Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
5432 vulnerabilities reference this CWE, most recent first.
GCVE-1-2026-20057 (CVE-2026-94393)
Vulnerability from gna-1 – Published: 2026-09-21 13:13 – Updated: 2026-09-21 13:13
VLAI
EPSS
VEX
Title
MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport
Summary
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.
As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access.
The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.
The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions.
Version affected: <2.5.47
Severity
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/43665b9bb | patch |
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-09-21 13:01 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/43665b9bb.patch
2306bd95d16b… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
43665b9bb6bd
|
fix: [security] Refuse to adopt an event report that belongs | 2306bd95d16b… |
Fix summary
The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report's event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.
Patch summary
In app/Model/EventReport.php, the editReport method's else-branch (handling an existing report found by UUID) now includes an 11-line guard: it compares (string)$existingReport['EventReport']['event_id'] against (string)$eventId and, on mismatch, appends an error string and returns early, preventing the subsequent assignment of the foreign report's ID to the current event's report record.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: the attacker only needs to supply a known/guessed UUID in a standard edit request; no race or complex condition. AT:N: no manipulation of the target environment is required. PR:L: the attacker must be an authenticated user with editor role on at least one event. UI:N: no victim interaction is needed. VC:N/VI:N/VA:N: the MISP application itself (its configuration, credentials, availability) is not directly impacted. SC:H: the attacker gains read access to private report data in events they cannot otherwise see. SI:H: the attacker can overwrite and modify report data belonging to other events. SA:N: no safety-system impact.
Weakness rationale
- CWE-639 The report UUID is a user-controlled key resolved globally without scoping to the caller's event context. The system failed to verify that the referenced object (report) belongs to the event the caller is authorized to edit, allowing cross-event access.
- CWE-284 The broader category applies: MISP's per-event access control model was bypassed because the editReport path did not enforce that a report UUID maps to the same event the caller is operating on.
Attack pattern rationale
- CAPEC-174 The edge case of a UUID belonging to a different event was not handled: the code assumed any UUID found in the global table belonged to the current event. The attacker exploits this unhandled edge case to reparent a foreign report. This is the closest CAPEC; a more specific 'IDOR' or 'broken object reference' CAPEC does not exist in the CAPEC catalog, so CAPEC-174 is the best available match.
Assumptions to verify
- The affected version range is inferred from the tag_version_boundary (v2.5.47, 56 commits after fix); the exact first affected and first fixed release versions are not stated in the patch and are marked unspecified.
- PR:L assumes the attacker needs at minimum editor-level access to one event; the patch does not specify whether viewer-level access could also trigger the code path, but the commit message explicitly references 'an event editor'.
- CAPEC-174 is selected as the closest available attack pattern; no CAPEC entry specifically covers IDOR or broken object reference resolution, so the mapping is approximate.
- The CVSS sub-component impact (SC:H, SI:H) assumes the event report data constitutes a distinct data asset whose confidentiality and integrity are the primary impact, rather than the MISP application's own state.
- The commit date (2026-09-16) and tag boundary are taken at face value from the supplied metadata; no independent verification of release timing was performed.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
5 | 9 | medium | 5 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"app/Model/EventReport.php"
],
"product": "MISP",
"programFiles": [
"app/Model/EventReport.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
},
{
"lang": "en",
"type": "reporter",
"value": "David Andr\u00e9"
},
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003c/div\u003e\u003cp\u003eWhen a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\u003c/p\u003e\u003cp\u003eAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\u003c/p\u003e\u003cp\u003eThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\u003c/p\u003e\u003cp\u003eThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e\u003cdiv\u003e\u003c/div\u003e"
}
],
"value": "When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event.\n\nAs a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report\u2019s UUID. Once moved, they could view and change information that they were not originally allowed to access.\n\nThe vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID.\n\nThe main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP\u2019s normal access restrictions.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-174",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-174 Exploiting Incorrectly Handled Edge Cases"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/43665b9bb"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.\u003c/p\u003e"
}
],
"value": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports."
}
],
"title": "MISP Event Report Cross-Event Reparenting via Unscoped UUID Resolution in editReport",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary (v2.5.47, 56 commits after fix); the exact first affected and first fixed release versions are not stated in the patch and are marked unspecified.",
"PR:L assumes the attacker needs at minimum editor-level access to one event; the patch does not specify whether viewer-level access could also trigger the code path, but the commit message explicitly references \u0027an event editor\u0027.",
"CAPEC-174 is selected as the closest available attack pattern; no CAPEC entry specifically covers IDOR or broken object reference resolution, so the mapping is approximate.",
"The CVSS sub-component impact (SC:H, SI:H) assumes the event report data constitutes a distinct data asset whose confidentiality and integrity are the primary impact, rather than the MISP application\u0027s own state.",
"The commit date (2026-09-16) and tag boundary are taken at face value from the supplied metadata; no independent verification of release timing was performed."
