATCH /api/users/api-tokens/{token_id}/ endpoint to modify the allowed_rate_limit field without server-side validation or a maximum limit. This allows an a...

EUVD-2026-92476

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893 Plane: Improper validation allows arbitrary modification of API token rate limits

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893 Plane: Improper validation allows arbitrary modification of API token rate limits

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104893: Allocation of Resources Without Limits or Throttling

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/users/api-tokens/ allows an authenticated user to retrieve API-token records, while PATCH /api/users/api-tokens/tokenid/ allows the user to modify the token's allowedratelimit field without server-side validation or a maxim...

CVE-2026-104966: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

PT-2026-106034

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description Two endpoint families fail to verify that nested resource identifiers belong to the workspace and project specified in the URL. An authenticated user can read or modify estimates from another workspace...

PT-2026-106019

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description An authenticated user can retrieve API-token records via the 'GET /api/users/api-tokens/' endpoint. Additionally, the 'PATCH /api/users/api-tokens/token id/' endpoint allows a user to modify the allowe...

CVE-2026-100610

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100610 Flowise through 3.1.4 Missing Authorization via upsert-history

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

EUVD-2026-87705

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100610

Flowise versions through 3.1.4 are vulnerable to an authorization bypass in the upsert-history functionality. The application fails to perform route-level permission checks, workspace validation, or ownership verification for the GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history end...

PT-2026-99281

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Insufficient route-level permission checks and a lack of workspace or ownership validation in the backing service allow authenticated low-privilege users or those with a valid API key to access or...

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

NPM: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.2...

GHSA-VMJQ-HVGQ-2WV4 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

Summary The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for...

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

The PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist. An authenticated user can set security-critical fields that are not meant to be modifiable here — notably requireLogin. Setting requireLogin: false disables authentication for the who...