CVE-2026-111909

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

EUVD-2026-103311

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111909 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111909

Versions of phpMyFAQ prior to 4.1.9 are vulnerable to a missing authorization flaw within the deleteUser() API. Authenticated users who possess the delete_user permission, but are not superadmins, can exploit this by sending a DELETE request to /admin/api/user/delete. By targeting a superadmin's ...

CVE-2026-111909 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111909 phpMyFAQ before 4.1.9 Missing Authorization Allows Superadmin Deletion via deleteUser API

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-111909: Improper Privilege Management

phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser API that allows authenticated non-superadmin users with deleteuser permission to delete superadmin accounts. Attackers can send a DELETE request to /admin/api/user/delete with a superadmin's userId other than 1...

CVE-2026-106708

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

CVE-2026-106708

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

CVE-2026-106708

XXL-JOB version 3.5.0-SNAPSHOT and earlier is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists in the JobUserController user management controller, specifically on the /user/insert , /user/update , and /user/delete endpoints. These endpoints lack CSRF protection and do not rest...

CVE-2026-106708: Cross-Site Request Forgery (CSRF)

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

CVE-2026-97060

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

EUVD-2026-87254

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

CVE-2026-97060 X-SpringBoot through 6.0 Authorization Bypass via User Management

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

CVE-2026-97060 X-SpringBoot through 6.0 Authorization Bypass via User Management

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

CVE-2026-97060

X-SpringBoot versions through 6.0 are vulnerable to a broken object-level authorization flaw in user management endpoints. The root cause is a lack of ownership verification, allowing attackers with user-management permissions to perform unauthorized actions. Specifically, an attacker can reset p...

CVE-2026-97060: Authorization Bypass Through User-Controlled Key

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

PT-2026-99091

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software lacks object-level authorization in user management endpoints, which allows sub-administrators to modify or delete users without ownership verification. Attackers possessing...

CVE-2026-75458: Authorization Bypass Through User-Controlled Key

The teacher-end interface POST /api/teacher/user/delete/id in XueZhiSi Open Source Exam System = 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserByIdid, setDeletedtrue, updateByIdFilter in sequence, without any validation of...

PYSEC-2026-2697 Open WebUI: Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access

Stale Admin Role in Socket.IO Session Pool Enables Post-Demotion Cross-User Note Access Affected Component Socket.IO session state and role-check callsites: - backend/openwebui/socket/main.py lines 330-351, connect handler — role snapshotted into SESSIONPOOL - backend/openwebui/socket/main.py lin...