],
"capecRationale": [
{
"capecId": "CAPEC-174",
"rationale": "The edge case of a UUID belonging to a different event was not handled: the code assumed any UUID found in the global table belonged to the current event. The attacker exploits this unhandled edge case to reparent a foreign report. This is the closest CAPEC; a more specific \u0027IDOR\u0027 or \u0027broken object reference\u0027 CAPEC does not exist in the CAPEC catalog, so CAPEC-174 is the best available match."
}
],
"commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
},
{
"lang": "en",
"type": "reporter",
"value": "David Andr\u00e9"
},
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: the attacker only needs to supply a known/guessed UUID in a standard edit request; no race or complex condition. AT:N: no manipulation of the target environment is required. PR:L: the attacker must be an authenticated user with editor role on at least one event. UI:N: no victim interaction is needed. VC:N/VI:N/VA:N: the MISP application itself (its configuration, credentials, availability) is not directly impacted. SC:H: the attacker gains read access to private report data in events they cannot otherwise see. SI:H: the attacker can overwrite and modify report data belonging to other events. SA:N: no safety-system impact.",
"fixSummary": "The fix adds an ownership check in editReport: before adopting an existing report found by UUID, the code now verifies that the report\u0027s event_id matches the event being edited. If the UUID resolves to a report belonging to a different event, the operation is rejected with an error message, preventing cross-event reparenting, unauthorized read, and unauthorized overwrite of reports.",
"generatedAt": "2026-09-21T13:01:16.364280Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
"patchSummary": "In app/Model/EventReport.php, the editReport method\u0027s else-branch (handling an existing report found by UUID) now includes an 11-line guard: it compares (string)$existingReport[\u0027EventReport\u0027][\u0027event_id\u0027] against (string)$eventId and, on mismatch, appends an error string and returns early, preventing the subsequent assignment of the foreign report\u0027s ID to the current event\u0027s report record.",
"patchTruncated": false,
"patches": [
{
"commit": "43665b9bb6bd39af0db1f38e608bdf2cb84b9dec",
"patchSha256": "2306bd95d16b9c00582997897aa9181253364082a09589640fce576a03beafb4",
"source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
"subject": "fix: [security] Refuse to adopt an event report that belongs"
}
],
"source": "https://github.com/MISP/MISP/commit/43665b9bb.patch",
"subject": "fix: [security] Refuse to adopt an event report that belongs",
"tagVersionBoundary": {
"commits_after_fix": 56,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-639",
"rationale": "The report UUID is a user-controlled key resolved globally without scoping to the caller\u0027s event context. The system failed to verify that the referenced object (report) belongs to the event the caller is authorized to edit, allowing cross-event access."
},
{
"cweId": "CWE-284",
"rationale": "The broader category applies: MISP\u0027s per-event access control model was bypassed because the editReport path did not enforce that a report UUID maps to the same event the caller is operating on."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20057"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-94393",
"datePublished": "2026-09-21T13:13:46.709115Z",
"dateReserved": "2026-09-21T13:13:54.299Z",
"dateUpdated": "2026-09-21T13:13:54.565172Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20057"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GCVE-1-2026-20022 (CVE-2026-94374)
Vulnerability from gna-1 – Published: 2026-09-21 12:24 – Updated: 2026-09-21 12:25
VLAI
EPSS
VEX
Title
MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports
Summary
MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied 'id' field before calling save(). Because the MISP EventReport model's create() method does not strip the id field, an authenticated user with permission to submit module results could include an 'id' value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to
- read the content of another event's report by reparenting it into their own event
- overwrite the report's fields with attacker-controlled data
- change the report's event_id to redirect ownership.
This constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.
Version affected: <2.5.47
Severity
CWE
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/4c1a03b20 | patch |
GCVE extensions
AI-generated
Confidence: medium
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-09-21 12:19 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/4c1a03b20.patch
1079aff9d4e4… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
4c1a03b200fc
|
fix: [security] Strip the client id from module-result event | 1079aff9d4e4… |
Fix summary
The fix adds an unset($report['id']) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.
Patch summary
In app/Model/Event.php, within the foreach loop over $resolved_data['EventReport'] in processModuleResultsData, a single line unset($report['id']); is inserted after $this->EventReport->create() and before $report['event_id'] = $id. A four-line comment is added explaining that module-result import only creates reports and that stripping the client id prevents redirecting save() onto another event's report row. No other files or logic are modified.
