Authorization Bypass Through User-Controlled Key

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the addnewmodel and canusermaketeammodelcall functions in modelmanagementendpoints.py, which authorize the caller by rol...

CVE-2026-105687

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

EUVD-2026-92706

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by...

CVE-2026-105688 Penpot: Team admin can escalate to owner via team invitation (missing owner-role guard on the invitation path)

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, create-team-invitations and the invitation acceptance path allow a non-owner team administrator to assign the owner role because invitation roles are persisted and applied without the role-ceiling check used by...

EUVD-2026-92705

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

CVE-2026-105687

The open-source design and prototyping platform Penpot is vulnerable to a privilege management issue in versions prior to 2.18.0 . A team administrator who is not the owner can exploit the delete-team-member RPC to remove the team owner . Specifically, the system fails to protect the owner's team...

CVE-2026-105687 Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove any member other than themselves but does not protect the team owner. A non-owner administrator can delete the owner's team-profile-rel membership and lock t...

PT-2026-106208

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists in the delete-team-member RPC where a team administrator can remove any member except themselves, but the system fails to protect the team owner. This allows a non-owner administrator...

PT-2026-106209

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description In the create-team-invitations and invitation acceptance paths, a non-owner team administrator can assign the owner role to another account. This occurs because invitation roles are persisted and...

PT-2026-91236

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost version 11.8.4 Mattermost version 11.7.7 Description Authorization boundaries are not properly enforced on the access control policy update endpoint. This allows a channel or team administrator to detach a...

CVE-2026-15754

Mattermost 11.7.x (≤11.7.6) and 11.8.x (≤11.8.3) have a missing per-channel team-scope check in the ABAC policy unassign endpoint, allowing an authenticated team administrator to remove ABAC policy assignments from channels that have been moved to another team. Impact is integrity-focused (CVSS 4...

CVE-2026-15754: Incorrect Authorization

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-26230 Team Admin Privilege Escalation to Demote Members to Guest

Mattermost versions 10.11.x = 10.11.10 fail to properly validate permission requirements in the team member roles API endpoint which allows team administrators to demote members to guest role. Mattermost Advisory ID: MMSA-2025-00531...

EUVD-2026-8828

Fleet: Authorization Bypass in certificate template batch deletion for team administrators...

CVE-2026-25963

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-25963

Fleet is an open source device management platform. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could let a team administrator delete certificate templates belonging to other teams within the same Fleet instance. The affected flow validat...

CVE-2026-25963 Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2026-25963 Fleet: Authorization Bypass in certificate template batch deletion for team administrators

Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance. Fleet supports...

CVE-2025-14573

Mattermost advisory MMSA-2025-00561 describes a vulnerability in Mattermost versions 10.11.x ≤ 10.11.9 where invite permissions are not enforced when updating team settings. This allows team administrators lacking proper permissions to bypass restrictions and add users to their team via API reque...