CVE-2026-108522 Studio-Saelix Sencho Login Endpoint login improper authentication

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...

CVE-2026-108696 CoreShop through 1.5.5 Authorization Bypass via OrderController OrderConfirm and SendReship

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confir...

CVE-2026-108694 ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108708 Wukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil

WukongHRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and EmployeeUtil data-scope checks return all employees. Any authenticated low-privileged employee can read payslips, salary records, bank cards an...

CVE-2026-108706 eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /api/s3Storage/download/id to collect UR...

CVE-2026-108707 Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect

WukongHRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal dat...

CVE-2026-108705 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records...

CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

CVE-2026-108703 CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

CVE-2026-108702 CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test

1Panel-dev CordysCRM through 1.9.3 lacks a PROCESSSETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe...

CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

CVE-2026-108701 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to...

CVE-2026-108692 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

CVE-2026-108691 mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList

mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to...

CVE-2026-108690 mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can request GET /p/shopCart/expiryProdList...

CVE-2026-108689 Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

CVE-2026-108688 Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload

Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...

CVE-2026-108680 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver...

CVE-2026-108679 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST crafted bodies to...

CVE-2026-108677 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by...

CVE-2026-108678 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles with an arbitrary username to enumerate...

CVE-2026-108676 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to retrieve a ZIP of attachments from...

CVE-2026-108674 JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OpenApiController queryById handler that allows low-privileged authenticated users to read OpenAPI definitions without openapi permissions. Attackers can request GET /openapi/queryById with an entry id to obtain interna...

CVE-2026-108675 JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notic...

CVE-2026-108673 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authenticated user to export all AI prompts. Low-privileged attackers can request /airag/prompts/exportXls to download every user's prompts, including prompt...

CVE-2026-108671 JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP...

CVE-2026-108672 JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser

JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video...

CVE-2026-108670 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large...

CVE-2026-108669 JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks Shiro permission annotations. Low-privileged authenticated attackers can supply knowledge base ids to the GET /airag/knowledge/embedding/search endpoint to...

CVE-2026-108668 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows any authenticated user to purge AI prompt templates. Low-privileged attackers can send DELETE requests with prompt template ids to permanently remove recycle-b...

CVE-2026-108667 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to cle...

CVE-2026-108665 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt...

CVE-2026-108666 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any authenticated user to delete AI prompt templates. Low-privileged attackers can obtain prompt ids from the unguarded list endpoint and pass them to deleteBatc...

CVE-2026-108664 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privileged authenticated users to read any AI prompt template. Attackers can enumerate ids via the unguarded /airag/prompts/list endpoint and query each one to...

CVE-2026-108663 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authenticated user to reject tenant administrator applications. Low-privileged attackers can send PUT requests with chosen tenantId, packId and userId values to...

CVE-2026-108662 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT /sys/tenant/deleteTenantPackUser. Attackers can supply arbitrary userId and packId values in the request body to remove any user...

CVE-2026-108661 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via POST /sys/tenant/changeOwenUserTenant. Low-privileged attackers can supply userId and tenantId parameters to reassign any tenant's owner to a member, includin...

CVE-2026-108660 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant...

CVE-2026-108659 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows any authenticated user to query tenant product packs. Low-privileged attackers can supply arbitrary tenantId and userId parameters to enumerate any tenant's...

CVE-2026-108658 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows any authenticated user to read other tenants' records. Low-privileged attackers can iterate small integer tenant ids to retrieve full systenant records,...

CVE-2026-108657 JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenant administrator applications. Attackers can file a pending application via doApplyTenantPackUser and approve it through PUT...

CVE-2026-108656 JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers endpoint that allows any authenticated user to read tenant administrator applications. Low-privileged attackers can iterate the tenantId parameter to retrieve...

CVE-2026-108655 JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron...

CVE-2026-108653 JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any authenticated user to list OpenAPI registry definitions. Low-privileged attackers can query GET /openapi/list to read virtual paths, internal origin URLs, IP...

CVE-2026-108654 JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the OssFileController queryById handler that allows low-privileged authenticated users to read object storage file records. Attackers who know a record id can request GET /sys/oss/file/queryById to obtain original file name...

CVE-2026-108652 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change other users' avatars. Low-privileged attackers can send PUT requests with a target user id and an arbitrary value, such as an...

CVE-2026-108650 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet ...

CVE-2026-108651 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrieve any user's role codes. Low-privileged attackers can supply arbitrary userId values to GET /sys/api/getRolesByUserId to enumerat...

CVE-2026-108649 JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRolesById handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send a userId to GET /sys/api/queryUserRolesById to enumerate role assignments and...