Missing Authorization

🗓️ 05 Aug 2026 21:14:33Reported by Snyk Security DatabaseType

Missing Authorization in Nuxt Nitro server allows access to other users' SSR data via /_payload.json; upgrade to 4.5.1.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-71316	5 Aug 202621:14	–	attackerkb
Circl	CVE-2026-71316	6 Aug 202600:00	–	circl
CVE	CVE-2026-71316	5 Aug 202621:14	–	cve
Cvelist	CVE-2026-71316 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients	5 Aug 202621:14	–	cvelist
EUVD	EUVD-2026-53646	5 Aug 202621:14	–	euvd
Github Security Blog	Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients	5 Aug 202621:14	–	github
NVD	CVE-2026-71316	5 Aug 202622:17	–	nvd
OSV	GHSA-WM8W-6QJM-CV43 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients	5 Aug 202621:14	–	osv
Patchstack	NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients	5 Aug 202621:14	–	patchstack
vulnersOsv	@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +15 more potentially affected by CVE-2026-71316 via @nuxt/nitro-server (>=4.4.2, <=4.5.0)	5 Aug 202621:14	–	vulnersosv

Vulners

Node

Source	Link
cwe	www.cwe.mitre.org/data/definitions/CWE-524.html
cwe	www.cwe.mitre.org/data/definitions/CWE-862.html
security	www.security.snyk.io/vuln/SNYK-JS-NUXTNITROSERVER-18565121

05 Aug 2026 21:14Current

5.4Medium risk

Vulners AI Score5.4

CVSS 45.3

CVSS 3.16.4 - 7.5

EPSS0.00297

SSVC