CVE-2026-119625

A flaw was found in Gitea. The user profile web route accepts personal access tokens through HTTP Basic authentication without properly verifying their assigned permission scopes. An authenticated attacker possessing a token with limited permissions can bypass intended scope restrictions to view...

CVE-2026-119625 Gitea user and organization feed token scope bypass

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

CVE-2026-119625

The Gitea /{username} web route was vulnerable to an incorrect authorization issue (CWE-863) because it accepted personal access tokens via HTTP Basic authentication without verifying their scope. An attacker using a token with an unrelated scope (e.g., read:issue) could access a user's private a...

CVE-2026-119625 Gitea user and organization feed token scope bypass

The /username web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to an unrelated scope, such as read:issue, could read its owner's private activity through the user RSS/Atom feed and the profile activity tab, and other members'...

CVE-2026-117635 Gitea admin API public-only token scope bypass

The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...

CVE-2026-117635

The Gitea software contains a vulnerability where the /api/v1/admin route group fails to enforce the public-only restriction on personal access tokens. This allows a public-only token with admin scope, issued by a site administrator, to perform unauthorized actions such as listing private organiz...

CVE-2026-117635 Gitea admin API public-only token scope bypass

The /api/v1/admin route group did not enforce the public-only restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registratio...

CVE-2025-6554

CVE-2025-6554 function leakhole let x; delete x?.y?.a; return y; let y; function pwn let hole = leakhole; %DebugPrinthole; pwn; Bug A variable y was accessed before declaration. Normally this should trigger a ReferenceError TDZ, but in older V8, when combined with delete x?.y, the check failed an...

redmine -- multiple vulnerabilities

Redmine reports: High: ReDoS in wiki macro argument parsing 44657. Affects 6.0.0 and later; fixed in 7.0.3, 6.1.6 and 6.0.12. High: OAuth token scope is ignored in Project.allowedtocondition 44625. Affects 6.1.0 and later; fixed in 7.0.3 and 6.1.6. High: Private project names and role assignments...

gitea-CVE-2026-28699

CVE-2026-28699: Gitea OAuth2 Scope Bypass via HTTP Basic Auth A Gitea OAuth2 access token scoped to only read:user can perform full write actions when it is sent as Authorization: Basic base64:x-oauth-basic instead of as a Bearer token. The scope check is skipped for any token presented over Basi...

CVE-2026-117472 URL prefix handling permits API key read-scope bypass in Psono Server

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An...

CVE-2026-117472

Psono Server CE && EE versions 4.0.33 through 7.2.3 are vulnerable to an authorization bypass due to incorrect path comparison for the bulk-secret-read endpoint. When configured with URL_PREFIX , the application compares the request path against a hard-coded unprefixed path, causing the compariso...

CVE-2026-117472 URL prefix handling permits API key read-scope bypass in Psono Server

Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URLPREFIX, the comparison failed and the POST request was authorized using write scope instead of read scope. An...

EUVD-2026-110600

Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session...

Obsidian-tc : Symlink Read-ACL Scope Bypass Via Lexical Path Checks

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink no M...

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink no M...

npm: obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

npm: obsidian-tc : Symlink read-ACL scope bypass via lexical path checks vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

GHSA-C5XX-H28H-F682 obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

Impact ACL checks ran on the lexical vault-relative path while containment used the realpath. An in-vault symlink placed under an allowed glob, whose realpath resolved into a denied folder, passed the read ACL — an intra-vault read-ACL-scope bypass. It requires an out-of-band-planted symlink no M...

PYSEC-2026-4359

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

Roundcube Webmail Project Roundcube Webmail permission and access control issues vulnerability

The Roundcube Webmail project contains a permission and access control vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability stems from CSS scope bypass in HTML messages. The rcubeutils::modcssstyles function fails to treat the “at-rule” prefix as a selector...