Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
15972 vulnerabilities reference this CWE, most recent first.
CVE-2026-72791 (GCVE-0-2026-72791)
Vulnerability from cvelistv5 – Published: 2026-08-12 19:07 – Updated: 2026-08-14 16:52
VLAI
EPSS
VEX
Title
SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews
Summary
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.
Severity
5.8 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 20:45 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/siyuan-note/siyuan/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/siyuan-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| siyuan-note | siyuan |
Affected:
0 , < 3.7.4
(semver)
Unaffected: 3.7.4 (semver) cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:* |
Date Public
2026-07-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72791",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T20:45:54.455167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T20:55:15.173Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
"product": "siyuan",
"vendor": "siyuan-note",
"versions": [
{
"lessThan": "3.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.7.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shirshakopencti"
}
],
"datePublic": "2026-07-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure \u2014 every view\u0027s name, icon, layout type, and per-field Hidden flag \u2014 for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:52:01.130Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-57v5-wqx3-cgj4)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4"
},
{
"name": "VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewfieldviews"
}
],
"title": "SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72791",
"datePublished": "2026-08-12T19:07:39.634Z",
"dateReserved": "2026-08-10T15:10:15.963Z",
"dateUpdated": "2026-08-14T16:52:01.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72790 (GCVE-0-2026-72790)
Vulnerability from cvelistv5 – Published: 2026-08-12 19:07 – Updated: 2026-08-14 16:52
VLAI
EPSS
VEX
Title
SiYuan before v3.7.4 Information Disclosure via getNotebookInfo
Summary
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 19:36 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/siyuan-note/siyuan/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/siyuan-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| siyuan-note | siyuan |
Affected:
0 , < 3.7.4
(semver)
Unaffected: 3.7.4 (semver) cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:* |
Date Public
2026-07-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72790",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T19:36:45.772066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T19:37:57.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-74pj-6g7r-j55c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
"product": "siyuan",
"vendor": "siyuan-note",
"versions": [
{
"lessThan": "3.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.7.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shirshakopencti"
}
],
"datePublic": "2026-07-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:52:00.450Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-74pj-6g7r-j55c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-74pj-6g7r-j55c"
},
{
"name": "VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getNotebookInfo",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getnotebookinfo"
}
],
"title": "SiYuan before v3.7.4 Information Disclosure via getNotebookInfo",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72790",
"datePublished": "2026-08-12T19:07:38.949Z",
"dateReserved": "2026-08-10T15:10:15.963Z",
"dateUpdated": "2026-08-14T16:52:00.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72789 (GCVE-0-2026-72789)
Vulnerability from cvelistv5 – Published: 2026-08-12 19:07 – Updated: 2026-08-14 22:00
VLAI
EPSS
VEX
Title
SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
Summary
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
Severity
8.6 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 21:59 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/siyuan-note/siyuan/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/siyuan-befor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| siyuan-note | siyuan |
Affected:
0 , < 3.7.4
(semver)
Unaffected: 3.7.4 (semver) cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:* |
Date Public
2026-07-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72789",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T21:59:58.998454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T22:00:32.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
"product": "siyuan",
"vendor": "siyuan-note",
"versions": [
{
"lessThan": "3.7.4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.7.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.7.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "shirshakopencti"
}
],
"datePublic": "2026-07-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:59.774Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v684-q882-jgmq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq"
},
{
"name": "VulnCheck Advisory: SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks"
}
],
"title": "SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72789",
"datePublished": "2026-08-12T19:07:38.239Z",
"dateReserved": "2026-08-10T15:10:15.963Z",
"dateUpdated": "2026-08-14T22:00:32.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72759 (GCVE-0-2026-72759)
Vulnerability from cvelistv5 – Published: 2026-08-10 14:19 – Updated: 2026-08-10 17:01
VLAI
EPSS
VEX
Title
cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion
Summary
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:01 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/cti-transmute/commit/88dc… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| misp | cti-transmute |
Affected:
0 , ≤ 1.4.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72759",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:01:47.836772Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:01:56.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "cti-transmute",
"repo": "https://github.com/MISP/cti-transmute",
"vendor": "misp",
"versions": [
{
"lessThanOrEqual": "1.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Christian Studer"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns \u003ccode\u003eNone\u003c/code\u003e. The previous logic only denied access when the conversion object existed \u003cem\u003eand\u003c/em\u003e the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission\u003cp\u003e\u003c/p\u003e"
}
],
"value": "In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object existed and the visibility check failed. As a result, deleted conversions bypassed the authorization check and their retained history input/output could be disclosed to a user able to request the corresponding history entry. The July 22, 2026 commit changes the logic to deny access whenever the conversion is missing or the requester lacks permission"
}
],
"impacts": [
{
"capecId": "CAPEC-87",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-87 Forceful Browsing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T14:19:13.478Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/MISP/cti-transmute/commit/88dc65f0117cf7a120f6252674c529e7b9c9b8c3"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-72759",
"datePublished": "2026-08-10T14:19:13.478Z",
"dateReserved": "2026-08-10T14:18:43.725Z",
"dateUpdated": "2026-08-10T17:01:56.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72737 (GCVE-0-2026-72737)
Vulnerability from cvelistv5 – Published: 2026-08-10 17:47 – Updated: 2026-08-13 15:58
VLAI
EPSS
VEX
Title
Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups
Summary
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization's S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker's service host, read that organization's backup objects, or redirect and poison backups across tenant boundaries.