CVSS rationale
AV:N – MISP is a network-accessible web application. AC:L – the attack requires only including an 'id' field in a normal module-results submission; no race condition or complex bypass is needed. AT:N – no prior user interaction or attack preparation beyond crafting the payload. PR:L – requires an authenticated user with permission to submit module results on an event (a common MISP role). UI:N – no victim interaction required. VC:L – the attacker can read the content of one specific report they target by id. VI:H – the attacker can overwrite all fields of the targeted report and change its event_id, fully compromising its integrity. VA:N – no availability impact. SC/SI/SA – no impact on adjacent systems; SI:H reflects the integrity compromise of the shared report data store.
Weakness rationale
- CWE-639 The attacker supplies an 'id' value in the module-results payload that the application uses as the primary key for the save() operation, redirecting the write to an object (report row) belonging to a different event. The user-controlled key bypasses the intended create-only semantics and grants unauthorized read/write access to another event's report.
- CWE-472 The 'id' field is assumed to be server-generated and immutable for new records, but the application accepts a client-supplied value and passes it directly to the ORM save() call, allowing the attacker to control which database row is affected.
Attack pattern rationale
- CAPEC-126 The attacker tampers with the module-results payload by injecting an 'id' parameter that the application does not expect or sanitize, redirecting the save operation to an arbitrary existing report row. This is the closest CAPEC to the observed attack: manipulating a request parameter to alter application behavior and access an unauthorized object. The mapping is approximate because CAPEC-126 typically describes in-transit tampering, whereas here the parameter is included in the initial request body; however, no more specific CAPEC for mass-assignment IDOR exists in the CAPEC catalog.
Assumptions to verify
- The exact affected and fixed MISP version numbers are not stated in the patch metadata; the tag boundary (v2.5.47, 53 commits after fix) suggests the fix landed after v2.5.47 but the precise fixed release is unspecified.
- PR:L assumes that submitting module results is available to any authenticated user with write access to an event; if MISP requires a more restrictive role (e.g., admin or org admin), PR should be raised to H.
- VC:L assumes the attacker can read only the specific report they target by id; if the reparenting exposes additional data (e.g., related attributes), the confidentiality impact could be higher.
- CAPEC-126 (Parameter Tampering) is the closest available CAPEC; the actual technique is more precisely a mass-assignment / IDOR via unsanitized primary key, for which no dedicated CAPEC entry exists.
- The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
5 | 9 | medium | 5 |
{
"containers": {
"cna": {
"affected": [
{
"modules": [
"app/Model/Event.php (processModuleResultsData / handleModuleResults)"
],
"product": "MISP",
"programFiles": [
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.47",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u0026nbsp;\u003c/p\u003e\u2003-\u0026nbsp;read the content of another event\u0027s report by reparenting it into their own event\u003cbr\u003e\u2003-\u0026nbsp;overwrite the report\u0027s fields with attacker-controlled data\u003cbr\u003e\u003cdiv\u003e\u2003-\u0026nbsp;change the report\u0027s event_id to redirect ownership.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\u003c/p\u003e\u003cp\u003eVersion affected: \u0026lt;2.5.47\u003c/p\u003e"
}
],
"value": "MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied \u0027id\u0027 field before calling save(). Because the MISP EventReport model\u0027s create() method does not strip the id field, an authenticated user with permission to submit module results could include an \u0027id\u0027 value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to\u00a0\n\n\u2003-\u00a0read the content of another event\u0027s report by reparenting it into their own event\n\u2003-\u00a0overwrite the report\u0027s fields with attacker-controlled data\n\u2003-\u00a0change the report\u0027s event_id to redirect ownership.\u00a0\n\n\n\n\nThis constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event.\n\nVersion affected: \u003c2.5.47"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-472",
"description": "CWE-472 External Control of Assumed-Immutable Web Parameter",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "00000000-0000-4000-9000-000000000000"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/4c1a03b20"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.\u003c/p\u003e"
}
],
"value": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method."
}
],
"title": "MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events\u0027 Reports",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The exact affected and fixed MISP version numbers are not stated in the patch metadata; the tag boundary (v2.5.47, 53 commits after fix) suggests the fix landed after v2.5.47 but the precise fixed release is unspecified.",
"PR:L assumes that submitting module results is available to any authenticated user with write access to an event; if MISP requires a more restrictive role (e.g., admin or org admin), PR should be raised to H.",
"VC:L assumes the attacker can read only the specific report they target by id; if the reparenting exposes additional data (e.g., related attributes), the confidentiality impact could be higher.",
"CAPEC-126 (Parameter Tampering) is the closest available CAPEC; the actual technique is more precisely a mass-assignment / IDOR via unsanitized primary key, for which no dedicated CAPEC entry exists.",
"The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The attacker tampers with the module-results payload by injecting an \u0027id\u0027 parameter that the application does not expect or sanitize, redirecting the save operation to an arbitrary existing report row. This is the closest CAPEC to the observed attack: manipulating a request parameter to alter application behavior and access an unauthorized object. The mapping is approximate because CAPEC-126 typically describes in-transit tampering, whereas here the parameter is included in the initial request body; however, no more specific CAPEC for mass-assignment IDOR exists in the CAPEC catalog."
