Common Weakness Enumeration
CWE-178
AllowedImproper Handling of Case Sensitivity
Abstraction: Base · Status: Incomplete
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
210 vulnerabilities reference this CWE, most recent first.
CVE-2026-83612 (GCVE-0-2026-83612)
Vulnerability from cvelistv5 – Published: 2026-09-01 14:36 – Updated: 2026-09-01 15:30
VLAI
EPSS
VEX
Title
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
Summary
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:29 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/xmldom/xmldom/security/advisor… | x_refsource_CONFIRM |
| https://github.com/xmldom/xmldom/pull/1071 | x_refsource_MISC |
| https://github.com/xmldom/xmldom/commit/7ced40c06… | x_refsource_MISC |
| https://github.com/xmldom/xmldom/releases/tag/0.9.12 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83612",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:29:51.387992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:30:10.060Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "xmldom",
"vendor": "xmldom",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.9.0-beta.1, \u003c 0.9.12"
}
]
},
{
"product": "xmldom",
"vendor": "@xmldom",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.9.0-beta.1, \u003c 0.9.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T14:36:23.638Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw"
},
{
"name": "https://github.com/xmldom/xmldom/pull/1071",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xmldom/xmldom/pull/1071"
},
{
"name": "https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707"
},
{
"name": "https://github.com/xmldom/xmldom/releases/tag/0.9.12",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12"
}
],
"source": {
"advisory": "GHSA-6mj3-qw4j-hgrw",
"discovery": "UNKNOWN"
},
"title": "xmldom: HTML raw-text closing-tag case mismatch causes output amplification"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-83612",
"datePublished": "2026-09-01T14:36:23.638Z",
"dateReserved": "2026-08-31T20:36:25.744Z",
"dateUpdated": "2026-09-01T15:30:10.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82726 (GCVE-0-2026-82726)
Vulnerability from cvelistv5 – Published: 2026-08-31 03:05 – Updated: 2026-08-31 14:47
VLAI
EPSS
VEX
Title
AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant
Summary
Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.
AshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, ""). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.
This issue affects ash_phoenix: from 2.1.26 before 2.3.25.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:47 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash_phoenix/securi… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82726.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82726 | related |
| https://github.com/ash-project/ash_phoenix/commit… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash_phoenix |
Affected:
2.1.26 , < 2.3.25
(semver)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
|
| ash-project | ash_phoenix |
Affected:
9a5ea4d377bc263de321d79574872a3dfc4fb541 , < 8306f29e77526840c89f3cd244996ce7c0fa2cda
(git)
cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82726",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:47:10.055608Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:47:35.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-rpf8-q9jh-qxrr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Helpers\u0027"
],
"packageName": "ash_phoenix",
"packageURL": "pkg:hex/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.Helpers\u0027:get_subdomain/2"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "2.3.25",
"status": "affected",
"version": "2.1.26",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.AshPhoenix.Helpers\u0027"
],
"packageName": "ash-project/ash_phoenix",
"packageURL": "pkg:github/ash-project/ash_phoenix",
"product": "ash_phoenix",
"programFiles": [
"lib/ash_phoenix/helpers.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.AshPhoenix.Helpers\u0027:get_subdomain/2"
}
],
"repo": "https://github.com/ash-project/ash_phoenix",
"vendor": "ash-project",
"versions": [
{
"lessThan": "8306f29e77526840c89f3cd244996ce7c0fa2cda",
"status": "affected",
"version": "9a5ea4d377bc263de321d79574872a3dfc4fb541",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application uses subdomain-based multitenancy via \u003ccode\u003eAshPhoenix.Helpers.get_subdomain/2\u003c/code\u003e (for example through \u003ccode\u003eAshPhoenix.LiveView.SubdomainHook\u003c/code\u003e) to select the tenant from the request host.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "The application uses subdomain-based multitenancy via `AshPhoenix.Helpers.get_subdomain/2` (for example through `AshPhoenix.LiveView.SubdomainHook`) to select the tenant from the request host."
