CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in Kibana

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, an authenticated user could reference another user's AI Assistant conversation identifier t...

CVE-2026-78581

CVE-2026-78581 is an authorization bypass (CWE-639) in Kibana affecting the AI Assistant feature. An authenticated user could reference another user's AI Assistant conversation identifier to access or modify a conversation they do not own. Successful exploitation requires knowledge of a hard-to-g...

PT-2026-81309

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass exists where an authenticated user can reference another user's AI Assistant conversation identifier to access or modify conversations they do not own. This occurs...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the removeProfileImage process. An attacker can remove another user's profile image without authorization by sending a crafted DELETE request with the target user's identifier...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the removeProfileImage process. An attacker can remove another user's profile image without authorization by sending a crafted DELETE request with the target user's identifier...

CVE-2026-78365

Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1 are affected by an IDOR (Insecure Direct Object Reference) in the supplier API . A missing authorization check on the company_id field allows any authenticated user to send a PUT request to /api/supplier/{id} and set company_id in the body, en...

EUVD-2026-64839

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

CVE-2026-78365 IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification

Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PUT request to /api/supplier/id setting companyid...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

EUVD-2026-63628

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

PT-2026-79384

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a bank...

CVE-2026-69558

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-69558

Microsoft Partner Center has an authorization bypass caused by a user-controlled key, enabling an unauthenticated remote attacker to disclose confidential information (CVSS 8.6, HIGH). The flaw requires no privileges or user interaction. No patch version or in-the-wild exploitation details are pr...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the copyplugins admin endpoint when the source-side authorization is not properly checked. An attacker can access unauthorized plugin content by supplying a sourceplaceholderid or...

Microsoft Partner Center Information Disclosure Vulnerability

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

PT-2026-79213

Name of the Vulnerable Software and Affected Versions Microsoft Partner Center affected versions not specified Description An authorization bypass exists due to a user-controlled key, which allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, ther...

Authorization Bypass Through User-Controlled Key

Overview @neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the isAuthenticated check in...