}
],
"commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "AV:N \u2013 MISP is a network-accessible web application. AC:L \u2013 the attack requires only including an \u0027id\u0027 field in a normal module-results submission; no race condition or complex bypass is needed. AT:N \u2013 no prior user interaction or attack preparation beyond crafting the payload. PR:L \u2013 requires an authenticated user with permission to submit module results on an event (a common MISP role). UI:N \u2013 no victim interaction required. VC:L \u2013 the attacker can read the content of one specific report they target by id. VI:H \u2013 the attacker can overwrite all fields of the targeted report and change its event_id, fully compromising its integrity. VA:N \u2013 no availability impact. SC/SI/SA \u2013 no impact on adjacent systems; SI:H reflects the integrity compromise of the shared report data store.",
"fixSummary": "The fix adds an unset($report[\u0027id\u0027]) call in the EventReport processing loop within processModuleResultsData, immediately before the event_id assignment and save() call. This ensures that any client-supplied id field is stripped from the report data, forcing the ORM to perform an insert (new report) rather than an update (existing report), consistent with the existing behavior of the attribute and object loops in the same method.",
"generatedAt": "2026-09-21T12:19:38.677403Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 5
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
"patchSummary": "In app/Model/Event.php, within the foreach loop over $resolved_data[\u0027EventReport\u0027] in processModuleResultsData, a single line unset($report[\u0027id\u0027]); is inserted after $this-\u003eEventReport-\u003ecreate() and before $report[\u0027event_id\u0027] = $id. A four-line comment is added explaining that module-result import only creates reports and that stripping the client id prevents redirecting save() onto another event\u0027s report row. No other files or logic are modified.",
"patchTruncated": false,
"patches": [
{
"commit": "4c1a03b200fc75854879897c9cfc33a86b965d11",
"patchSha256": "1079aff9d4e4710ba6c4ea950bcbbe2597411bfe7065efbc1bc9a5587f87a6c9",
"source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
"subject": "fix: [security] Strip the client id from module-result event"
}
],
"source": "https://github.com/MISP/MISP/commit/4c1a03b20.patch",
"subject": "fix: [security] Strip the client id from module-result event",
"tagVersionBoundary": {
"commits_after_fix": 53,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.47",
"version": "2.5.47",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-639",
"rationale": "The attacker supplies an \u0027id\u0027 value in the module-results payload that the application uses as the primary key for the save() operation, redirecting the write to an object (report row) belonging to a different event. The user-controlled key bypasses the intended create-only semantics and grants unauthorized read/write access to another event\u0027s report."
},
{
"cweId": "CWE-472",
"rationale": "The \u0027id\u0027 field is assumed to be server-generated and immutable for new records, but the application accepts a client-supplied value and passes it directly to the ORM save() call, allowing the attacker to control which database row is affected."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20022"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "00000000-0000-4000-9000-000000000000",
"cveId": "CVE-2026-94374",
"datePublished": "2026-09-21T12:24:54.615296Z",
"dateReserved": "2026-09-21T12:25:00.527Z",
"dateUpdated": "2026-09-21T12:25:00.709103Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1-2026-20022"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-19997 (GCVE-0-2026-19997)
Vulnerability from cvelistv5 – Published: 2026-08-17 07:00 – Updated: 2026-08-17 15:17
VLAI
EPSS
VEX
Title
Webkul Bagisto Backend Sales RMA Endpoint requests authorization
Summary
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 15:17 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391198 | vdb-entry |
| https://vuldb.com/vuln/391198/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19997 | third-party-advisory |
| https://vuldb.com/submit/870358 | third-party-advisory |
| https://github.com/Mitchell45/PHP_Web_POCs/blob/m… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19997",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T15:17:04.304796Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:17:14.759Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*"
],
"modules": [
"Backend Sales RMA Endpoint"
],
"product": "Bagisto",
"vendor": "Webkul",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "affected",
"version": "2.4.1"
},
{
"status": "affected",
"version": "2.4.2"
},
{
"status": "affected",
"version": "2.4.3"
},
{
"status": "affected",
"version": "2.4.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitchell_45 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: \"The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T07:00:09.743Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391198 | Webkul Bagisto Backend Sales RMA Endpoint requests authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/391198"
},
{
"name": "VDB-391198 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391198/cti"
},
{
"name": "CVE-2026-19997 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19997"
},
{
"name": "Submit #870358 | Webkul Bagisto \u003c=2.4.4 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870358"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/11_18_english_vulnerability_report.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-16T20:10:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "Webkul Bagisto Backend Sales RMA Endpoint requests authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19997",
"datePublished": "2026-08-17T07:00:09.743Z",
"dateReserved": "2026-08-16T18:05:24.867Z",
"dateUpdated": "2026-08-17T15:17:14.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19994 (GCVE-0-2026-19994)
Vulnerability from cvelistv5 – Published: 2026-08-17 06:15 – Updated: 2026-08-19 14:13
VLAI
EPSS
VEX
Title
Webkul Bagisto Configuration Management execute authorization
Summary
