EUVD-2026-111234

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations...

CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-116677 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-116677 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-116677

The OpenWISP Controller (versions 1.0.0 through 1.3.2 ) contains an authorization bypass in the GET /api/v1/controller/ca//crl endpoint. The vulnerability exists because CrlDownloadView.retrieve resolves the CA directly via a sequential identifier instead of using the organization-scoped retrieva...

CVE-2026-116677

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-116677 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca//crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization's...

CVE-2026-116677: Missing Authorization

OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/ /crl endpoint allows an authenticated organization manager with CA view permission to retrieve another organization'...

PT-2026-126706

Name of the Vulnerable Software and Affected Versions OpenWISP Controller versions 1.0.0 through 1.3.1 Description An authenticated organization manager with CA view permission can retrieve the certificate revocation list of another organization. This occurs because the CrlDownloadView.retrieve...

PT-2021-22252

Name of the Vulnerable Software and Affected Versions netless Agora Flat Server versions prior to 2021-07-30 Description The issue concerns the remove API in the netless Agora Flat Server, specifically in the file v1/controller/cloudStorage/alibabaCloud/remove/index.ts, which mishandles file...

CVE-2021-38621: Undefined Security Weakness

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership...

CVE-2013-5036

The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...