}
],
"value": "The application uses subdomain-based multitenancy via AshPhoenix.Helpers.get_subdomain/2 (for example through AshPhoenix.LiveView.SubdomainHook) to select the tenant from the request host."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash_phoenix:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.25",
"versionStartIncluding": "2.1.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePermissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted \u003ccode\u003eHost\u003c/code\u003e header.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAshPhoenix.Helpers.get_subdomain/2\u003c/code\u003e stripped the root domain with \u003ccode\u003eString.replace(host, ~r/.?#{root_host}/, \"\")\u003c/code\u003e. The root host was interpolated raw, so each \u003ccode\u003e.\u003c/code\u003e became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With \u003ccode\u003eroot_host\u003c/code\u003e \u003ccode\u003eexample.com\u003c/code\u003e, \u003ccode\u003eHost: foo.exampleXcom.attacker.net\u003c/code\u003e returned the tenant \u003ccode\u003efoo.attacker.net\u003c/code\u003e. A metacharacter-bearing or \u003ccode\u003enil\u003c/code\u003e root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so \u003ccode\u003eTENANT.EXAMPLE.COM\u003c/code\u003e and \u003ccode\u003eEXAMPLE.COM\u003c/code\u003e slipped past the root-host allowlist. \u003ccode\u003econn.host\u003c/code\u003e comes from the client \u003ccode\u003eHost\u003c/code\u003e header. The fix matches the root host case-insensitively and only as an exact trailing suffix.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash_phoenix: from 2.1.26 before 2.3.25.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted `Host` header.\n\n`AshPhoenix.Helpers.get_subdomain/2` stripped the root domain with `String.replace(host, ~r/.?#{root_host}/, \"\")`. The root host was interpolated raw, so each `.` became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With `root_host` `example.com`, `Host: foo.exampleXcom.attacker.net` returned the tenant `foo.attacker.net`. A metacharacter-bearing or `nil` root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so `TENANT.EXAMPLE.COM` and `EXAMPLE.COM` slipped past the root-host allowlist. `conn.host` comes from the client `Host` header. The fix matches the root host case-insensitively and only as an exact trailing suffix.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"value": "Permissive Regular Expression vulnerability in ash-project ash_phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header.\n\nAshPhoenix.Helpers.get_subdomain/2 stripped the root domain with String.replace(host, ~r/.?#{root_host}/, \"\"). The root host was interpolated raw, so each . became a wildcard and any metacharacter a pattern, and the replace was global and unanchored, so a match was removed from anywhere in the string. With root_host example.com, Host: foo.exampleXcom.attacker.net returned the tenant foo.attacker.net. A metacharacter-bearing or nil root host degraded the pattern or raised on every request. The comparison was also case-sensitive, so TENANT.EXAMPLE.COM and EXAMPLE.COM slipped past the root-host allowlist. conn.host comes from the client Host header. The fix matches the root host case-insensitively and only as an exact trailing suffix.\n\nThis issue affects ash_phoenix: from 2.1.26 before 2.3.25."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-625",
"description": "CWE-625 Permissive Regular Expression",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178 Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T03:05:38.612Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash_phoenix/security/advisories/GHSA-rpf8-q9jh-qxrr"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82726.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82726"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash_phoenix/commit/8306f29e77526840c89f3cd244996ce7c0fa2cda"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82726",
"datePublished": "2026-08-31T03:05:38.612Z",
"dateReserved": "2026-08-31T00:59:08.960Z",
"dateUpdated": "2026-08-31T14:47:35.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82067 (GCVE-0-2026-82067)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:12 – Updated: 2026-09-08 17:54
VLAI
EPSS
VEX
Title
Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup
Summary
Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:54 UTC
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | MongoDB Server |
Affected:
8.3.0 , < 8.3.9
(semver)
Affected: 8.0.0 , < 8.0.30 (semver) Affected: 7.0.0 , < 7.0.41 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82067",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:54:13.251513Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:54:23.911Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "8.3.9",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThan": "8.0.30",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "7.0.41",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability."