A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:13 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391195 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391195/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19994 | third-party-advisory |
| https://vuldb.com/submit/870355 | third-party-advisory |
| https://github.com/Mitchell45/PHP_Web_POCs/blob/m… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19994",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:13:41.925353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:13:50.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*"
],
"modules": [
"Configuration Management"
],
"product": "Bagisto",
"vendor": "Webkul",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "affected",
"version": "2.4.1"
},
{
"status": "affected",
"version": "2.4.2"
},
{
"status": "affected",
"version": "2.4.3"
},
{
"status": "affected",
"version": "2.4.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch_45 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used. The vendor confirms: \"The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T06:15:08.262Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391195 | Webkul Bagisto Configuration Management execute authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391195"
},
{
"name": "VDB-391195 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391195/cti"
},
{
"name": "CVE-2026-19994 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19994"
},
{
"name": "Submit #870355 | Webkul Bagisto \u003c=2.4.4 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870355"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/31_33_english_vulnerability_report.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-16T20:10:36.000Z",
"value": "VulDB entry last update"
}
],
"title": "Webkul Bagisto Configuration Management execute authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19994",
"datePublished": "2026-08-17T06:15:08.262Z",
"dateReserved": "2026-08-16T18:05:13.265Z",
"dateUpdated": "2026-08-19T14:13:50.894Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19979 (GCVE-0-2026-19979)
Vulnerability from cvelistv5 – Published: 2026-08-17 03:30 – Updated: 2026-08-18 13:37
VLAI
EPSS
VEX
Title
GL.iNet XE3000 WebDAV Service MOVE authorization
Summary
A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist."
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 13:06 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391161 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391161/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19979 | third-party-advisory |
| https://vuldb.com/submit/873915 | third-party-advisory |
| https://github.com/gl-inet/CVE-issues/blob/main/4… | related |
Impacted products
17 products
| Vendor | Product | Version | |
|---|---|---|---|
| GL.iNet | A1300 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:* |
|
| GL.iNet | AX1800 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:* |
|
| GL.iNet | AXT1800 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE1400 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:be1400:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE3600 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:be3600:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE6500 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:be6500:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE9300 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:be9300:*:*:*:*:*:*:*:* |
|
| GL.iNet | BE10000 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:be10000:*:*:*:*:*:*:*:* |
|
| GL.iNet | E5800 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT2500 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT3000 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT3600BE |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:mt3600be:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT5000 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:mt5000:*:*:*:*:*:*:*:* |
|
| GL.iNet | MT6000 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:* |
|
| GL.iNet | X2000 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:x2000:*:*:*:*:*:*:*:* |
|
| GL.iNet | X3000 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:* |
|
| GL.iNet | XE3000 |
Affected:
4.0
Affected: 4.1 Affected: 4.2 Affected: 4.3 Affected: 4.4 Affected: 4.5 Affected: 4.6 Affected: 4.7 Affected: 4.8 cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19979",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:06:22.664205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:37:35.365Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "A1300",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "AX1800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "AXT1800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be1400:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "BE1400",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be3600:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "BE3600",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be6500:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "BE6500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be9300:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "BE9300",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:be10000:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "BE10000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:e5800:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "E5800",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "MT2500",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "MT3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt3600be:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "MT3600BE",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt5000:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "MT5000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "MT6000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:x2000:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "X2000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "X3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
},
{
"cpes": [
"cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*"
],
"modules": [
"WebDAV Service"
],
"product": "XE3000",
