nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

CVE-2026-48493 Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment

Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only users.edit can send a PATCH to /api/v1/users/theirownid and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc. The issue is...

CVE-2026-21721 Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions: action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege...

CVE-2026-21721 Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions: action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege...

Google Chrome Permissions UI Replacement

The vulnerability of the Permissions control element in Google Chrome and Microsoft Edge is related to improper limitation of the layers or frames that are displayed in the user interface. Exploiting this vulnerability could allow a malicious actor to replace the user interface with a specially...

hyperkitty-permissions.sh Privilege Escalation

The vulnerability of the “hyperkitty-permissions.sh” web interface implementation for accessing Mailman archives in HyperKitty relates to the tracking of symbolic links. Exploiting this vulnerability can allow attackers to increase their privileges...

Google Chrome for Mac, Windows and Linux Permissions Interface Forgery Vulnerability

Google Chrome for Mac, Windows and Linux is a web browser developed by Google for the Mac, Windows and Linux platforms.Permissions is one of the permissions licensing components. A security vulnerability exists in Permissions in versions of Google Chrome prior to 64.0.3282.119 for Windows, Mac an...