}
],
"value": "Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and availability."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:12:26.745Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-131229"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup",
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-82067",
"datePublished": "2026-09-08T16:12:26.745Z",
"dateReserved": "2026-08-27T22:52:58.382Z",
"dateUpdated": "2026-09-08T17:54:23.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77560 (GCVE-0-2026-77560)
Vulnerability from cvelistv5 – Published: 2026-09-21 16:39 – Updated: 2026-09-21 20:45
VLAI
EPSS
VEX
Title
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
Summary
Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:05 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/tinyauthapp/tinyauth/security/… | x_refsource_CONFIRM |
| https://github.com/tinyauthapp/tinyauth/pull/1000 | x_refsource_MISC |
| https://github.com/tinyauthapp/tinyauth/pull/1028 | x_refsource_MISC |
| https://github.com/tinyauthapp/tinyauth/commit/80… | x_refsource_MISC |
| https://github.com/tinyauthapp/tinyauth/commit/e7… | x_refsource_MISC |
| https://github.com/tinyauthapp/tinyauth/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tinyauthapp | tinyauth |
Affected:
< 5.1.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:05:46.154613Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:45:26.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tinyauth",
"vendor": "tinyauthapp",
"versions": [
{
"status": "affected",
"version": "\u003c 5.1.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-636",
"description": "CWE-636: Not Failing Securely (\u0027Failing Open\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:39:18.606Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-328g-jx67-v94g"
},
{
"name": "https://github.com/tinyauthapp/tinyauth/pull/1000",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinyauthapp/tinyauth/pull/1000"
},
{
"name": "https://github.com/tinyauthapp/tinyauth/pull/1028",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinyauthapp/tinyauth/pull/1028"
},
{
"name": "https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinyauthapp/tinyauth/commit/80bc87188ec3aabc5104c249eaa7b997973b9275"
},
{
"name": "https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinyauthapp/tinyauth/commit/e75605b2c534ec83525a33603e16d76baca13399"
},
{
"name": "https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinyauthapp/tinyauth/releases/tag/v5.1.2"
}
],
"source": {
"advisory": "GHSA-328g-jx67-v94g",
"discovery": "UNKNOWN"
},
"title": "Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77560",
"datePublished": "2026-09-21T16:39:18.606Z",
"dateReserved": "2026-08-20T20:35:30.146Z",
"dateUpdated": "2026-09-21T20:45:26.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77281 (GCVE-0-2026-77281)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:04 – Updated: 2026-09-18 14:43
VLAI
EPSS
VEX
Title
Caddy: rewrite placeholder re-expansion
Summary
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:39 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/caddyserver/caddy/security/adv… | x_refsource_CONFIRM |
| https://github.com/caddyserver/caddy/pull/7761 | x_refsource_MISC |
| https://github.com/caddyserver/caddy/commit/176b0… | x_refsource_MISC |
| https://github.com/caddyserver/caddy/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| caddyserver | caddy |
Affected:
< 2.11.4
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77281",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:39:55.254322Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:43:34.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "caddy",
"vendor": "caddyserver",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite() can pass attacker-controlled replacement bytes through buildQueryString for a second placeholder expansion when a rewrite URI ends with a literal question mark, allowing injected environment or request-variable placeholders to disclose data and, when the file provider is registered, allowing injected file placeholders to disclose readable files. The issue is fixed in version 2.11.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:04:58.400Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9"
},
{
"name": "https://github.com/caddyserver/caddy/pull/7761",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/caddyserver/caddy/pull/7761"
},
{
"name": "https://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb"
},
{
"name": "https://github.com/caddyserver/caddy/releases/tag/v2.11.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/caddyserver/caddy/releases/tag/v2.11.4"
}
],
"source": {
"advisory": "GHSA-j8px-rmrx-76h9",
"discovery": "UNKNOWN"
},
"title": "Caddy: rewrite placeholder re-expansion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-77281",
"datePublished": "2026-09-17T21:04:58.400Z",
"dateReserved": "2026-08-20T19:14:21.331Z",
"dateUpdated": "2026-09-18T14:43:34.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74041 (GCVE-0-2026-74041)
Vulnerability from cvelistv5 – Published: 2026-10-13 13:27 – Updated: 2026-10-14 14:14
VLAI
EPSS
VEX
Title
Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch
Summary
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:12 UTC
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/wazuh/wazuh/security/advisorie… | vendor-advisory |
| https://github.com/wazuh/wazuh/releases/tag/v4.14.8 | patchrelease-notes |
| https://www.vulncheck.com/advisories/wazuh-4.14.3… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wazuh | wazuh-manager |
Affected:
4.14.3 , < 4.14.8
(semver)
Unaffected: 4.14.8 (semver) cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:* |
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74041",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:12:03.074387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:14:38.913Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wazuh/wazuh",
"product": "wazuh-manager",
"repo": "https://github.com/wazuh/wazuh",
"vendor": "Wazuh",
"versions": [
{
"lessThan": "4.14.8",
"status": "affected",
"version": "4.14.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.14.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.8",
