Vulnerability-Lookup

GHSA-XHXV-X276-MMHP

Vulnerability from github – Published: 2026-09-02 15:34 – Updated: 2026-09-02 15:34

Details

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

Severity

3.8 (Low)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-14326"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T15:17:37Z",
    "severity": "LOW"
  },
  "details": "The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.",
  "id": "GHSA-xhxv-x276-mmhp",
  "modified": "2026-09-02T15:34:49Z",
  "published": "2026-09-02T15:34:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14326"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/0e12e0d0-fcf1-4dfd-bbf3-7647fe231b26"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-XJ53-RHQX-X9X6

Vulnerability from github – Published: 2022-10-13 12:00 – Updated: 2025-05-15 15:31

Details

In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-2828"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-13T05:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In affected versions of Octopus Server it is possible to reveal information about teams via the API due to an Insecure Direct Object Reference (IDOR) vulnerability",
  "id": "GHSA-xj53-rhqx-x9x6",
  "modified": "2025-05-15T15:31:07Z",
  "published": "2022-10-13T12:00:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2828"
    },
    {
      "type": "WEB",
      "url": "https://advisories.octopus.com/post/2022/sa2022-19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-XJ6J-6JHQ-42GG

Vulnerability from github – Published: 2026-08-26 18:31 – Updated: 2026-08-28 18:31

Details

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target.

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-81031"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-26T16:16:45Z",
    "severity": "HIGH"
  },
  "details": "IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and never compares the two. The route is mounted behind the administrator token check only, so any valid administrator session is sufficient, and the sole ownership-like guard in the handler rejects a single hardcoded demo address. A caller can therefore set an arbitrary password on any other administrator account and sign in as it. The read handler in the same controller directory accepts an identifier the same way, which supplies the identifiers needed to pick a target.",
  "id": "GHSA-xj6j-6jhq-42gg",
  "modified": "2026-08-28T18:31:23Z",
  "published": "2026-08-26T18:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81031"
    },
    {
      "type": "WEB",
      "url": "https://github.com/idurar/idurar-erp-crm/issues/1470"
    },
    {
      "type": "WEB",
      "url": "https://github.com/idurar/idurar-erp-crm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/idurar/idurar-erp-crm/blob/4.1.0/backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/idurar/idurar-erp-crm/blob/v4.1.0/backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/idurar-erp-crm-through-4.1.1-account-takeover-via-unverified-identifier-on-password-update"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-XJJ9-V7HQ-9HC8

Vulnerability from github – Published: 2026-10-12 15:32 – Updated: 2026-10-12 15:32

Details

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim's formKey, injecting attacker-chosen fields onto the victim's public fill page.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-109165"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-12T13:17:28Z",
    "severity": "MODERATE"
  },
  "details": "TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users\u0027 forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form and later elements reference a victim\u0027s formKey, injecting attacker-chosen fields onto the victim\u0027s public fill page.",
  "id": "GHSA-xjj9-v7hq-9hc8",
  "modified": "2026-10-12T15:32:13Z",
  "published": "2026-10-12T15:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109165"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/tduck/poc_form_item_batch_create_cross_form.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TDuckCloud/tduck-survey-form/blob/43ffa9c993e38936fc4de7d8e5aee82bbaa19502/tduck-api/src/main/java/com/tduck/cloud/api/web/controller/UserFormController.java#L327-L336"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/tduck-survey-form-through-6.0-authorization-bypass-via-user-controlled-form-key-in-post-user-form-item-batch-create"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-XJQ6-RQGG-X5J7

Vulnerability from github – Published: 2026-09-29 21:33 – Updated: 2026-09-29 21:33

Details

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-102876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-29T20:17:18Z",
    "severity": "HIGH"
  },
  "details": "SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant\u0027s namespace and database to read, create, and modify records across tenant boundaries.",
  "id": "GHSA-xjq6-rqgg-x5j7",
  "modified": "2026-09-29T21:33:25Z",
  "published": "2026-09-29T21:33:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-vx2p-7hhm-wv62"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102876"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/commit/5000e233b4a8b96689c82715c172061dcf711d31"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/blob/v3.2.4/surrealdb/server/src/ntw/auth.rs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/releases/tag/v3.3.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-cross-tenant-access-via-headers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-XM3P-GGHG-F4V9

Vulnerability from github – Published: 2026-08-05 09:31 – Updated: 2026-08-06 18:30

Details

The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.

