Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7482 vulnerabilities reference this CWE, most recent first.
CVE-2026-112047 (GCVE-0-2026-112047)
Vulnerability from cvelistv5 – Published: 2026-10-18 12:19 – Updated: 2026-10-18 12:19
VLAI
EPSS
VEX
Title
OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
Summary
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources.
Severity
5.4 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OneUptime/oneuptime/security/a… | vendor-advisory |
| https://github.com/OneUptime/oneuptime/commit/264… | patch |
| https://github.com/OneUptime/oneuptime/releases/t… | release-notes |
| https://github.com/OneUptime/oneuptime/blob/14.0.… | technical-description |
| https://www.vulncheck.com/advisories/oneuptime-14… | third-party-advisory |
Impacted products
Date Public
2026-10-18 04:53
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/OneUptime/oneuptime",
"product": "oneuptime",
"repo": "https://github.com/OneUptime/oneuptime",
"vendor": "OneUptime",
"versions": [
{
"lessThan": "14.0.69",
"status": "affected",
"version": "14.0.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*",
"versionEndExcluding": "14.0.69",
"versionStartIncluding": "14.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-18T04:53:37.000Z",
"descriptions": [
{
"lang": "en",
"value": "OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset, kubectl plan approval and incident AI conversation features to learn agent RBAC permissions, disconnect agents, approve kubectl changes, or run commands on unauthorized resources."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T12:19:36.162Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8fph-9j9f-xxgc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-8fph-9j9f-xxgc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/OneUptime/oneuptime/commit/264e1ba13149cbd4c80cb22f2177b405886b0452"
},
{
"name": "oneuptime 14.0.69 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/OneUptime/oneuptime/releases/tag/14.0.69"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/OneUptime/oneuptime/blob/14.0.68/packages/Common/Server/API/KubernetesClusterAiAccessAPI.ts#L188-L207"
},
{
"name": "VulnCheck Advisory: OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/oneuptime-14.0.2-before-14.0.69-incorrect-authorization-in-kubernetes-ai-actions"
}
],
"title": "OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112047",
"datePublished": "2026-10-18T12:19:36.162Z",
"dateReserved": "2026-10-18T11:48:33.045Z",
"dateUpdated": "2026-10-18T12:19:36.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112001 (GCVE-0-2026-112001)
Vulnerability from cvelistv5 – Published: 2026-10-18 11:38 – Updated: 2026-10-18 11:38
VLAI
EPSS
VEX
Title
ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
Summary
ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/projectsend/projectsend/securi… | vendor-advisory |
| https://github.com/projectsend/projectsend/commit… | patch |
| https://github.com/projectsend/projectsend/releas… | release-notes |
| https://github.com/projectsend/projectsend/blob/v… | technical-description |
| https://www.vulncheck.com/advisories/projectsend-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProjectSend | ProjectSend |
Affected:
2.0.0 , < 2.7.0
(semver)
cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:* |
Date Public
2026-10-07 02:39
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/projectsend/projectsend",
"product": "ProjectSend",
"repo": "https://github.com/projectsend/projectsend",
"vendor": "ProjectSend",
"versions": [
{
"lessThan": "2.7.0",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.0",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "WHS4th Team TokenManiZo"
}
],
"datePublic": "2026-10-07T02:39:58.000Z",
"descriptions": [
{
"lang": "en",
"value": "ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner\u0027s credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner\u0027s full role permissions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:38:26.451Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-j5cp-r8pr-m5cr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/projectsend/projectsend/security/advisories/GHSA-j5cp-r8pr-m5cr"
},
{
"tags": [
"patch"
],
"url": "https://github.com/projectsend/projectsend/commit/db65731c3ad28ac7f0d541c60cb65eb100958514"
},
{
"name": "ProjectSend v2.7.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/projectsend/projectsend/releases/tag/v2.7.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/projectsend/projectsend/blob/v2.6.0/app/Modules/Identity/StaffAccounts.php#L153-L162"
},
{
"name": "VulnCheck Advisory: ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/projectsend-2.0.0-before-2.7.0-incorrect-authorization-via-users-api-token-abilities"
}
],
"title": "ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112001",
"datePublished": "2026-10-18T11:38:26.451Z",
"dateReserved": "2026-10-18T01:23:15.240Z",
"dateUpdated": "2026-10-18T11:38:26.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111929 (GCVE-0-2026-111929)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-17 18:46
VLAI
EPSS
VEX
Title
Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
Summary
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.30.0… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations\u0027 cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:40.707Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hrhj-hpwc-9hmc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc"
},
{
"name": "VulnCheck Advisory: Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc"
}
],
"title": "Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111929",
"datePublished": "2026-10-17T18:46:40.707Z",
"dateReserved": "2026-10-17T12:19:42.359Z",
"dateUpdated": "2026-10-17T18:46:40.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111928 (GCVE-0-2026-111928)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-17 18:46
VLAI
EPSS
VEX
Title
Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
Summary
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
Severity
5.4 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.0.0-… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:40.029Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7v78-w67v-pm2g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-7v78-w67v-pm2g"
},
{
"name": "VulnCheck Advisory: Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-authorization-bypass-via-user-level-acl-in-rbac-policy"
}
],
"title": "Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111928",
"datePublished": "2026-10-17T18:46:40.029Z",
"dateReserved": "2026-10-17T12:19:42.359Z",
"dateUpdated": "2026-10-17T18:46:40.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111921 (GCVE-0-2026-111921)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-17 18:46
VLAI
EPSS
VEX
Title
Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
Summary
Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions.