"vendor": "GL.iNet",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.3"
},
{
"status": "affected",
"version": "4.4"
},
{
"status": "affected",
"version": "4.5"
},
{
"status": "affected",
"version": "4.6"
},
{
"status": "affected",
"version": "4.7"
},
{
"status": "affected",
"version": "4.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "GLiNet (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: \"After our investigation, we have confirmed that the vulnerability described (...) does indeed exist.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T03:30:09.125Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391161 | GL.iNet XE3000 WebDAV Service MOVE authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391161"
},
{
"name": "VDB-391161 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391161/cti"
},
{
"name": "CVE-2026-19979 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19979"
},
{
"name": "Submit #873915 | GL.iNet Router 4.8.x Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/873915"
},
{
"tags": [
"related"
],
"url": "https://github.com/gl-inet/CVE-issues/blob/main/4.0.0/WebDAV%20Public-Share%20Destination%20Authorization%20Bypass.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-16T15:43:39.000Z",
"value": "VulDB entry last update"
}
],
"title": "GL.iNet XE3000 WebDAV Service MOVE authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19979",
"datePublished": "2026-08-17T03:30:09.125Z",
"dateReserved": "2026-08-16T13:38:11.037Z",
"dateUpdated": "2026-08-18T13:37:35.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19966 (GCVE-0-2026-19966)
Vulnerability from cvelistv5 – Published: 2026-08-17 00:15 – Updated: 2026-08-17 16:08
VLAI
EPSS
VEX
Title
CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization
Summary
A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 16:08 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391143 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391143/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19966 | third-party-advisory |
| https://vuldb.com/submit/873105 | third-party-advisory |
| https://github.com/4m3rr0r/PoCVulDb/issues/19 | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CodeCanyon | TimeCamp Integration for CRM |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3 Affected: 2.4 Affected: 2.5 Affected: 2.6 Affected: 2.7 Affected: 2.8 cpe:2.3:a:codecanyon:timecamp_integration_for_crm:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19966",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T16:08:07.943632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T16:08:32.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:codecanyon:timecamp_integration_for_crm:*:*:*:*:*:*:*:*"
],
"modules": [
"Contact Information Update"
],
"product": "TimeCamp Integration for CRM",
"vendor": "CodeCanyon",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4"
},
{
"status": "affected",
"version": "2.5"
},
{
"status": "affected",
"version": "2.6"
},
{
"status": "affected",
"version": "2.7"
},
{
"status": "affected",
"version": "2.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "4m3rr0r (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T00:15:09.037Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391143 | CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391143"
},
{
"name": "VDB-391143 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391143/cti"
},
{
"name": "CVE-2026-19966 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19966"
},
{
"name": "Submit #873105 | CodenPlug TimeCamp Integration for RISE CRM v2.8 Access Control",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/873105"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/4m3rr0r/PoCVulDb/issues/19"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-16T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-16T09:38:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19966",
"datePublished": "2026-08-17T00:15:09.037Z",
"dateReserved": "2026-08-16T07:32:53.742Z",
"dateUpdated": "2026-08-17T16:08:32.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19870 (GCVE-0-2026-19870)
Vulnerability from cvelistv5 – Published: 2026-08-14 12:08 – Updated: 2026-08-14 14:49 X_Open Source
VLAI
EPSS
VEX
Title
IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation
Summary
Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create payroll permission to create payroll records attributed to another company's employees, because the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 14:49 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Roskus/prospero-flow-crm/commi… | patch |
| https://secur0.com/en/cna/cve-list/cve-2026-19870… | technical-description |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Roskus | Prospero Flow CRM |
Affected:
0 , < 5.15.10
(semver)
cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:* |
Date Public
2026-08-14 12:02
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19870",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T14:49:01.838361Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T14:49:13.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Prospero Flow CRM",
"programFiles": [
"app/Http/Controllers/Payroll/PayrollIndexController.php",
"app/Http/Requests/PayrollRequest.php"
],
"repo": "https://github.com/Roskus/prospero-flow-crm",
"vendor": "Roskus",
"versions": [
{
"lessThan": "5.15.10",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.10",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Manuel Mart\u00ednez Casasola"
},
{
"lang": "en",
"type": "analyst",
"value": "Cristian Fern\u00e1ndez Cornejo"
},
{
"lang": "en",
"type": "analyst",
"value": "Xo\u00e1n M. Otero Jorge"
},
{
"lang": "en",
"type": "coordinator",
"value": "Secur0 CNA"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Gustavo Novaro"
}
],
"datePublic": "2026-08-14T12:02:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create payroll permission to create payroll records attributed to another company\u0027s employees, because the listing query is not scoped to the caller\u0027s company and the employee identifier is validated for global existence rather than company membership"
}
],
