CVE-2023-37597

CVE-2023-37597 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Delete User Group Disclaimer: This repository is intended for educational and authorized security research purposes only. Do not use this exploit against any system you do not own or have explicit written permission to test...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103494

JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a privilege escalation flaw. This vulnerability is triggered through user group membership changes . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is available in v...

EUVD-2026-90585

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103494

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...

CVE-2026-103490

JetBrains YouTrack versions prior to 2026.2.19422 are susceptible to a privilege escalation vulnerability. The flaw is triggered through the use of user group links . This vulnerability has a HIGH base severity score of 7.2, with impacts on confidentiality, integrity, and availability.

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-103490

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

EUVD-2026-90581

In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...

CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-91965

WWBN AVideo through version 29.0 contains a broken access control vulnerability in the Live plugin endpoints (plugin/Live/stats.json.php and plugin/Live/calendar.json.php). User-group restrictions are not enforced, allowing unauthenticated attackers to retrieve restricted live transmission detail...

CVE-2026-84799 Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations

Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of a...

CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

CVE-2026-63178 Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/usergroupid and POST /manage/admin/user-group/usergroupid/add-users endpoints in ee/onyx/server/usergroup/api.py call updateusergroup and adduserstousergroup in ee/onyx/db/usergroup.py...

PT-2026-66546

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...

PT-2026-65785

Name of the Vulnerable Software and Affected Versions Gridbox versions prior to 2.20.2 Description A privilege escalation issue exists in the registration method of the Gridbox extension for Joomla. This flaw allows unauthenticated actors to register new accounts with administrative permissions b...

EUVD-2026-49377

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...