"versionStartIncluding": "4.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "namd0ng"
},
{
"lang": "en",
"type": "finder",
"value": "vikman90"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can inject an uppercase LOG_FORMAT command localfile that the collector runs as root on reload."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:27:31.203Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cjf8-wjx6-hjw6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-cjf8-wjx6-hjw6"
},
{
"name": "Wazuh v4.14.8 Release Notes",
"tags": [
"patch",
"release-notes"
],
"url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.8"
},
{
"name": "VulnCheck Advisory: Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wazuh-4.14.3-before-4.14.8-remote-command-validation-bypass-via-case-mismatch"
}
],
"title": "Wazuh 4.14.3 before 4.14.8 Remote Command Validation Bypass via Case Mismatch",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-74041",
"datePublished": "2026-10-13T13:27:31.203Z",
"dateReserved": "2026-08-14T14:06:40.512Z",
"dateUpdated": "2026-10-14T14:14:38.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73476 (GCVE-0-2026-73476)
Vulnerability from cvelistv5 – Published: 2026-09-02 12:32 – Updated: 2026-09-02 18:38
VLAI
EPSS
VEX
Title
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
Summary
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:38 UTC
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Drupal | External Authentication |
Affected:
0.0.0 , < 2.0.13
(semver)
|
Date Public
2026-08-12 17:56
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T18:38:36.672968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T18:38:42.486Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.drupal.org/project/externalauth",
"product": "External Authentication",
"repo": "https://git.drupalcode.org/project/externalauth",
"vendor": "Drupal",
"versions": [
{
"lessThan": "2.0.13",
"status": "affected",
"version": "0.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u00e6\u0099\u0089\u00e5\u00ae\u0087 \u00e6\u009e\u0097 (whale120)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sven Decabooter (svendecabooter)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Swan Kalata (akalata)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Neil Drumm (drumm)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Greg Knaddison (greggles)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Juraj Nemec (poker10)"
}
],
"datePublic": "2026-08-12T17:56:03.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178 Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:32:38.621Z",
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal"
},
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-098"
}
],
"title": "External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098"
}
},
"cveMetadata": {
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"cveId": "CVE-2026-73476",
"datePublished": "2026-09-02T12:32:38.621Z",
"dateReserved": "2026-08-12T17:21:18.776Z",
"dateUpdated": "2026-09-02T18:38:42.486Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73416 (GCVE-0-2026-73416)
Vulnerability from cvelistv5 – Published: 2026-08-13 22:04 – Updated: 2026-08-17 17:17
VLAI
EPSS
VEX
Title
jupyterlab: PyPI extension blocklist package-name canonicalization bypass
Summary
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. This issue is fixed in versions 4.5.10 and 4.6.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 17:16 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/jupyterlab/jupyterlab/security… | x_refsource_CONFIRM |
| https://github.com/jupyterlab/jupyterlab/pull/19184 | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/pull/19185 | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/pull/19186 | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/commit/9… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/commit/b… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/commit/f… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/releases… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/releases… | x_refsource_MISC |
| https://github.com/jupyterlab/jupyterlab/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jupyterlab | jupyterlab |
Affected:
>= 4.5.0, < 4.5.10
Affected: >= 4.6.0, < 4.6.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T17:16:18.061380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T17:17:59.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jupyterlab",
"vendor": "jupyterlab",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.5.0, \u003c 4.5.10"
},
{
"status": "affected",
"version": "\u003e= 4.6.0, \u003c 4.6.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab\u0027s PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. This issue is fixed in versions 4.5.10 and 4.6.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178: Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-180",
"description": "CWE-180: Incorrect Behavior Order: Validate Before Canonicalize",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T22:04:26.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-89vp-jrxv-24w8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-89vp-jrxv-24w8"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/pull/19184",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/pull/19185",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/pull/19186",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
},
{
"name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1"
}
],
"source": {
"advisory": "GHSA-89vp-jrxv-24w8",
"discovery": "UNKNOWN"
},
"title": "jupyterlab: PyPI extension blocklist package-name canonicalization bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73416",
"datePublished": "2026-08-13T22:04:26.603Z",
"dateReserved": "2026-08-12T14:32:11.795Z",
"dateUpdated": "2026-08-17T17:17:59.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73270 (GCVE-0-2026-73270)
Vulnerability from cvelistv5 – Published: 2026-09-01 14:48 – Updated: 2026-09-08 01:09
VLAI
EPSS
VEX
Title
httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
Summary
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.
