CVE-2026-10527

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-10527

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

EUVD-2026-60192

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-10527

Mattermost versions up to 11.7.6, 10.11.21, and 11.8.3 fail to reconcile SchemeAdmin flags with role changes, allowing a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI. CVSS 6.3 MEDIUM, network exploitable with low pri...

CVE-2026-16048

Mattermost versions 11.8.x through 11.8.2, 11.7.x through 11.7.6, and 10.11.x through 10.11.21 fail to restrict the channel member roles API to channel-scoped roles, allowing a channel administrator to assign out-of-scope roles and gain additional permissions. Advisory MMSA-2026-00697 tracks the ...

CVE-2026-16048

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048 Channel member roles accept out-of-scope roles

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

EUVD-2026-60206

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

WordPress Wholesale Market plugin <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via 'rolerequired' Parameter vulnerability discovered by SEONGWON CHO - Chung-ang University in WordPress Plugin Wholesale Market versions = 2.2.2...

WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability

Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...

WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

WordPress Propovoice: All-in-One Client Management System plugin <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter vulnerability

Authenticated ndpvmanager+ Privilege Escalation via 'role' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Propovoice CRM versions = 1.7.8...

BIT-GITLAB-2026-6267 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

BIT-GITLAB-2026-4672 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...

BIT-GITLAB-2026-14341 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify protected branch configuration due to improper...

BIT-GITLAB-2025-14562 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to commit changes to a project after being removed as a...

BIT-MONGODB-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

PT-2026-76813

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py t...