Severity

2.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-16746"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T07:16:36Z",
    "severity": "LOW"
  },
  "details": "The MultiVendorX  WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors\u0027 commission and financial data.",
  "id": "GHSA-xm3p-gghg-f4v9",
  "modified": "2026-08-06T18:30:34Z",
  "published": "2026-08-05T09:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16746"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/721033a0-b0bb-4a64-a99a-12ac416b20fd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-XM42-MHFF-286M

Vulnerability from github – Published: 2026-10-16 00:31 – Updated: 2026-10-16 00:31

Details

Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants' usernames, full names and email addresses.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-111345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-15T22:19:31Z",
    "severity": "MODERATE"
  },
  "details": "Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation\u0027s id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant checks, to obtain full message history plus participants\u0027 usernames, full names and email addresses.",
  "id": "GHSA-xm42-mhff-286m",
  "modified": "2026-10-16T00:31:57Z",
  "published": "2026-10-16T00:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111345"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polonel/trudesk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polonel/trudesk/blob/v1.2.11/src/controllers/api/v1/messages.js#L255-L308"
    },
    {
      "type": "WEB",
      "url": "https://github.com/polonel/trudesk/blob/v1.2.11/src/models/chat/message.js#L70-L101"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@hieuPenguinnn/trudesk-conversation-messages-idor"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/trudesk-through-1.2.11-authorization-bypass-via-get-api-v1-messages-conversation-id"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-XM43-3M56-W3WF

Vulnerability from github – Published: 2026-08-04 21:57 – Updated: 2026-08-04 21:57

Summary

Ghost: Paid gift memberships obtainable at minimal cost via the donations feature

Details

Impact

A vulnerability in Ghost's public donation checkout flow allowed an unauthenticated attacker to obtain full paid gift memberships for a minimal payment. No customer or member data was exposed, and the issue could not be used to steal money from a site or its members.

Vulnerable versions

This vulnerability is present in Ghost from v6.27.0 up to v6.43.1.

Patches

v6.44.0 contains a fix for this issue.

How to update

For self-hosters using Docker, find Docker’s official Ghost image on Docker Hub and follow the documentation on updating a Docker-based Ghost instance.

For self-hosters using Ghost-CLI, see the documentation for updating Ghost to the latest version.

Workarounds

If upgrading immediately is not possible, you can remove the vulnerable checkout path by disabling the donations feature in Ghost Admin under Settings → Membership → Tips & donations until the upgrade is applied.

References

Ghost thanks sane100400 and p4p3r for disclosing this vulnerability responsibly.

For more information

If you have any questions or comments about this advisory, email Ghost at security@ghost.org.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "ghost"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.27.0"
            },
            {
              "fixed": "6.44.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59817"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-472",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-04T21:57:48Z",
    "nvd_published_at": "2026-07-09T18:16:57Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nA vulnerability in Ghost\u0027s public donation checkout flow allowed an unauthenticated attacker to obtain full paid gift memberships for a minimal payment. No customer or member data was exposed, and the issue could not be used to steal money from a site or its members.\n\n### Vulnerable versions\n\nThis vulnerability is present in Ghost from [v6.27.0](https://github.com/TryGhost/Ghost/releases/tag/v6.27.0) up to [v6.43.1](https://github.com/TryGhost/Ghost/releases/tag/v6.43.1).\n\n### Patches\n\n[v6.44.0](https://github.com/TryGhost/Ghost/releases/tag/v6.44.0) contains a fix for this issue. \n\n### How to update\n\nFor self-hosters using Docker, find [Docker\u2019s official Ghost image on Docker Hub](https://hub.docker.com/_/ghost) and follow the documentation on [updating a Docker-based Ghost instance](https://docs.ghost.org/install/docker#updating-ghost).\n\nFor self-hosters using Ghost-CLI, see the documentation for [updating Ghost to the latest version](https://docs.ghost.org/update).\n\n### Workarounds\n\nIf upgrading immediately is not possible, you can remove the vulnerable checkout path by disabling the donations feature in Ghost Admin under Settings \u2192 Membership \u2192 Tips \u0026 donations until the upgrade is applied.\n\n### References\n\nGhost thanks sane100400 and [p4p3r](https://hackerone.com/p4p3r_hak) for disclosing this vulnerability responsibly.\n\n### For more information\n\nIf you have any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).",
  "id": "GHSA-xm43-3m56-w3wf",
  "modified": "2026-08-04T21:57:48Z",
  "published": "2026-08-04T21:57:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/Ghost/security/advisories/GHSA-xm43-3m56-w3wf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59817"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/Ghost/pull/28351"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/Ghost/pull/28352"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/Ghost/commit/cab716cd015ac04b7ee50c7a405478d97bc7b1e0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/TryGhost/Ghost/commit/ee7b991b466a7849c70f9d1caed8e491ee4113c6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/TryGhost/Ghost"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ghost: Paid gift memberships obtainable at minimal cost via the donations feature"
}