Severity
9.6 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:58 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Dokploy/dokploy/security/advis… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72737",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:58:07.740018Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:58:15.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-56qv-89fq-3h2q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "dokploy",
"vendor": "Dokploy",
"versions": [
{
"status": "affected",
"version": "\u003c= 0.29.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup permissions for a service in one organization can cause another organization\u0027s S3 accessKey and secretAccessKey to be materialized by packages/server/src/utils/backups/utils.ts getS3Credentials on the attacker\u0027s service host, read that organization\u0027s backup objects, or redirect and poison backups across tenant boundaries."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:47:50.363Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-56qv-89fq-3h2q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Dokploy/dokploy/security/advisories/GHSA-56qv-89fq-3h2q"
}
],
"source": {
"advisory": "GHSA-56qv-89fq-3h2q",
"discovery": "UNKNOWN"
},
"title": "Dokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant\u0027s S3 credentials and backups"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72737",
"datePublished": "2026-08-10T17:47:50.363Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-13T15:58:15.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72732 (GCVE-0-2026-72732)
Vulnerability from cvelistv5 – Published: 2026-08-10 17:18 – Updated: 2026-08-13 17:37
VLAI
EPSS
VEX
Title
Discourse: Templates endpoint exposes hidden tag names
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 17:37 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/25e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c9b… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f21… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/f41… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72732",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T17:37:25.435786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:37:34.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags through the request Guardian. The serializer did not respect tag group permissions, allowing users to see tags they were not permitted to view. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:18:00.524Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-xrgc-52m8-82hm"
},
{
"name": "https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/25e9d55b4c652b8dc1c90f44c40c8f3fec77748c"
},
{
"name": "https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c9b431b3b75727f7132ec231142371d203a6124b"
},
{
"name": "https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f216f258bd473e6299c6aef7b6130e7db90116c0"
},
{
"name": "https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/f41e71b645eb60cc263e7a1de22251028115abf1"
}
],
"source": {
"advisory": "GHSA-xrgc-52m8-82hm",
"discovery": "UNKNOWN"
},
"title": "Discourse: Templates endpoint exposes hidden tag names"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72732",
"datePublished": "2026-08-10T17:18:00.524Z",
"dateReserved": "2026-08-10T13:48:09.546Z",
"dateUpdated": "2026-08-13T17:37:34.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72723 (GCVE-0-2026-72723)
Vulnerability from cvelistv5 – Published: 2026-08-10 15:56 – Updated: 2026-08-10 21:11
VLAI
EPSS
VEX
Title
Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 19:02 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/024… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/034… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/900… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/da8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72723",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T19:02:43.987708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T21:11:02.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags serializes tags from SiteSetting.default_navigation_menu_tags without applying DiscourseTagging.filter_visible for the anonymous viewer. An unauthenticated user can retrieve restricted tag names and descriptions through /site.json when those tags are limited by inaccessible categories, category tag groups, or tag-group permissions. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:56:53.723Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4p6q-h74v-5j7p"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/0248e9ca82d0493037a9ca04d73904ccfad795f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0248e9ca82d0493037a9ca04d73904ccfad795f9"
},
{
"name": "https://github.com/discourse/discourse/commit/03444ddb74d535dda557350f4c5800a6ec2669d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/03444ddb74d535dda557350f4c5800a6ec2669d7"
},
{
"name": "https://github.com/discourse/discourse/commit/900f51c147913f667e64484c2f2dd48c723314ac",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/900f51c147913f667e64484c2f2dd48c723314ac"
},
{
"name": "https://github.com/discourse/discourse/commit/da84c677213cac3b024e753f180f45472b89efde",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/da84c677213cac3b024e753f180f45472b89efde"
}
],
"source": {
"advisory": "GHSA-4p6q-h74v-5j7p",
"discovery": "UNKNOWN"
},
"title": "Discourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72723",
"datePublished": "2026-08-10T15:56:53.723Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-10T21:11:02.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72722 (GCVE-0-2026-72722)
