4 matches found
CVE-2026-119599
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...
CVE-2026-119599 AxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...
CVE-2026-119599
AxonHub versions through 1.0.0-beta11 are vulnerable to a privilege escalation vulnerability (CWE-266) caused by unvalidated scopes when creating service_account API keys. This flaw allows project users to assign system-level scopes. Specifically, an attacker with write_api_keys can mint keys con...
EUVD-2026-113936
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating serviceaccount API keys with unvalidated scopes. Attackers holding writeapikeys can mint keys with readchannels and query /admin/graphql to read every...