CVE-2026-103758

The Obot platform, versions 0.21.1 through 0.24.1 , is vulnerable to an authorization bypass because the checkUI deny list fails to include the /mcp-connect-composite/ route. This flaw allows authenticated users with basic-role privileges and a composite MCP ID to proxy requests via mcpGateway.Pr...

CLEANSTART-2026-ZF70449 flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution

Security vulnerability affects the keycloak package. A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution...

keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

BIT-KEYCLOAK-2026-17059 Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

Improper Authorization

keycloak-services is vulnerable to an improper authorization. The vulnerability is due to insufficient permission checks when a restricted administrator lists users assigned to a role, which allows an attacker with limited administrative privileges to exploit the role-users endpoint and access...

CVE-2026-17059

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-17059 Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-17059

The CVE-2026-17059 issue affects the Keycloak‑services library’s role-users endpoint. A permission check gap allows an administrator with limited privileges to view private user details (names, email addresses) for members of a role they should not access, enabling information disclosure. Accordi...

CVE-2026-17059 Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

EUVD-2026-48598

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-17059

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

CVE-2026-17059: Authorization Bypass Through User-Controlled Key

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

PT-2026-64299

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the role-users endpoint of the keycloak-services library. The system fails to verify if an administrator has the necessary permissions to view individual users when listing...

CVE-2026-63734: Improper Input Validation

SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header parser that allows authenticated Owner-role users to crash the server by uploading a malformed .surml file to the /ml/import endpoint. Attackers can supply non-numeric input-dimensions or other...

EUVD-2026-39179

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configuratio...

UBUNTU-CVE-2026-40213

OpenStack Cyborg before 16.0.1 uses rule:allow checkstr='@' as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complet...

CVE-2026-40213

OpenStack Cyborg before 16.0.1 uses rule:allow checkstr='@' as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complet...

PT-2026-38596

Name of the Vulnerable Software and Affected Versions OpenStack Cyborg versions prior to 16.0.1 Description Multiple API endpoints use rule:allow check str='@' as the default policy, which unconditionally authorizes any request containing a valid Keystone token. This occurs regardless of the user...

CVE-2026-40213

OpenStack Cyborg before 16.0.1 is affected by CVE-2026-40213. The issue arises from a default policy rule (rule:allow with check_str='@') applied to multiple API endpoints, which unconditionally authorizes any request bearing a valid Keystone token regardless of user roles, project membership, or...

CVE-2026-40213

OpenStack Cyborg before 16.0.1 uses rule:allow checkstr='@' as the default policy for multiple API endpoints. This unconditionally authorizes any request carrying a valid Keystone token regardless of roles, project membership, or scope. An authenticated user with zero role assignments can complet...