rbac

PHP-RBAC v2.x PHP-RBAC is an authorization library for PHP. It provides developers with NIST Level 2 Hierarchical Role Based Access Control and more, in the fastest implementation yet. Current Stable Release: PHP-RBAC v2.0 Connect With Us Home Page: http://phprbac.net/ OWASP Project Page:...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

jackhammer

Jackhammer: One Security vulnerability assessment/management tool to solve all the security team problems. What is Jackhammer? Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and trac...

CVE-2026-19610

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control RBAC...

CVE-2026-19610

A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource operation on the runtime management resource fails to perform required Role-Based Access Control RBAC...

BIT-GRAFANA-2026-9703 Viewer role can create, modify and delete Loki alerting rules

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

SUSE CVE-2026-9703

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-9703

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-9703

Both Grafana OSS and Grafana Enterprise are affected by a vulnerability in the data source proxy where role-based access control (RBAC) is not correctly applied to write requests for Loki data sources . An authenticated user with only the Viewer role can exploit this to send POST, PUT, and DELETE...

CVE-2026-9703 Viewer role can create, modify and delete Loki alerting rules

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

CVE-2026-107334 Incorrect Authorization in Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

PT-2026-108102

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description An inconsistency in URL path normalization exists between the Lua-based role-based access control RBAC authorization layer and the nginx request routing logic in the reverse proxy. An...

PT-2026-102459

Name of the Vulnerable Software and Affected Versions Apache Karaf versions prior to 4.4.12 Apache Karaf versions prior to 4.5.0 Description Apache Karaf contains a flaw in the KarafMBeanServerGuard which fails to enforce role-based access control RBAC on specific MBean lifecycle operations. The...

PT-2026-97071

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote authenticated attacker can access or modify unauthorized resources. This is caused by the use of wildcards in Role-Based Access Control RBAC permission definitions, which is a metho...

CVE-2026-92787

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

CVE-2026-92787: Use of Hard-coded Credentials

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

PT-2026-94057

Name of the Vulnerable Software and Affected Versions KnowStreaming versions prior to 3.4.2 Description Failure to enforce role-based access control on REST API endpoints allows any authenticated user to access protected functionality. This enables attackers to call identity-management endpoints ...

PT-2026-94064

Name of the Vulnerable Software and Affected Versions Feast versions prior to 0.66.0 Description The software fails to verify JSON Web Token JWT signatures before establishing user identity. This allows an attacker to bypass role-based access control by presenting an unverified token containing a...

CVE-2026-20773

CVE-2026-20773 is an improper authorization flaw in PingFederate (Ping Identity), specifically in the administrative expression evaluation endpoint . A role-based access control (RBAC) deficiency allows users holding certain administrative roles to access expression testing capabilities beyond th...

CVE-2026-20773 Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...