"value": "Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company in the instance, and users holding the create payroll permission to create payroll records attributed to another company\u0027s employees, because the listing query is not scoped to the caller\u0027s company and the employee identifier is validated for global existence rather than company membership"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T12:08:30.457Z",
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/Roskus/prospero-flow-crm/commit/59644f910b7d1aec7d1ac962b0354b3ec209977e"
},
{
"tags": [
"technical-description"
],
"url": "https://secur0.com/en/cna/cve-list/cve-2026-19870-idor-in-prospero-flow-crm-allows-cross-tenant-payroll-disclosure-and-creation"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to version 5.15.10 or higher. The fix is not included in any tagged release"
}
],
"value": "Upgrade to version 5.15.10 or higher. The fix is not included in any tagged release"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"assignerShortName": "Secur0",
"cveId": "CVE-2026-19870",
"datePublished": "2026-08-14T12:08:30.457Z",
"dateReserved": "2026-08-14T11:53:44.193Z",
"dateUpdated": "2026-08-14T14:49:13.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19869 (GCVE-0-2026-19869)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:35 – Updated: 2026-08-19 16:02
VLAI
EPSS
VEX
Title
Privilege Escalation via Dropped Field-Level @authentication
Summary
@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same operation type. When both a type-level @authentication (on Query/Mutation) and a field-level @authentication (on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement — such as an admin-role JWT claim (jwt: { roles_INCLUDES: "admin" }) — is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g. roles: ["user"]) is sufficient.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 19:09 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/neo4j/graphql/security/advisor… | third-party-advisory |
| https://neo4j.com/security/CVE-2026-19869 | vendor-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19869",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T19:09:25.351012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T19:09:31.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://registry.npmjs.org",
"defaultStatus": "unaffected",
"packageName": "@neo4j/graphql",
"product": "graphql",
"repo": "https://github.com/neo4j/graphql",
"vendor": "neo4j",
"versions": [
{
"lessThan": "7.6.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThan": "5.12.15",
"status": "affected",
"version": "5.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.4",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe application enables\u0026nbsp;\u003ccode\u003efeatures.authorization\u003c/code\u003e\u0026nbsp;and defines a root operation type (\u003ccode\u003eQuery\u003c/code\u003e/\u003ccode\u003eMutation\u003c/code\u003e) annotated with\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;that also contains one or more custom-resolver fields carrying their own, stricter\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;rule.\u003c/p\u003e"
}
],
"value": "The application enables\u00a0features.authorization\u00a0and defines a root operation type (Query/Mutation) annotated with\u00a0@authentication\u00a0that also contains one or more custom-resolver fields carrying their own, stricter\u00a0@authentication\u00a0rule."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.6.0",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.12.15",
"versionStartIncluding": "5.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.6.4",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ccode\u003e@neo4j/graphql\u003c/code\u003e\u0026nbsp;from\u0026nbsp;\u003ccode\u003e5.2.0\u003c/code\u003e\u0026nbsp;until the patched versions fails to enforce field-level\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;rules on root custom-resolver fields when a type-level\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;rule is also present on the same operation type. When both a type-level\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;(on\u0026nbsp;\u003ccode\u003eQuery\u003c/code\u003e/\u003ccode\u003eMutation\u003c/code\u003e) and a field-level\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;(on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement \u2014 such as an admin-role JWT claim (\u003ccode\u003ejwt: { roles_INCLUDES: \"admin\" }\u003c/code\u003e) \u2014 is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g.\u0026nbsp;\u003ccode\u003eroles: [\"user\"]\u003c/code\u003e) is sufficient."
}
],
"value": "@neo4j/graphql\u00a0from\u00a05.2.0\u00a0until the patched versions fails to enforce field-level\u00a0@authentication\u00a0rules on root custom-resolver fields when a type-level\u00a0@authentication\u00a0rule is also present on the same operation type. When both a type-level\u00a0@authentication\u00a0(on\u00a0Query/Mutation) and a field-level\u00a0@authentication\u00a0(on a root custom-resolver field within that type) are declared, only the type-level rule is evaluated and the field-level rule is silently discarded. As a result a stricter per-field requirement \u2014 such as an admin-role JWT claim (jwt: { roles_INCLUDES: \"admin\" }) \u2014 is never checked, and any client that satisfies the coarser type-level requirement can invoke the more-restricted field. No token forgery is involved: a legitimately issued, correctly signed non-admin token (e.g.\u00a0roles: [\"user\"]) is sufficient."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:02:04.528Z",
"orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
"shortName": "Neo4j"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/neo4j/graphql/security/advisories/GHSA-82m8-p9px-c3x5"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://neo4j.com/security/CVE-2026-19869"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade the library to\u0026nbsp;\u003ccode\u003e7.6.0\u003c/code\u003e+ or\u0026nbsp;\u003ccode\u003e5.12.15\u003c/code\u003e+. v6 is end-of-life and will not receive a fix. v5 releases prior to\u0026nbsp;\u003ccode\u003e5.2.0\u003c/code\u003e\u0026nbsp;are not affected.\u003c/p\u003e\u003cp\u003eFor users who cannot upgrade immediately: do not combine a type-level\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;with a field-level\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;on the same root operation type. Because the type-level annotation is what shadows the field-level rule, removing it restores correct enforcement \u2014 instead apply a complete\u0026nbsp;\u003ccode\u003e@authentication\u003c/code\u003e\u0026nbsp;directive to each root field individually, including the full stricter rule on the sensitive field. Alternatively, enforce the stricter requirement inside the custom resolver\u0027s own code.\u003c/p\u003e"
