Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the webhook delivery. An attacker can access sensitive repository content by maintaining control of a webhook endpoint after their collaborator access has been revoked. Remediation Upgrade...

Vulnerabilities handled in IBM Langflow OSS

IBM has addressed several vulnerabilities in the IBM Langflow OSS versions from 1.0.0 to 1.10.0. The vulnerabilities in IBM Langflow OSS include: - Execution of arbitrary file modifications by authorized users through specially crafted Content-Disposition headers. - Server-side request forgery SS...

EUVD-2026-46123

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup DeleteCollaboration removes the collaboration record, recalculates accesses, drops watches, and unassigns issues — but it...