CVE-2026-92787

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

EUVD-2026-81043

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without...

CVE-2026-92600

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login toke...

CVE-2026-92600

Guns (a Java-based application framework) through version 8.3.5 contains an information disclosure vulnerability in SysUserController . The /sysUser/detail and /sysUser/page endpoints omit the requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authent...

CVE-2026-33186

CVE-2026-33186 gRPC-Go RBAC Authorization Policy Bypass via Missing :path Slash Auth Bypass Description The authz package in google.golang.org/grpc implements SDK-level RBAC authorization using deny and allow rules matched against the :path pseudo-header. The HTTP/2 server transport stores the ra...

GHSA-QC2Q-P7WX-3PX3 gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion

Summary A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies specifically DENY rules by using mixed-case or canonical-case header matchers e.g., X-Role instead of x-role. Additionally, the safety guards introduced by gRFC A...

CVE-2026-62650

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

CVE-2026-62650

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

CVE-2026-62650

Reyrolle 7SR5 (all versions prior to V2.70 ) contains a server-side authorization flaw in its web-based management interface . Role-based access control (RBAC) restrictions can be bypassed by manipulating request data, enabling an authenticated, low-privileged remote attacker to escalate to an ad...

EUVD-2026-72665

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control RBAC restrictions to be bypassed through manipulation of request data. This could allow an...

EUVD-2026-70053

Incomplete Cleanup CWE-459 in Elastic Cloud on Kubernetes ECK can lead to unauthorized access via Privilege Abuse CAPEC-122. Authentication credentials persist after a cross-namespace association has been denied by RBAC enforcement, allowing a low-privileged tenant to retain unauthorized read...

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Summary Multiple Missing Function Level Access Control vulnerabilities exist in the Yamcs Core API. These vulnerabilities allow any authenticated user, regardless of their assigned roles or privileges e.g., an unprivileged "Guest", to bypass intended access controls. An attacker can exploit these...

CVE-2026-61783

Wazuh versions 4.14.0 through 4.14.6 contain an RBAC logic flaw in the mask_sensitive_config() decorator. The gate that determines whether sensitive values are masked checks only whether a manager:update_config or cluster:update_config rule exists, without evaluating whether that rule's effect is...

CVE-2026-61783 Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...

CVE-2026-71325

A flaw was found in Traefik. This flaw allows a tenant, even when restricted by Role-Based Access Control RBAC to a single namespace, to bypass namespace isolation. By binding their own router to a TraefikService in another namespace, an attacker can expose or reroute that namespace's backend...

Wazuh Server 4.0.0 < 4.14.5 Incorrect Authorization (CVE-2026-44252)

The version of Wazuh Server on the remote host is at least 4.0.0 and prior to 4.14.5. It is, therefore, affected by an incorrect authorization vulnerability: - A low-privilege read-only API user with manager:read permission can retrieve the cluster key from ossec.conf. An attacker can use the...

CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...

CVE-2026-47735

Arc (Basekick Labs) is an open-source SQL-native time-series database for telemetry. Prior to 26.06.1 , its user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only read_parquet( and arc_partition_agg( via regex denylist, while the broader DuckDB I/O function family (read_csv_au...

CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...

CVE-2026-53487

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...