56 matches found
CVE-2026-56739: Server-Side Request Forgery (SSRF)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and...
CVE-2026-94411
jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint (located in UserBusinessController.java). An authenticated low-privilege tenant user can send a POST request with type=UserRole, their own user ID, and an arbitrary role ID list to grant themselv...
CVE-2026-82817 dibo-software diboot Tenant Administrator Management API admin access control
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiat...
CVE-2026-82817 dibo-software diboot Tenant Administrator Management API admin access control
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiat...
CVE-2026-82817: Improper Access Control
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiat...
CVE-2026-76237
stigmem-node before 0.9.0a12 has a cross-tenant BOLA flaw in quarantine review endpoints: list/count queries and _get_quarantined_fact in routes/quarantine.py lack a tenant_id predicate, and the garden lookup is not tenant-scoped, allowing a low-privilege tenant admin to read, admit, or reject ot...
CVE-2026-76237 stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine
stigmem-node before 0.9.0a12 contains a broken object level authorization cross-tenant BOLA vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count queries and getquarantinedfact in routes/quarantine.py lacked a...
CVE-2026-48086
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...
CVE-2026-48080
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...
CVE-2026-48086 OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN promotes themselves to platform-wide GLOBALADMIN through a single PUT request. The role-update handler accepts the GLOBALADMIN enum value from any tena...
CVE-2026-48081
OpenReception's appointment-booking software is affected by a stored cross-site scripting (XSS) flaw in versions prior to 1.0.2. TENANT_ADMINs can inject javascript: URLs into tenant links (website, imprint, privacyStatement); these links are returned on the patient-facing landing page via /api/p...
EUVD-2026-54154
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN can store javascript: URLs in the tenant links configuration website, imprint, privacyStatement. These values are returned to the patient-facing landin...
CVE-2026-10059: Incorrect Privilege Assignment
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a tok...
Improper Authorization
Keycloak is vulnerable to improper authorization. The vulnerability is due to missing validation that the target user belongs to the caller's realm in certain user read endpoints, which allows a tenant realm administrator to access profile information, client roles, and realm roles of users acros...
EUVD-2026-37828
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...
CVE-2026-53676
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...
CVE-2026-53676
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...
CVE-2026-53676
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...
CVE-2026-53676
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege TENANTADMIN...