CVE-2023-37597

CVE-2023-37597 — issabel-pbx 4.0.0-6: クロスサイト・リクエスト・フォージェリ CSRF — ユーザーグループの削除 免責事項: このリポジトリは、教育および許可されたセキュリティ研究のみを目的としています。所有していない、または明示的な書面によるテスト許可を得ていないシステムに対して、このエクスプロイトを使用しないでください。 目次 概要 脆弱性の詳細 影響を受ける製品 技術的分析 攻撃シナリオ 概念実証 PoC 再現手順 PoCエクスプロイトコード 影響 緩和策と是正 開示タイムライン 参考文献 著者 概要 issabel-pbx...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103494

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a privilege escalation flaw. This vulnerability is triggered through user group membership changes . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is available in v...

EUVD-2026-90585

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103490

JetBrains YouTrack versions prior to 2026.2.19422 are susceptible to a privilege escalation vulnerability. The flaw is triggered through the use of user group links . This vulnerability has a HIGH base severity score of 7.2, with impacts on confidentiality, integrity, and availability.

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

EUVD-2026-90581

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

PT-2026-103750

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description Privilege escalation is possible through the use of user group links. Recommendations Update to version 2026.2.19422...

CVE-2026-103490: Missing Authorization

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

PT-2026-103754

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19422 Description Privilege escalation is possible through the modification of user group memberships. Recommendations Update to version 2026.2.19422...

CVE-2026-103494: Incorrect Privilege Assignment

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-91965

WWBN AVideo through version 29.0 contains a broken access control vulnerability in the Live plugin endpoints (plugin/Live/stats.json.php and plugin/Live/calendar.json.php). User-group restrictions are not enforced, allowing unauthenticated attackers to retrieve restricted live transmission detail...

CVE-2026-84799 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...