BIT-ELK-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-82725

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-81853

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as th...

EUVD-2026-68337

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-82725 AshPhoenix FilterForm allows filtering across non-public relationships, disclosing private related data

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashphoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as th...

EEF-CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbat...

EUVD-2026-68330

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as th...

CVE-2026-82564

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

CVE-2026-82564

CVE-2026-82564 is an Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai (versions 0.6.0 to <1.0.0). In AshAi.Tool.Execution, the identity_filter/3 function built update/destroy filters directly from raw tool arguments. Because a map value is parsed as a predic...

CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

EEF-CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Summary Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter...

CVE-2026-82564 Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

EUVD-2026-68306

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identityfilter/3 built the update/destroy filter directly...

PT-2026-83705

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data...

PT-2026-83679

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decode primary key/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as...

PT-2026-83689

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash phoenix lets an attacker who controls filter form parameters filter across relationships the resource author marked non-public, turning the returned rows into a boolean oracle over private related data...

PT-2026-83667

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity filter/3 built the update/destroy filter direct...

Paint Component Data Compromise

The vulnerability of the Paint component in Google Chrome and Microsoft Edge browsers relates to the ability to bypass authentication by using a user-controlled password. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially created HTML page...

SeaweedFS TUS Bypass Write Delete

The vulnerability of the TUS distributed file system SeaweedFS relates to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker, operating remotely, to circumvent existing security mechanisms and gain access to write and delete arbitrary fil...