EUVD-2026-85517

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...

Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...

PT-2026-97434

Name of the Vulnerable Software and Affected Versions GoCD versions 20.2.0 through 26.0.x Description An internal pipeline structure API used for autocompletion during the editing of pipeline, template, environment, and user-preference configurations allows regular authenticated users to access t...

CVE-2026-91167 Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:roleid reaches apiupdateuserrole in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited...

CVE-2026-94411 jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege...

SUSE CVE-2026-73293

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

PT-2026-96310

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.1 Description Authenticated users can read the roles and permissions of any employee because the application fails to validate the employeeId parameter in the '/anyone/visible/resource' endpoint. This allows...

CVE-2026-94536: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, an...

CVE-2026-92772

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to depl...

CVE-2026-92772 Leantime before 3.9.6 Unauthorized Plugin Installation via HTMX

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to depl...

keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

CVE-2026-73470 Apache Syncope: Delegating users can grant unowned Roles

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, fro...

CVE-2026-73470

An Improper Privilege Management vulnerability exists in Apache Syncope (versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2). The root cause allows delegations to be created or updated using Roles not owned by the delegating User, or for a Realm subtree different...

CVE-2026-20773

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

PT-2026-91147

A role-based access control issue was identified in the administrative expression evaluation functionality. This could allow users with certain administrative roles to access expression testing capabilities beyond their intended permissions...

SUSE CVE-2026-6739

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 fail to require system-level permission when patching protected default system roles, which allows authenticated users with delegated user-management permissions to escalate privileges by altering built-i...

GHSA-CXVF-GVFQ-36W2 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom projec...

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom projec...

BIT-KEYCLOAK-2026-16105 Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...