PT-2026-96252

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.0.0 through 2.9.2 Description A workspace member with the lowest role who has been denied access to a tool via WorkspaceUserResourcePermission can still bind the tool identifier using tool ids, skill tool ids, or mcp tool ids...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization via the chatcompletion API when user-supplied toolids or toolservers parameters are processed without verifying the user's permissions. An attacker can gain unauthorized access to...