12 matches found
CVE-2026-90594
A missing authorization (fail-open) vulnerability in the Permission Service of wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0 affects the function PermissionService.checkUserPermission in /rpc/service/PermissionService.java. The flaw allows remote attackers with low privileges to bypass p...
CVE-2026-90594 wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
CVE-2026-90594 wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
CVE-2026-90594: Missing Authorization
A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService UMA Protection API. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first...
GHSA-FM6W-RRP3-2X4W Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService UMA Protection API. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first...
CVE-2025-14778
A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService UMA Protection API. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first...
CVE-2026-2141
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization...
CVE-2026-2141 WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization...
CVE-2026-2141 WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization
A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization...
PT-2026-6968
Name of the Vulnerable Software and Affected Versions WuKongOpenSource WukongCRM versions through 11.3.3 Description A security flaw exists in WuKongOpenSource WukongCRM, specifically within the URL Handler component. The issue resides in the file...
Insecure Access Control
ssddanbrown/bookstack does not properly validate user's access. The permission service allows users to obtain unauthorized access to the API, enabling users to view any attachment without having permission...