Vulnerability from cvelistv5 – Published: 2026-08-10 15:54 – Updated: 2026-08-13 17:46
VLAI
EPSS
VEX
Title
Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 17:46 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42092 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42093 | x_refsource_MISC |
| https://github.com/discourse/discourse/pull/42094 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/45a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/7d7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/836… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e54… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T17:46:20.910196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T17:46:27.779Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T15:54:35.907Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/pull/42092",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42092"
},
{
"name": "https://github.com/discourse/discourse/pull/42093",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42093"
},
{
"name": "https://github.com/discourse/discourse/pull/42094",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42094"
},
{
"name": "https://github.com/discourse/discourse/commit/45abd925e46e8be40d2d047bced26628f26e4e31",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/45abd925e46e8be40d2d047bced26628f26e4e31"
},
{
"name": "https://github.com/discourse/discourse/commit/7d7ce546ac86e24a6512b321ace69fc52fe37bf4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/7d7ce546ac86e24a6512b321ace69fc52fe37bf4"
},
{
"name": "https://github.com/discourse/discourse/commit/836a251d54a1004fb1c463a7d299b933b176191f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/836a251d54a1004fb1c463a7d299b933b176191f"
},
{
"name": "https://github.com/discourse/discourse/commit/e54ba27eacee0f14f315e510e287e7ac2e4bdb1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e54ba27eacee0f14f315e510e287e7ac2e4bdb1a"
}
],
"source": {
"advisory": "GHSA-4fx9-5m29-83p4",
"discovery": "UNKNOWN"
},
"title": "Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72722",
"datePublished": "2026-08-10T15:54:35.907Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-13T17:46:27.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72692 (GCVE-0-2026-72692)
Vulnerability from cvelistv5 – Published: 2026-08-10 11:59 – Updated: 2026-08-10 18:21
VLAI
EPSS
VEX
Title
OpenSignLabs opensignserver - Missing Authorization
Summary
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/OpenSignLabs/OpenSign | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenSignLabs | opensignserver |
Affected:
0 , ≤ 2.37.0
(semver)
|
Date Public
2026-08-10 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72692",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T15:35:02.707376Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T18:21:58.204Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "opensignserver",
"vendor": "OpenSignLabs",
"versions": [
{
"lessThanOrEqual": "2.37.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov (Mahadsec)"
}
],
"datePublic": "2026-08-10T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller\u0027s identity, enabling workflow termination and evidentiary record falsification against any accessible document.\u003c/p\u003e"
}
],
"value": "A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller\u0027s identity, enabling workflow termination and evidentiary record falsification against any accessible document."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:59:14.935Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"name": "OpenSign GitHub Repository",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/OpenSignLabs/OpenSign"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "OpenSignLabs opensignserver - Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-72692",
"datePublished": "2026-08-10T11:59:14.935Z",
"dateReserved": "2026-08-10T11:55:39.471Z",
"dateUpdated": "2026-08-10T18:21:58.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72681 (GCVE-0-2026-72681)
Vulnerability from cvelistv5 – Published: 2026-08-13 19:11 – Updated: 2026-08-14 03:56
VLAI
EPSS
VEX
Title
Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure
Summary
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 00:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:56:10.063Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Kibana",
"vendor": "Elastic",
"versions": [
{
"lessThanOrEqual": "9.4.3",
"status": "affected",
"version": "9.4.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eKibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature\u0027s functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read.\u003c/p\u003e"
}
],
"value": "Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature\u0027s functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T19:11:09.099Z",
"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"shortName": "elastic"
},
"references": [
{
"url": "https://discuss.elastic.co/t/kibana-9-4-4-security-update-esa-2026-83/389534"
}
],
"source": {
"discovery": "Elastic"
},
"title": "Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure",
"x_generator": {
"engine": "Elastic CVE Publisher 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"assignerShortName": "elastic",
"cveId": "CVE-2026-72681",
"datePublished": "2026-08-13T19:11:09.099Z",
"dateReserved": "2026-08-10T11:17:58.730Z",
"dateUpdated": "2026-08-14T03:56:10.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.