11 matches found
CVE-2026-114485
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
CVE-2026-114485
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
EUVD-2026-108217
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...
CVE-2026-114485
The Devolutions Server version 2026.3.10.0 and earlier contains a vulnerability involving the insufficient protection of sensitive information within the user list endpoint . An authenticated attacker possessing delegated user view permissions can exploit this flaw to obtain the MFA secrets of al...
CVE-2026-68964
The Gitea platform is vulnerable to a metadata disclosure vulnerability because the user SSH and GPG key-list API endpoints omit the profile visibility checks applied to web equivalents. An authenticated account with restricted status can access public keys, key titles, fingerprints, and GPG-embe...
CVE-2026-65956
KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...
GO-2026-6240 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...
PT-2026-80457
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...
CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
EUVD-2026-60240
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...