CVE-2026-61910

A flaw was found in cyrus-imapd. An authenticated user with specific permissions on another user's mailbox could alter its special-use annotation. This manipulation might allow the user to change the shared mailbox's role, potentially causing unintended mail content to be written to it and shared...

CVE-2026-61910

Cyrus IMAP versions before 3.12.4 are affected by an issue in the Mailbox/set command that allows an authenticated user holding the maySetKeywords permission on a shared mailbox to modify its specialuse annotation . This could reassign the mailbox to an archived, snoozed, or other special role, p...

CVE-2026-86731

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86731

Craft CMS versions 5.0.0-RC1 through 5.10.11 contain a permission escalation flaw in UsersController::actionActivateUser (the users/activate-user action). The action requires the administrateUsers permission but fails to call requireAdmin() when the targeted user is an administrator, unlike the s...

CVE-2026-86731 Craft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser the users/activate-user action. While the action requires the administrateUsers permission, it does not call requireAdmin when the targeted user is an administrator, unlike the...

CVE-2026-86498

In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission...

CVE-2026-86416

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-85395

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting...

CVE-2026-77125

Sonatype Nexus Repository 3 contains an incorrect authorization flaw in two blobstore group management REST API endpoints . A user holding only the nexus:blobstores:create permission (which must be explicitly granted and is not default) could invoke these endpoints to convert an existing blobstor...

CVE-2026-79989 Arbitrary user password reset leading to administrator account takeover

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...

BIT-KEYCLOAK-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

PT-2026-82078

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.18 Description The injectSecurityTab function within the BlueprintController fails to apply the API-key scope cap when determining if a page's security or permissions blueprint...

CVE-2026-76836

AzuraCast (through 0.23.8 ) allows a station manager holding only the Profile permission to write Liquidsoap custom configuration fields via PUT /api/station/{station_id}/profile/edit. The root cause is that the backend_config property is serialized under GROUP_GENERAL without field-level permiss...

CVE-2026-73499

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

EUVD-2026-57641

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a single exact key can use the Watch gRPC API with clientv3.WithFromKey to receive watch events for every key lexicographically greater than o...

EUVD-2026-56109

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

CVE-2026-61892 Weintek cMT3092X Incorrect Permission Assignment for Critical Resource

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

CVE-2026-61892

The CVE-2026-61892 entry applies to Weintek cMT3092X HMI. The vulnerability concerns insufficient permission handling that lets a non-privileged user modify tokens to escalate privileges, yielding a high-severity impact on confidentiality, integrity, and availability per the ICS CVSS metrics (sco...

GHSA-H4HF-V6W5-897X Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Summary The REST API user-update endpoint PUT/PATCH /api/v2/users/id and the V1 equivalent does not enforce two authorization rules that the web interface enforces. A user who holds the usereditothers permission but is not a superuser can: 1. edit user accounts that belong to a superuser, and 2...

CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...