CVE-2026-93968

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called...

EUVD-2026-83704

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called...

CVE-2026-93968 aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called...

CVE-2026-93968

aiyiyi121 SxDevOps versions 1.0 and 1.1 are affected by an improper privilege management vulnerability in the update function of the UserSerializer component (file backend/rbac/serializers.py). A remote attacker with high privileges can manipulate the update function to alter user privileges, res...

CVE-2026-93968 aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called...

CVE-2026-93968 aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called...

CVE-2026-93968: Improper Privilege Management

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called...

CVE-2026-16764: Improper Privilege Management

A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/apiv2/serializers.py of the component API/Web. Such manipulation of the argument isstaff leads to improper privilege management. The attack may be performed from remote. The...

PT-2026-64184

Name of the Vulnerable Software and Affected Versions OWASP DefectDojo version 2.59.0 Description Improper privilege management occurs in the API/Web component within the UserSerializer function located in the dojo/api v2/serializers.py file. A remote attacker can manipulate the is staff argument...

CVE-2026-40172: Improper Privilege Management

authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, the PATCH /api/v3/core/users/pk/ API allows a caller with changeuser on a target user to assign arbitrary groups through UserSerializer, including groups with issuperuser=True, without...

CVE-2025-48070

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site...

CVE-2025-48070 Plane has insecure permissions in UserSerializer

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site...

CVE-2025-48070 Plane has insecure permissions in UserSerializer

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer that allows users to change fields that are meant to be read-only, such as email. This can lead to account takeover when chained with another vulnerability such as cross-site...

Plane 安全漏洞

Plane is an open source, self-hosted project planning tool from Plane Open Source. A security vulnerability exists in Plane versions prior to 0.23 that stems from improper UserSerializer permissions, which could lead to account takeover...

PT-2025-22443 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane versions prior to 0.23 Description: The issue concerns insecure permissions in the UserSerializer that allow users to modify fields intended to be read-only, such as the email. This can potentially lead to account takeover when combined...