CVE-2026-82310

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82311 Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false

Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. The cleanup compares the string identifier Flask-Login stores in the session against the user's integer database identifier, so the...

CVE-2026-81921

Concrete CMS versions 8.5.3 through 9.5.2 are affected by an OAuth 2.0 refresh-token grant flaw. The unmodified upstream League grant issued new access tokens from a valid refresh token without re-checking the associated account's active status . Consequently, a user who obtained a refresh token ...

CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-55774

A flaw was found in OpenBao, an open source identity-based secrets management system. An authenticated user with specific access to lease revocation functions could revoke a lease in a different namespace if the foreign lease identifier was known. This bypasses Access Control List ACL isolation,...

CVE-2026-55774

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-55774 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

EUVD-2026-78681

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-55774 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-55774 OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

CVE-2026-55774

OpenBao is an open-source identity-based secrets management system. Prior to 2.5.5 , the lease lookup routing in vault/expiration.go allowed FetchLeaseInfo and loadEntry to resolve cached or stored lease data outside the requesting namespace. This meant an authenticated user with access to sys/le...

CVE-2026-52822 Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation

Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/id/restart, PATCH /api/timesheets/id/duplicate, and the web duplicate workflow can derive a new record from an owned historical timesheet after the user's access to its project or activity has been revoked...

CVE-2026-55774: Incorrect Authorization

OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:leaseid in one namespace could revoke a lease in another namespace when the foreign leaseid was known, bypassing namespace ACL isolation. The affected lease lookup...

GHSA-V859-C572-QH5P ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...

ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

Summary A bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects shared between different organizations, potentially allowing users to ke...

CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

EUVD-2026-78163

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...

CVE-2026-76081

ZITADEL , an open source identity management platform, contains a permission revocation flaw affecting versions prior to 4.16.0 . When multiple project roles are deleted simultaneously, a bug in the permission-update logic can cause some User Grants on Granted Projects (projects shared between or...

CVE-2026-76081 ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple project roles are deleted at the same time can cause some user permissions to be missed. This issue specifically affects User Grants on Granted Projects projects...