mod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:58 UTC
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-73270.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-73270 | related |
| https://www.erlang.org/doc/system/versions.html#o… | x_version-scheme |
| https://github.com/erlang/otp/commit/bac19eb3dbd9… | patch |
| https://github.com/erlang/otp/commit/d8878dec0ece… | patch |
| https://github.com/erlang/otp/commit/9641944a2efb… | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Erlang | OTP |
Unknown:
0 , < 17.0
(otp)
Affected: 17.0 , < 27.3.4.17 (otp) Affected: 28.0 , < 28.5.0.6 (otp) Affected: 29.0 , < 29.0.6 (otp) cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
|
| Erlang | OTP |
Unknown:
0 , < 5.10
(otp)
Affected: 5.10 , < 9.3.2.7 (otp) Affected: 9.4 , < 9.6.2.3 (otp) Affected: 9.7 , < 9.7.2 (otp) cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
|
| Erlang | OTP |
Affected:
84adefa331c4159d432d22840663c38f155cd4c1 , < *
(git)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73270",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:58:36.382951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:58:41.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"mod_auth"
],
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"programFiles": [
"lib/inets/src/http_server/mod_auth.erl"
],
"programRoutines": [
{
"name": "mod_auth:secret_path/3"
}
],
"vendor": "Erlang",
"versions": [
{
"lessThan": "17.0",
"status": "unknown",
"version": "0",
"versionType": "otp"
},
{
"lessThan": "27.3.4.17",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"lessThan": "28.5.0.6",
"status": "affected",
"version": "28.0",
"versionType": "otp"
},
{
"lessThan": "29.0.6",
"status": "affected",
"version": "29.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"mod_auth"
],
"packageName": "inets",
"packageURL": "pkg:otp/inets",
"product": "OTP",
"programFiles": [
"src/http_server/mod_auth.erl"
],
"programRoutines": [
{
"name": "mod_auth:secret_path/3"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"lessThan": "5.10",
"status": "unknown",
"version": "0",
"versionType": "otp"
},
{
"lessThan": "9.3.2.7",
"status": "affected",
"version": "5.10",
"versionType": "otp"
},
{
"lessThan": "9.6.2.3",
"status": "affected",
"version": "9.4",
"versionType": "otp"
},
{
"lessThan": "9.7.2",
"status": "affected",
"version": "9.7",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"mod_auth"
],
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"programFiles": [
"lib/inets/src/http_server/mod_auth.erl"
],
"programRoutines": [
{
"name": "mod_auth:secret_path/3"
}
],
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6",
"status": "unaffected"
},
{
"at": "d8878dec0ececc2eab18e47bb18b472f224ca633",
"status": "unaffected"
},
{
"at": "9641944a2efbf55bea760f8ff7ba777fe3a0961c",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTwo conditions must both hold. The server must protect a directory with \u003ccode\u003emod_auth\u003c/code\u003e, by configuring a \u003ccode\u003edirectory\u003c/code\u003e block with authentication requirements, and the document root must sit where the operating system resolves paths case-insensitively, which is the default on Windows and on macOS. Deployments whose path resolution is case-sensitive are unaffected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Two conditions must both hold. The server must protect a directory with `mod_auth`, by configuring a `directory` block with authentication requirements, and the document root must sit where the operating system resolves paths case-insensitively, which is the default on Windows and on macOS. Deployments whose path resolution is case-sensitive are unaffected."
