654 matches found
CVE-2026-109119
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-109118
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109119
The rdiffweb application contains an Improper Privilege Management vulnerability in the user management API endpoint (/api/users/{username_or_id}). This flaw allows authenticated users to perform a privilege escalation to administrator status by modifying the role parameter within a POST request ...
CVE-2026-109119 Missing Authorization in rdiffweb
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-109119 Missing Authorization in rdiffweb
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
EUVD-2026-102836
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
EUVD-2026-102835
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118
The ikus060 rdiffweb 7.1.1 software contains a Path Traversal vulnerability (CWE-22) due to an improper path containment check. An authenticated user can use a percent-encoded traversal sequence (%2e%2e) in the request path to cause browse, restore, history, and delete operations to resolve to pa...
CVE-2026-109118 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in rdiffweb
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109118: Improper Limitation of a Pathname to a Restricted Directory
Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to resolve to a path outside the repository being operated on, via a percent-encoded traversal sequence %2e%2e in the request path, because the...
CVE-2026-109119: Missing Authorization
Improper Privilege Management in the user management API endpoint /api/users/usernameorid in Rdiffweb allows authenticated users to elevate their privileges to administrator by modifying the role parameter in a POST request...
PT-2026-115577
Name of the Vulnerable Software and Affected Versions rdiffweb version 7.1.1 Description An improper path containment check allows an authenticated user to perform browse, restore, history, and delete operations on paths outside the intended repository. This occurs because the system uses a strin...
PT-2026-115578
Name of the Vulnerable Software and Affected Versions Rdiffweb affected versions not specified Description Improper Privilege Management in the user management API endpoint '/api/users/username or id' allows authenticated users to elevate their privileges to administrator. This is achieved by...
RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0...
PYSEC-2026-1863 RDiffWeb vulnerable to Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0...
Access Control Bypass
Overview rdiffweb is an A web interface to rdiff-backup repositories. Affected versions of this package are vulnerable to Access Control Bypass via the API authentication process. An attacker can gain unauthorized access to other users' data and perform actions on their behalf by using any valid ...
CVE-2025-67796
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
EUVD-2025-209635
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users...
CVE-2025-67796
The IKUS Rdiffweb software (versions prior to 2.10.6 ) contains an improper authorization flaw. The vulnerability stems from the API's failure to enforce a binding between the authenticated subject and the targeted user or tenant. An attacker possessing a valid or stolen access token can exploit ...