CVE-2026-89419

A flaw was found in OpenStack Ironic. A missing authorization check in the node PATCH API allows an authenticated lessee member to change the maintenance state of a bare metal node, an operation that should be restricted to lessee managers and administrators. By sending a PATCH request to...

ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

PT-2026-120300

Summary The self-service password-change endpoint verifies the current password but does not use the login module’s failed-attempt counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit repeated guesses for the current password without receiving ...

PT-2026-118500

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because th...

PT-2026-118588

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description The self-service password-change endpoint verifies the current password but fails to utilize the login module's failed-attempt counter, throttle, delay, or lockout mechanisms. An attacker with...

CVE-2026-77439

Summary Two related broken access control vulnerabilities in album member management allow any album Editor to: 1. Privilege escalation — promote themselves or any member to the Owner role via "PATCH /api/albums/:albumId/user/:userId" with ""role": "owner"" 2. Owner removal — delete any Owner-rol...

CVE-2026-112001

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112004

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

CVE-2026-112004 Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

CVE-2026-112004

The Teable application, in versions prior to 2026-10-12T12-45-53Z.3331 , is vulnerable to an authorization bypass via the folder rename endpoint. The root cause is that the PATCH /api/base/:baseId/node/folder/:folderId endpoint only validates the base|update permission against the :baseId provide...

EUVD-2026-103457

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...

CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112001

ProjectSend versions 2.0.0 before 2.7.0 are vulnerable to an incorrect authorization flaw (CWE-863) within the Users API. Specifically, API token holders with restricted permissions (limited to manage_users and edit_users) can exploit the PATCH /api/v1/users/{user} endpoint to modify the credenti...

EUVD-2026-103454

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/user. Attackers with a token limited to manageusers and editusers can set a new owner password, clear two-facto...

CVE-2026-112004: Authorization Bypass Through User-Controlled Key

Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against the URL baseId, so...