CVE-2026-111636

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tena...

CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tena...

CVE-2026-111636

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tena...

CVE-2026-111636

OpenBMB StaffDeck versions through 0.5.6 are vulnerable to an authentication bypass due to a hard-coded default app_secret (CWE-322). This flaw allows unauthenticated attackers to forge HMAC-SHA256 session tokens for the seeded 'admin' user in the 'tenant_demo' tenant. Successful exploitation gra...

CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tena...

PT-2026-116035

Name of the Vulnerable Software and Affected Versions OpenBMB StaffDeck versions prior to 0.5.7 Description An authentication bypass exists that allows unauthenticated attackers to forge administrator session tokens. This is possible due to a hard-coded default app secret. Attackers can sign an...

CVE-2026-108663 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to...

CVE-2026-25045

Budibase is a low code platform for creating internal tools, workflows, and admin panels. This issue is a combination of Vertical Privilege Escalation and IDOR Insecure Direct Object Reference due to missing server-side RBAC checks in the /api/global/users endpoints. A Creator-level user, who...

lemlist: Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries

An authorization issue was discovered in the application that allowed a tenant admin to change the password of another user within the same tenant, including invited agency accounts. The victim had to first accept the invitation before the attacker could proceed. The issue could allow unintended...

CVE-2021-0235

On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, vSRX Series devices using tenant services on Juniper Networks Junos OS, due to incorrect permission scheme assigned to tenant system administrators, a tenant system administrator may inadvertently send their network traffic to...

CVE-2021-0246

On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, devices using tenant services on Juniper Networks Junos OS, due to incorrect default permissions assigned to tenant system administrators a tenant system administrator may inadvertently send their network traffic to one or more...