529 matches found
CVE-2023-37597
CVE-2023-37597 — issabel-pbx 4.0.0-6: Cross-Site Request Forgery CSRF — Delete User Group Disclaimer: This repository is intended for educational and authorized security research purposes only. Do not use this exploit against any system you do not own or have explicit written permission to test...
CVE-2026-108875
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...
CVE-2026-108875
Versions of JeecgBoot up to and including 3.9.5 are vulnerable to a missing authorization flaw in the SysUserController's addSysUserGroup handler. This vulnerability allows any authenticated user to perform unauthorized modifications to user group memberships by sending POST requests with arbitra...
EUVD-2026-97049
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...
EUVD-2026-96576
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...
CVE-2026-108875: Missing Authorization
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids and a groupId to add any users to...
CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...
CVE-2026-108637 JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sysugroupuser rows without...
PT-2026-109898
Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.6 Description Low-privileged authenticated users can remove members from user groups due to missing authorization. This is achieved by calling the 'DELETE /sys/user/deleteUserGroupBatch' endpoint. An attacker ca...
CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...
CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
CVE-2026-103494
JetBrains YouTrack versions prior to 2026.2.19422 are vulnerable to a privilege escalation flaw. This vulnerability is triggered through user group membership changes . No specific exploit details or in-the-wild exploitation information are provided in the documents. Remediation is available in v...
CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
CVE-2026-103494
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
EUVD-2026-90585
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes...
CVE-2026-103490
JetBrains YouTrack versions prior to 2026.2.19422 are susceptible to a privilege escalation vulnerability. The flaw is triggered through the use of user group links . This vulnerability has a HIGH base severity score of 7.2, with impacts on confidentiality, integrity, and availability.
CVE-2026-103490
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...
EUVD-2026-90581
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links...