EUVD-2026-60541

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an arbitrary channel via a crafted PATCH request...

CVE-2026-55163: Incorrect Authorization

Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermissionroleid, which allowed either an administrator or any existing member of the target role. The handler passed data"users" and data"name" to service.updat...

CVE-2026-9816

Mattermost 11.7.x (≤11.7.6), 10.11.x (≤10.11.21), and 11.8.x (≤11.8.3) lack server-side validation of BoardMember.Scheme* fields on insert and archive-import paths, allowing board editors or non-guest team members to grant Board Admin to arbitrary users via POST /api/v2/boards/{boardID}/members a...

CVE-2026-44846

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

EUVD-2026-60469

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-44846 JumpServer: Privilege Overwrite via Organization Invite Logic Flaw

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.inviteuser permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to...

CVE-2026-16048

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048 Channel member roles accept out-of-scope roles

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

EUVD-2026-60206

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048 Channel member roles accept out-of-scope roles

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

PT-2026-76662

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

CVE-2026-16048: Incorrect Authorization

Mattermost versions 11.8.x = 11.8.2, 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to restrict channel member role assignment to channel-scoped roles which allows a channel administrator to gain additional channel permissions via the channel member roles API.. Mattermost Advisory ID: MMSA-2026-00697...

PT-2026-76813

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17 Description A user possessing the users.invite user permission can submit an existing member via the 'POST /api/v1/users/users/invite/' endpoint. This triggers the organization invitation logic within...

CVE-2026-16772: Improper Privilege Management

In Akaunting versions sync call without verifying whether the caller is authorized to manage roles. Users only require the default update-auth-profile permission to access the self-update path and assign themselves as admins. The API endpoints are properly permission‑gated and are not affected by...

CVE-2026-73305: Improper Privilege Management

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...

CVE-2026-73293

CVE-2026-73293 affects Semaphore UI. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, the combination of ProjectMiddleware and GetProjectOrGlobalRoleBySlug allows a project manager to create a custom manager role via POST /api/project/{id}/roles with permission bitmask 15, which overri...

CVE-2026-73293: Improper Privilege Management

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...

CVE-2026-19278

A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine M2M token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim values. This allows an attacker with a valid OpenID Connect OIDC token, whose claim value ...