}
],
"value": "Two conditions must both hold. The server must protect a directory with mod_auth, by configuring a directory block with authentication requirements, and the document root must sit where the operating system resolves paths case-insensitively, which is the default on Windows and on macOS. Deployments whose path resolution is case-sensitive are unaffected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.6",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.6",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Konrad Pietrzak / Ericsson"
},
{
"lang": "en",
"type": "analyst",
"value": "Lukas Backstr\u00f6m / Erlang Solutions"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a \u003ccode\u003emod_auth\u003c/code\u003e protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emod_auth:secret_path/3\u003c/code\u003e decides whether a resolved filesystem path lies inside a protected \u003ccode\u003edirectory\u003c/code\u003e block by running the configured directory path through \u003ccode\u003ere:run/3\u003c/code\u003e without the \u003ccode\u003ecaseless\u003c/code\u003e option. A request for \u003ccode\u003e/secret/file\u003c/code\u003e against a directory configured as \u003ccode\u003e/Secret\u003c/code\u003e therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and \u003ccode\u003emod_get\u003c/code\u003e serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;27.3.4.17, from OTP\u0026nbsp;28.0 before OTP\u0026nbsp;28.5.0.6, and from OTP\u0026nbsp;29.0 before OTP\u0026nbsp;29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u0026nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a `mod_auth` protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.\n\n`mod_auth:secret_path/3` decides whether a resolved filesystem path lies inside a protected `directory` block by running the configured directory path through `re:run/3` without the `caseless` option. A request for `/secret/file` against a directory configured as `/Secret` therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and `mod_get` serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
}
],
"value": "Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive.\n\nmod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
}
],
"impacts": [
{
"capecId": "CAPEC-76",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-76 Manipulating Web Input to File System Calls"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "CWE-178 Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T01:09:49.755Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-mh78-93cr-jx8f"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-73270.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-73270"
},
{
"tags": [
"x_version-scheme"
],
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/d8878dec0ececc2eab18e47bb18b472f224ca633"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/9641944a2efbf55bea760f8ff7ba777fe3a0961c"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\n\u003cli\u003eHost the document root on a case-sensitive filesystem, where the mismatched casing does not resolve to the protected file.\u003c/li\u003e\n\u003cli\u003ePlace a reverse proxy in front of httpd that performs its own case-insensitive path matching for the protected paths, or that normalises request path casing before forwarding.\u003c/li\u003e\n\u003cli\u003eRestrict access to the server to trusted clients where the deployment allows it.\u003c/li\u003e\n\u003c/ul\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "* Host the document root on a case-sensitive filesystem, where the mismatched casing does not resolve to the protected file.\n* Place a reverse proxy in front of httpd that performs its own case-insensitive path matching for the protected paths, or that normalises request path casing before forwarding.\n* Restrict access to the server to trusted clients where the deployment allows it."
}
],
"value": "* Host the document root on a case-sensitive filesystem, where the mismatched casing does not resolve to the protected file.\n* Place a reverse proxy in front of httpd that performs its own case-insensitive path matching for the protected paths, or that normalises request path casing before forwarding.\n* Restrict access to the server to trusted clients where the deployment allows it."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-73270",
"datePublished": "2026-09-01T14:48:53.200Z",
"dateReserved": "2026-08-17T11:15:02.315Z",
"dateUpdated": "2026-09-08T01:09:49.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72836 (GCVE-0-2026-72836)
Vulnerability from cvelistv5 – Published: 2026-08-14 11:35 – Updated: 2026-08-18 02:00
VLAI
EPSS
VEX
Title
FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
Summary
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 02:00 UTC
CWE
- CWE-178 - Improper Handling of Case Sensitivity
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/filebrowser/filebrowser/securi… | vendor-advisory |
| https://github.com/filebrowser/filebrowser/commit… | patch |
| https://www.vulncheck.com/advisories/filebrowser-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| filebrowser | filebrowser |
Affected:
0 , < 2.63.19
(semver)
Unaffected: 2.63.19 (semver) cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:* |
Date Public
2026-07-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72836",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T02:00:31.486852Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T02:00:53.619Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-576v-w77m-gr84"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/filebrowser/filebrowser/v2",
"product": "filebrowser",
"vendor": "filebrowser",
"versions": [
{
"lessThan": "2.63.19",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.63.19",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.63.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "luoy16002-svg"
},
{
"lang": "en",
"type": "finder",
"value": "hacdias"
}
],
"datePublic": "2026-07-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser\u0027s root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account\u0027s files through authenticated HTTP endpoints, without needing an existing account or victim interaction."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-178",
"description": "Improper Handling of Case Sensitivity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:52:17.496Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-576v-w77m-gr84)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-576v-w77m-gr84"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/filebrowser/filebrowser/commit/fe7efb2e6afe66774cd86a5b0a03033bd514d0c0"
},
{
"name": "VulnCheck Advisory: FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/filebrowser-before-case-sensitivity-authentication-bypass"
}
],
"title": "FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72836",
"datePublished": "2026-08-14T11:35:41.491Z",
"dateReserved": "2026-08-10T15:13:41.486Z",
"dateUpdated": "2026-08-18T02:00:53.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-44
Architecture and Design
Strategy: Input Validation
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-20
Implementation
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
No CAPEC attack patterns related to this CWE.