GHSA-XMFR-M52W-M2HX

Vulnerability from github – Published: 2026-06-30 15:30 – Updated: 2026-08-05 18:31

Details

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-14209"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-30T13:17:10Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was discovered in Keycloak\u0027s Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific \"brute-force-user\" endpoint to access a user\u0027s full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required \"view\" permission for that specific user when using this particular search path.",
  "id": "GHSA-xmfr-m52w-m2hx",
  "modified": "2026-08-05T18:31:22Z",
  "published": "2026-06-30T15:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14209"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:50846"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:50847"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:50848"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:50849"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14209"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494837"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-XMVG-335G-X44Q

Vulnerability from github – Published: 2024-07-18 15:22 – Updated: 2024-07-18 15:22

Summary

The OpenSearch reporting plugin improperly controls tenancy access to reporting resources

Details

Summary

An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.

Impact

The lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user's private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.

Impacted versions <= 2.13

Patches

The patches are included in OpenSearch 2.14

Workarounds

None

References

OpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html

The latest version of OpenSearch is available for download at https://opensearch.org/downloads.html

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.opensearch.plugin:opensearch-reports-scheduler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.14.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39900"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-18T15:22:02Z",
    "nvd_published_at": "2024-07-09T22:15:03Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nAn issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed.\n\n### Impact\n\nThe lack of proper access control validation for private tenant resources in the OpenSearch observability and reporting plugins can lead to unintended data access. If an authorized user with observability or reporting roles is aware of another user\u0027s private tenant resource ID, such as a notebook, they can potentially read, modify, or take ownership of that resource, despite not being the original author, thus impacting the confidentiality and integrity of private tenant resources. The impact is confined to private tenant resources, where authorized users may gain inappropriate visibility into data intended to be private from other users within the same OpenSearch instance, potentially violating the intended separation of access. This issue does not alter the scope of access but highlights a flaw in the existing access control mechanisms.\n\nImpacted versions \u003c= 2.13\n\n### Patches\n\nThe patches are included in OpenSearch 2.14\n\n### Workarounds\n\nNone\n\n### References\n\nOpenSearch 2.14 is available for download at https://opensearch.org/versions/opensearch-2-14-0.html\n\nThe latest version of OpenSearch is available for download at https://opensearch.org/downloads.html",
  "id": "GHSA-xmvg-335g-x44q",
  "modified": "2024-07-18T15:22:03Z",
  "published": "2024-07-18T15:22:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/reporting/security/advisories/GHSA-xmvg-335g-x44q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39900"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opensearch-project/reporting/commit/2403014c57ee63268e83d919db3334b676a8c992"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/opensearch-project/reporting"
    },
    {
      "type": "WEB",
      "url": "https://opensearch.org/versions/opensearch-2-14-0.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "The OpenSearch reporting plugin improperly controls tenancy access to reporting resources"
}

CWE-639

Authorization Bypass Through User-Controlled Key

GHSA-XHXV-X276-MMHP

GHSA-XJ53-RHQX-X9X6

GHSA-XJ6J-6JHQ-42GG

GHSA-XJJ9-V7HQ-9HC8

GHSA-XJQ6-RQGG-X5J7

GHSA-XM3P-GGHG-F4V9

GHSA-XM42-MHFF-286M

GHSA-XM43-3M56-W3WF

Impact

Vulnerable versions

Patches

How to update

Workarounds

References

For more information

GHSA-XMFR-M52W-M2HX

GHSA-XMVG-335G-X44Q

Summary

Impact

Patches

Workarounds

References

Mitigation

Mitigation

Mitigation