}
],
"value": "Upgrade the library to\u00a07.6.0+ or\u00a05.12.15+. v6 is end-of-life and will not receive a fix. v5 releases prior to\u00a05.2.0\u00a0are not affected.\n\n\n\nFor users who cannot upgrade immediately: do not combine a type-level\u00a0@authentication\u00a0with a field-level\u00a0@authentication\u00a0on the same root operation type. Because the type-level annotation is what shadows the field-level rule, removing it restores correct enforcement \u2014 instead apply a complete\u00a0@authentication\u00a0directive to each root field individually, including the full stricter rule on the sensitive field. Alternatively, enforce the stricter requirement inside the custom resolver\u0027s own code."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Privilege Escalation via Dropped Field-Level @authentication",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
"assignerShortName": "Neo4j",
"cveId": "CVE-2026-19869",
"datePublished": "2026-08-18T16:35:19.878Z",
"dateReserved": "2026-08-14T11:22:26.042Z",
"dateUpdated": "2026-08-19T16:02:04.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19838 (GCVE-0-2026-19838)
Vulnerability from cvelistv5 – Published: 2026-08-14 16:00 – Updated: 2026-08-14 16:34
VLAI
EPSS
VEX
Title
Webkul Bagisto Backend Reporting Endpoint sales authorization
Summary
A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:34 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389976 | vdb-entry |
| https://vuldb.com/vuln/389976/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19838 | third-party-advisory |
| https://vuldb.com/submit/870353 | third-party-advisory |
| https://github.com/Mitchell45/PHP_Web_POCs/blob/m… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19838",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:34:32.353917Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:34:46.974Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*"
],
"modules": [
"Backend Reporting Endpoint"
],
"product": "Bagisto",
"vendor": "Webkul",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "affected",
"version": "2.4.1"
},
{
"status": "affected",
"version": "2.4.2"
},
{
"status": "affected",
"version": "2.4.3"
},
{
"status": "affected",
"version": "2.4.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitch_45 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: \"The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:00:06.787Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389976 | Webkul Bagisto Backend Reporting Endpoint sales authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389976"
},
{
"name": "VDB-389976 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389976/cti"
},
{
"name": "CVE-2026-19838 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19838"
},
{
"name": "Submit #870353 | Webkul Bagisto \u003c=2.4.4 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870353"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/19_30_english_vulnerability_report.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T09:49:54.000Z",
"value": "VulDB entry last update"
}
],
"title": "Webkul Bagisto Backend Reporting Endpoint sales authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19838",
"datePublished": "2026-08-14T16:00:06.787Z",
"dateReserved": "2026-08-14T07:44:30.148Z",
"dateUpdated": "2026-08-14T16:34:46.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19836 (GCVE-0-2026-19836)
Vulnerability from cvelistv5 – Published: 2026-08-14 15:30 – Updated: 2026-08-18 13:38
VLAI
EPSS
VEX
Title
Webkul Bagisto Backend Customer Detail Feature view authorization
Summary
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 13:33 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389974 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389974/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19836 | third-party-advisory |
| https://vuldb.com/submit/870344 | third-party-advisory |
| https://github.com/Mitchell45/PHP_Web_POCs/blob/m… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19836",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T13:33:28.733168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:38:58.875Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*"
],
"modules": [
"Backend Customer Detail Feature"
],
"product": "Bagisto",
"vendor": "Webkul",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "affected",
"version": "2.4.1"
},
{
"status": "affected",
"version": "2.4.2"
},
{
"status": "affected",
"version": "2.4.3"
},
{
"status": "affected",
"version": "2.4.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mitchell45 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: \"The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T15:30:07.386Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389974 | Webkul Bagisto Backend Customer Detail Feature view authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389974"
},
{
"name": "VDB-389974 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389974/cti"
},
{
"name": "CVE-2026-19836 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19836"
},
{
"name": "Submit #870344 | Webkul Bagisto \u003c=2.4.4 Authorization Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/870344"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/02_english_vulnerability_report.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-14T09:49:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "Webkul Bagisto Backend Customer Detail Feature view authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19836",
"datePublished": "2026-08-14T15:30:07.386Z",
"dateReserved": "2026-08-14T07:44:22.437Z",
"dateUpdated": "2026-08-18T13:38:58.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.