CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

EUVD-2026-86223

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203 Logto: Account API can disclose stored third-party provider tokens without the identities scope

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-63203: Missing Authorization

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

PT-2026-98226

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0 Description The get trip summary function in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring the trips:read scope. This allows a token granted only unrelated capabilities,...

PT-2026-98313

CVE-2026-97636 Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Da… https://t.co/UZkMPyWzeJ...

PT-2026-97857

Name of the Vulnerable Software and Affected Versions Logto versions 1.31.0 through 1.41.0 Description Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller with a same-user access token containing only the openid scope to retrieve stored social or enterpri...

CVE-2026-95627

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-95627 Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-95627 Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

EUVD-2026-85181

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-95627

A vulnerability in the Tauri framework v2 dialog plugin allows an attacker with JavaScript execution (XSS) to manipulate the file or folder picker. The attacker can force the scope expansion to be recursive , granting unauthorized read/write access to an entire directory tree. This occurs after a...

PT-2026-97262

Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description An attacker with JavaScript execution capabilities, such as through Cross-Site Scripting XSS, can manipulate the dialog plugin's file or folder picker. This allows the attacker to force a...

PT-2026-97368

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1 Description An authenticated remote attacker with ownership of any configured domain can access files outside the intended directory. This occurs because the application validates the domainName but fails to canonicali...

CVE-2026-95627: Incorrect Permission Assignment for Critical Resource

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution XSS can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no...

CVE-2026-86681: Missing Authentication for Critical Function

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

GHSA-W89X-C962-C44G Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are missing the write-scope enforcement that their neighboring endpoints correctly apply. Specifically, the WOPI configuration fetch endpoint and the SMTP test/mail endpoint can both be...

Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Summary There is a privilege scope bypass in Cloudreve's admin API where two endpoints that mutate server state are missing the write-scope enforcement that their neighboring endpoints correctly apply. Specifically, the WOPI configuration fetch endpoint and the SMTP test/mail endpoint can both be...

CVE-2026-77637

Cloudreve , a self-hosted file management and sharing system, is affected by a privilege scope bypass prior to version 4.18.0 . The routes tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit the ScopeAdminRead scope but omit the RequiredScopes(types.ScopeAdminWrite) middleware app...