CVE-2026-88860 Capgo Authorization Bypass via Stale Channel Permission Overrides

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

CVE-2025-55948

This vulnerability fundamentally arises from yzcheng90 X-SpringBoot 6.0's implementation of role-based access control RBAC through dual dependency on frontend menu systems and backend permission tables, without enforcing atomic synchronization between these components. The critical flaw manifests...

PT-2022-21374

Name of the Vulnerable Software and Affected Versions Couchbase Server versions prior to 7.0.4 Description An issue was discovered where operations may succeed on a collection using stale RBAC permission. Recommendations For versions prior to 7.0.4, update to version 7.0.4 or later to resolve the...