Severity
5.4 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-0.13… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
0.13.0 , < 2.7.0
(semver)
Unaffected: 2.7.0 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.0",
"status": "affected",
"version": "0.13.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.0",
"versionStartIncluding": "0.13.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier link shares because the delete permission check reads an unloaded share object. Attackers can send DELETE requests to the v1 or v2 projects shares endpoints with sequential share IDs to revoke admin links and invalidate existing share sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:35.329Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fmmf-xq98-g327)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fmmf-xq98-g327"
},
{
"name": "VulnCheck Advisory: Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-0.13.0-before-2.7.0-incorrect-authorization-in-link-share-deletion"
}
],
"title": "Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111921",
"datePublished": "2026-10-17T18:46:35.329Z",
"dateReserved": "2026-10-17T12:19:42.358Z",
"dateUpdated": "2026-10-17T18:46:35.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111918 (GCVE-0-2026-111918)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-17 18:46
VLAI
EPSS
VEX
Title
Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
Summary
Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service.
Severity
5.4 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vikunja/vikunja/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/vikunja-1.0.… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| go-vikunja | vikunja |
Affected:
1.0.0-rc0 , < 2.7.0
(semver)
Unaffected: 2.7.0 (semver) cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:* |
Date Public
2026-10-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/code.vikunja.io/api",
"product": "vikunja",
"vendor": "go-vikunja",
"versions": [
{
"lessThan": "2.7.0",
"status": "affected",
"version": "1.0.0-rc0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.0",
"versionStartIncluding": "1.0.0-rc0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Tan-JunWei"
}
],
"datePublic": "2026-10-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with zero accessible projects to write task_positions rows for all tasks instance-wide. Attackers can delete their Inbox after repointing default_project_id, then create empty-filter saved filters to persist cross-tenant references and amplify writes for denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:33.245Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fprf-r6rv-xg99)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fprf-r6rv-xg99"
},
{
"name": "VulnCheck Advisory: Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/vikunja-1.0.0-rc0-before-2.7.0-cross-tenant-task-position-writes-via-saved-filter-creation"
}
],
"title": "Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111918",
"datePublished": "2026-10-17T18:46:33.245Z",
"dateReserved": "2026-10-17T12:18:55.463Z",
"dateUpdated": "2026-10-17T18:46:33.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111900 (GCVE-0-2026-111900)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-17 18:46
VLAI
EPSS
VEX
Title
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
Summary
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment&id=<ID> to download complete attachment files belonging to draft FAQs.
