27 matches found
GO-2026-6335 Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea
Gitea primary email ownership bypass allows cross-user email changes in code.gitea.io/gitea...
CVE-2026-77508
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/username/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the...
CVE-2026-77508: Authentication Bypass by Assumed-Immutable Data
Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/users/username/ without verifying the new address, allowing a later team invitation for that address to be accepted without access to the...
Malware in hubert-verify-primary-email-am
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious Package
Overview hubert-verify-primary-email-am is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...
Malicious code in hubert-verify-primary-email-am (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b673dd1185ee4ae8ee19ec605dc7f25eebf55c0583be7c5cb878d331e70db3 [email protected] presents itself as an email-verification library but on require of index.js loads init.js, which reconstructs...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the email settings process. An attacker can modify another user's primary email address by sending crafted requests to the relevant endpoint. Remediation Upgrade gitea.dev/models/user...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the email settings process. An attacker can modify another user's primary email address by sending crafted requests to the relevant endpoint. Remediation Upgrade...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the email settings process. An attacker can modify another user's primary email address by sending crafted requests to the relevant endpoint. Remediation Upgrade...
Gitea primary email ownership bypass allows cross-user email changes
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
GHSA-4C8F-3M6H-M56R Gitea primary email ownership bypass allows cross-user email changes
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
CVE-2026-27657
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
EUVD-2026-41632
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
CVE-2026-27657 Gitea email settings allow changing another user's primary email address
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
CVE-2026-27657
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
CVE-2026-27657 Gitea email settings allow changing another user's primary email address
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
CVE-2026-27657 Gitea email settings allow changing another user's primary email address
Gitea versions before 1.25.5 allow a user to change another user's primary email address...
CVE-2026-27657
Gitea versions prior to 1.25.5 are vulnerable to an authorization bypass through a user-controlled key within the email settings process. This flaw allows an attacker to send crafted requests to relevant endpoints to modify another user's primary email address . Affected components include gitea....
PT-2026-55600
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.25.5 Description A flaw allows a user to change the primary email address of another user. Recommendations Update to version 1.25.5 or later...