82 matches found
CVE-2026-113596
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...
CVE-2026-113596 Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...
CVE-2026-113596 Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...
CVE-2026-113596
Webstudio versions prior to 0.256.0 are vulnerable to an information disclosure flaw caused by missing authorization in the tRPC procedures publishedBuilds and findManyByIds. Authenticated users who possess another user's project UUID can query the /trpc handler to retrieve sensitive project data...
EUVD-2026-105162
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...
CVE-2026-113596 Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish...
PT-2026-118456
Name of the Vulnerable Software and Affected Versions Webstudio versions prior to 0.256.0 Description Authenticated users can access project data belonging to other users due to missing authorization. By knowing a project UUID, an attacker can query the '/trpc' endpoint using the publishedBuilds...
Webstudio authorization issue vulnerability
Versions prior to Webstudio 0.256.0 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation; authenticated users can read other users’ project data via the publishedBuilds and findManyByIds tRPC processes. Attackers who know other users’...
CVE-2026-86119
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
EUVD-2026-71951
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86119
Webstudio through version 0.296.0 is affected by an unauthenticated server-side request forgery (SSRF) vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes. The root cause is that when the RESIZE_ORIGIN environment variable is unset, attackers can supply arbitrary URLs to thes...
CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86119
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
PT-2026-86390
Name of the Vulnerable Software and Affected Versions Webstudio versions prior to 0.296.0 Description An unauthenticated server-side request forgery SSRF exists when the RESIZE ORIGIN environment variable is unset. This allows attackers to provide arbitrary URLs to the '/cgi/image', '/cgi/video',...
CVE-2026-86119: Server-Side Request Forgery (SSRF)
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
EUVD-2008-5270
Malware in sbrugna...