CVE-2026-103007

A flaw was found in Elasticsearch. An authorization flaw in delegated role-management permissions allows an authenticated user with delegated administrative access to escalate privileges. Because authorization checks fail to strictly enforce index scoping restrictions, a user with this privilege...

CVE-2026-103007

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...

EUVD-2026-93937

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...

CVE-2026-103007

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...

CVE-2026-103007 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...

CVE-2026-103007

Elasticsearch versions 8.x (8.16.0 to 8.19.21) and 9.x (9.0.0 to 9.4.6, 9.5.0 to 9.5.3) are vulnerable to Incorrect Authorization (CWE-863) . The flaw exists in a configurable, non-default privilege that allows administrators to delegate limited role-management capabilities. Specifically, the aut...

CVE-2026-103007 Incorrect Authorization in Elasticsearch Leading to Privilege Escalation

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...

Elasticsearch 8.19.22, 9.4.7, 9.5.4 Security Update (ESA-2026-197)

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect...

CVE-2026-103007: Incorrect Authorization

Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets a...

PT-2026-107166

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An incorrect authorization weakness exists in a configurable, non-default privilege that allows administrators to delegate limited role-management capabilities to other users scoped to...

Elasticsearch 9.0.x < 9.4.7 / 9.5.x < 9.5.4 Privilege Escalation (ESA-2026-197)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-197 advisory. - Incorrect Authorization CWE-863 in Elasticsearch can lead to Privilege Escalation via a delegated...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

SummaryOpen WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session at...

PYSEC-2026-4129 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

PT-2026-105878

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

PT-2026-96209

Name of the Vulnerable Software and Affected Versions jshERP versions prior to 3.7 Description Authenticated users can modify the data scope of any role or delete roles due to a failure in validating caller permissions within role management endpoints. This allows for privilege escalation and the...

CVE-2026-94496: Missing Authorization

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...

CVE-2026-88006

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...

CVE-2026-88006 Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 until 0.11.1, Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose...