CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

EUVD-2026-65442

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79672 Ech0 before 4.4.3 Authentication Bypass via Comment Panel

Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments, and modify comment...

CVE-2026-79667 Ech0 before 4.4.3 Authentication Bypass via Scope Enforcement

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-79667

Ech0 versions 4.3.4 and earlier fail to enforce scoped access token (least-privilege) restrictions on several privileged admin routes. Endpoints such as /api/inbox, /api/panel/comments, and /api/backup/export authorize based only on the user's admin role, omitting scope checks. The backup export ...

EUVD-2026-65447

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

PT-2026-81286

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-75866 Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and granttypes per client and documents both as client registration. token dispatches...

PT-2026-79570

Name of the Vulnerable Software and Affected Versions Punk::OAuth2::Server versions prior to 0.04 Description The software issues access tokens that exceed a client's registered scopes and grant types because the authorization path fails to validate them. Specifically, the token function dispatch...

CVE-2026-62667 Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey stores a declared scopes array, but ApiKeyAuthenticator::authenticate does not read keyDatascopes and returns the owning user's...

CVE-2026-72833

The Grav API plugin getgrav/grav-plugin-api versions = 1.0.6 and = 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account bypasses its declared scope cap on four isSuperAdmin-gated write endpoints in GroupsController, AccountsConfigController,...

CVE-2026-58444

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444

The Git repository management system Gitea is affected by a personal access token scope enforcement bypass on the repository home page (GET /{owner}/{repo}). This vulnerability is caused by a lack of access control, which could allow a malicious actor to expose protected information or private re...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-58444 Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents

Personal access token scope enforcement bypass on the repository home page GET /owner/repo discloses private repository contents...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

CVE-2026-55982 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes

OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes...

GO-2026-6022 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim in github.com/cloudreve/Cloudreve

Cloudreve: OAuth access tokens bypass scope enforcement due to missing clientid claim in github.com/cloudreve/Cloudreve...

Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data

Summary A Gitea personal access token PAT restricted to a non-repository scope e.g. read:issue can read the commit history of any private repository the token owner can access, via the repository RSS/Atom feed endpoints. The same token is correctly denied 403 on /raw, /media, /archive, and the...