Severity
4.3 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/thorsten/phpMyFAQ/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/phpmyfaq-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-03 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "phpMyFAQ",
"vendor": "thorsten",
"versions": [
{
"lessThan": "4.1.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.1.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "phpMyFAQ",
"vendor": "thorsten",
"versions": [
{
"lessThan": "4.2.0-beta",
"status": "affected",
"version": "4.2.0-alpha",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.2.0-beta",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0-beta",
"versionStartIncluding": "4.2.0-alpha",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "MTekinAU"
}
],
"datePublic": "2026-10-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment\u0027s parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request index.php?action=attachment\u0026id=\u003cID\u003e to download complete attachment files belonging to draft FAQs."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:21.382Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h76j-35m7-3mwq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h76j-35m7-3mwq"
},
{
"name": "VulnCheck Advisory: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-draft-faq-attachment-disclosure-via-attachment-php"
}
],
"title": "phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111900",
"datePublished": "2026-10-17T18:46:21.382Z",
"dateReserved": "2026-10-17T12:18:07.314Z",
"dateUpdated": "2026-10-17T18:46:21.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111888 (GCVE-0-2026-111888)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-18 11:21
VLAI
EPSS
VEX
Title
phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
Summary
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item's header, body, author, link and active flag shown on the public front page.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:21 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/thorsten/phpMyFAQ/security/adv… | vendor-advisory |
| https://www.vulncheck.com/advisories/phpmyfaq-4.0… | third-party-advisory |
Impacted products
Date Public
2026-10-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111888",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:21:43.733421Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:21:59.896Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "phpMyFAQ",
"vendor": "thorsten",
"versions": [
{
"lessThan": "4.1.9",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.1.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.9",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "euriconicacio"
}
],
"datePublic": "2026-10-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the update-news CSRF token from their own cookie and rewrite any news item\u0027s header, body, author, link and active flag shown on the public front page."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:13.202Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-287v-6c6j-x9f7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-287v-6c6j-x9f7"
},
{
"name": "VulnCheck Advisory: phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-incorrect-authorization-via-news-update-api"
}
],
"title": "phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111888",
"datePublished": "2026-10-17T18:46:13.202Z",
"dateReserved": "2026-10-17T12:15:56.790Z",
"dateUpdated": "2026-10-18T11:21:59.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111875 (GCVE-0-2026-111875)
Vulnerability from cvelistv5 – Published: 2026-10-18 05:30 – Updated: 2026-10-18 05:30
VLAI
EPSS
VEX
Title
David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
Summary
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421587 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421587/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-111875 | third-party-advisory |
| https://vuldb.com/submit/1005220 | third-party-advisory |
| https://github.com/David-Crty/databasement/securi… | exploit |
| https://github.com/David-Crty/databasement/releas… | patch |
| https://github.com/David-Crty/databasement/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| David-Crty | Databasement |
Affected:
1.8.0
Affected: 1.8.1 Unaffected: 1.8.2 cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:david-crty:databasement:*:*:*:*:*:*:*:*"
],
"modules": [
"Scheduled Restore"
],
"product": "Databasement",
"vendor": "David-Crty",
"versions": [
{
"status": "affected",
"version": "1.8.0"
},
{
"status": "affected",
"version": "1.8.1"
},
{
"status": "unaffected",
"version": "1.8.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mikannse (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.8.2 addresses this issue. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T05:30:17.829Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421587 | David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421587"
},
{
"name": "VDB-421587 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421587/cti"
},
{
"name": "CVE-2026-111875 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-111875"
},
{
"name": "Submit #1005220 | David-Crty/databasement databasement \u003c=1.7.3 Write-what-where Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1005220"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/David-Crty/databasement/security/advisories/GHSA-3rjj-69wh-r95f"
},
{
"tags": [
"patch"
],
"url": "https://github.com/David-Crty/databasement/releases/tag/v1.8.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/David-Crty/databasement/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-17T11:53:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-111875",
"datePublished": "2026-10-18T05:30:17.829Z",
"dateReserved": "2026-10-17T09:48:37.852Z",
"dateUpdated": "2026-10-18T05:30:17.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111688 (GCVE-0-2026-111688)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 20:16
VLAI
EPSS
VEX
Title
Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter
Summary
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization's department tree and names outside their assigned scope.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:43 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/xboot-data-scope… | third-party-advisory |
| https://github.com/Exrick/xboot/blob/3.3.4/xboot-… | technical-description |
| https://www.vulncheck.com/advisories/exrick-xboot… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111688",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:43:12.243973Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T20:16:18.861Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Exrick/xboot",
"product": "xboot",
"repo": "https://github.com/Exrick/xboot",
"vendor": "Exrick",
"versions": [
{
"lessThanOrEqual": "3.3.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exrick:xboot:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by sending openDataFilter=false. Attackers can append this parameter to the department getByParentId or search endpoints to retrieve the entire organization\u0027s department tree and names outside their assigned scope."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:39:45.564Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/xboot-data-scope-filter-bypass-cross-dept-user-disclosure"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Exrick/xboot/blob/3.3.4/xboot-fast/src/main/java/cn/exrick/xboot/modules/base/serviceimpl/DepartmentServiceImpl.java#L35-L60"
},
{
"name": "VulnCheck Advisory: Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exrick-xboot-through-3.3.4-data-scope-bypass-via-opendatafilter-parameter"
}
],
"title": "Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111688",
"datePublished": "2026-10-16T17:39:45.564Z",
"dateReserved": "2026-10-16T14:31:20.052Z",
"dateUpdated": "2026-10-16T20:16:18.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.