Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7482 vulnerabilities reference this CWE, most recent first.

CVE-2026-111666 (GCVE-0-2026-111666)

Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 21:18
VLAI
Title
Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API
Summary
Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:34 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6430 records in the last 180 days details
References
Impacted products
Vendor Product Version
steedos steedos-platform Affected: 0 , ≤ 3.0.15-beta.51 (custom)
    cpe:2.3:a:steedos:steedos-platform:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-15 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:34:07.603063Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T21:18:06.427Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/steedos/steedos-platform",
          "product": "steedos-platform",
          "repo": "https://github.com/steedos/steedos-platform",
          "vendor": "steedos",
          "versions": [
            {
              "lessThanOrEqual": "3.0.15-beta.51",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:steedos:steedos-platform:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.0.15-beta.51",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants\u0027 report definitions by querying the reports object. Because objectql\u0027s callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T17:39:28.959Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/steedos-platform-reports-cross-tenant-idor"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/steedos/steedos-platform/blob/v3.0.15-beta.51/packages/objectql/src/types/object.ts#L2899-L2913"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/steedos/steedos-platform/blob/v3.0.15-beta.51/services/service-core-objects/main/default/objects/reports.object.yml#L4"
        },
        {
          "name": "VulnCheck Advisory: Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/steedos-platform-through-3.0.15-beta.51-cross-tenant-information-disclosure-via-reports-api"
        }
      ],
      "title": "Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111666",
    "datePublished": "2026-10-16T17:39:28.959Z",
    "dateReserved": "2026-10-16T14:31:17.043Z",
    "dateUpdated": "2026-10-16T21:18:06.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111627 (GCVE-0-2026-111627)

Vulnerability from cvelistv5 – Published: 2026-10-16 17:39 – Updated: 2026-10-16 19:32
VLAI
Title
HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
Summary
HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator's system account.
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:31 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6430 records in the last 180 days details
References
Impacted products
Vendor Product Version
hestiacp hestiacp Affected: 0 , < 1.10.5 (semver)
Create a notification for this product.
Date Public
2026-09-15 00:00
Credits
lichoin
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111627",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:31:01.638917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:32:00.506Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/hestiacp/hestiacp/security/advisories/GHSA-vp7q-fjv5-5vg8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/hestiacp/hestiacp",
          "product": "hestiacp",
          "repo": "https://github.com/hestiacp/hestiacp",
          "vendor": "hestiacp",
          "versions": [
            {
              "lessThan": "1.10.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "lichoin"
        }
      ],
      "datePublic": "2026-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions while impersonating the protected ROOT_USER account. Attackers can log in via the loginas parameter and POST to /add/cron/, because the read-only flag is never checked, causing crond to run their commands as the protected administrator\u0027s system account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T17:39:02.155Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-vp7q-fjv5-5vg8)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/hestiacp/hestiacp/security/advisories/GHSA-vp7q-fjv5-5vg8"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hestiacp/hestiacp/blob/1.10.4/web/add/cron/index.php#L11-L70"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/hestiacp/hestiacp/blob/1.10.4/web/inc/policies.php#L3-L14"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/hestiacp/hestiacp/commit/1af7e057cd5ad2ea945acba6c9932ea1a1802c24"
        },
        {
          "name": "hestiacp 1.10.5 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/hestiacp/hestiacp/releases/tag/1.10.5"
        },
        {
          "name": "VulnCheck Advisory: HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hestiacp-before-1.10.5-protected-admin-bypass-via-cron-job-creation"
        }
      ],
      "title": "HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111627",
    "datePublished": "2026-10-16T17:39:02.155Z",
    "dateReserved": "2026-10-16T14:31:11.688Z",
    "dateUpdated": "2026-10-16T19:32:00.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111446 (GCVE-0-2026-111446)

Vulnerability from cvelistv5 – Published: 2026-10-16 03:37 – Updated: 2026-10-16 16:20
VLAI
Summary
Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.
Severity
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:20 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
mitre CNA under the mitre root
CNA scorecard E 28/100 over 2338 records in the last 180 days details
References
Impacted products
Vendor Product Version
Wheels Wheels Affected: 4.0.0 , < 4.2.0 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111446",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:20:35.733304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T16:20:50.474Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Wheels",
          "repo": "https://github.com/wheels-dev/wheels",
          "vendor": "Wheels",
          "versions": [
            {
              "lessThan": "4.2.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T03:37:32.158Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/wheels-dev/wheels/security/advisories/GHSA-6v6c-p375-vxw9"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-111446",
    "datePublished": "2026-10-16T03:37:32.158Z",
    "dateReserved": "2026-10-16T03:37:31.350Z",
    "dateUpdated": "2026-10-16T16:20:50.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111369 (GCVE-0-2026-111369)

Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 17:08
VLAI
Title
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
Summary
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6430 records in the last 180 days details
References
Impacted products
Vendor Product Version
classroomio ClassroomIO Affected: 0 , ≤ 1.0.0 (semver)
    cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-15 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111369",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:31:47.802897Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:08:02.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/classroomio/classroomio",
          "product": "ClassroomIO",
          "repo": "https://github.com/classroomio/classroomio",
          "vendor": "classroomio",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:52.330Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/classroomio/classroomio"
        },
        {
          "name": "VulnCheck Advisory: ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes"
        }
      ],
      "title": "ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111369",
    "datePublished": "2026-10-15T21:43:52.330Z",
    "dateReserved": "2026-10-15T21:21:32.069Z",
    "dateUpdated": "2026-10-16T17:08:02.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111352 (GCVE-0-2026-111352)

Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-15 21:43
VLAI
Title
ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
Summary
ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6430 records in the last 180 days details
References
Impacted products
Vendor Product Version
ThinkCMF ThinkCMF Affected: 0 , ≤ 8.0.1 (semver)
    cpe:2.3:a:thinkcmf:thinkcmf:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-15 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/thinkcmf/thinkcmf",
          "product": "ThinkCMF",
          "repo": "https://github.com/thinkcmf/thinkcmf",
          "vendor": "ThinkCMF",
          "versions": [
            {
              "lessThanOrEqual": "8.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:thinkcmf:thinkcmf:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:42.341Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/thinkcmf-admin-rest-api-missing-authorization"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/lib/Auth.php#L40-L61"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thinkcmf/cmf-core/blob/v8.0.3/src/controller/RestAdminBaseController.php#L15-L34"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/thinkcmf/cmf-api/blob/v8.0.7/src/admin/controller/RoleController.php#L345-L381"
        },
        {
          "name": "VulnCheck Advisory: ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/thinkcmf-through-8.0.1-incorrect-authorization-in-admin-rest-api"
        }
      ],
      "title": "ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111352",
    "datePublished": "2026-10-15T21:43:42.341Z",
    "dateReserved": "2026-10-15T20:55:42.432Z",
    "dateUpdated": "2026-10-15T21:43:42.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111332 (GCVE-0-2026-111332)

Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-15 21:43
VLAI
Title
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
Summary
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6430 records in the last 180 days details
References
Impacted products
Vendor Product Version
AtalayaLabs OxiCloud Affected: 0.9.1 , ≤ 0.9.3 (semver)
Create a notification for this product.
Date Public
2026-10-15 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/AtalayaLabs/OxiCloud",
          "product": "OxiCloud",
          "repo": "https://github.com/AtalayaLabs/OxiCloud",
          "vendor": "AtalayaLabs",
          "versions": [
            {
              "lessThanOrEqual": "0.9.3",
              "status": "affected",
              "version": "0.9.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxi_shares share-ring cookie can request content via GET /api/files/{id} to read shared files or folder contents despite the new password."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T21:43:35.166Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/oxicloud-share-password-grant-not-revoked"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/application/services/share_service.rs#L497-L538"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud/blob/v0.9.3/src/infrastructure/services/share_ring.rs#L173-L195"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/AtalayaLabs/OxiCloud"
        },
        {
          "name": "VulnCheck Advisory: OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/oxicloud-0.9.1-through-0.9.3-incorrect-authorization-via-share-ring-cookie"
        }
      ],
      "title": "OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111332",
    "datePublished": "2026-10-15T21:43:35.166Z",
    "dateReserved": "2026-10-15T20:43:59.141Z",
    "dateUpdated": "2026-10-15T21:43:35.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111235 (GCVE-0-2026-111235)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:45 – Updated: 2026-10-16 19:59
VLAI
Title
OpenNMS REST authorization bypass via non-canonical HTTP method
Summary
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:59 UTC
CWE
  • CWE-862 - Missing Authorization
  • CWE-863 - Incorrect Authorization
  • CWE-204 - Observable Response Discrepancy
Assigner
OpenNMS CNA under the mitre root
CNA scorecard – unranked: 7 records in the last 180 days, 10 needed details
References
Impacted products
Vendor Product Version
The OpenNMS Group Meridian Affected: 2024.1.0 , < 2024.3.14 (maven)
Affected: 2025.0.0 , < 2025.0.11 (maven)
Affected: 2026.0.0 , < 2026.0.1 (maven)
Create a notification for this product.
The OpenNMS Group Horizon Affected: 36.0.0 , < 36.0.5 (maven)
Create a notification for this product.
Credits
Pongsathon Sirithanyakul, Warunyou Sunpachit, Khamolwan Hnunainam (IT Select Lab Co., Ltd., Thailand)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111235",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:59:23.754367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:59:35.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Meridian",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "2024.3.14",
              "status": "affected",
              "version": "2024.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2025.0.11",
              "status": "affected",
              "version": "2025.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "2026.0.1",
              "status": "affected",
              "version": "2026.0.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Horizon",
          "repo": "https://github.com/OpenNMS",
          "vendor": "The OpenNMS Group",
          "versions": [
            {
              "lessThan": "36.0.5",
              "status": "affected",
              "version": "36.0.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pongsathon Sirithanyakul, Warunyou Sunpachit, Khamolwan Hnunainam (IT Select Lab Co., Ltd., Thailand)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain.\u003c/p\u003e\u003cp\u003eThe solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet.\u003c/p\u003e"
            }
          ],
          "value": "An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain.\n\n\n\nThe solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization\u0027s private networks and should not be directly accessible from the Internet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-204",
              "description": "CWE-204 Observable Response Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T16:52:07.417Z",
        "orgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
        "shortName": "OpenNMS"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/OpenNMS/opennms/pull/8934"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "OpenNMS REST authorization bypass via non-canonical HTTP method",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "70b007e9-5235-4ee5-90b5-a71a81beeda0",
    "assignerShortName": "OpenNMS",
    "cveId": "CVE-2026-111235",
    "datePublished": "2026-10-15T18:45:06.685Z",
    "dateReserved": "2026-10-15T18:22:58.029Z",
    "dateUpdated": "2026-10-16T19:59:35.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111231 (GCVE-0-2026-111231)

Vulnerability from cvelistv5 – Published: 2026-10-15 18:46 – Updated: 2026-10-15 18:46
VLAI
Title
Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()
Summary
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-863 - Incorrect Authorization
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6430 records in the last 180 days details
References
Impacted products
Vendor Product Version
Netgate pfSense CE Affected: 0 , ≤ 2.9.0 (semver)
    cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-15 17:21
Credits
Abraxas Labs
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/pfsense/pfsense",
          "product": "pfSense CE",
          "repo": "https://github.com/pfsense/pfsense",
          "vendor": "Netgate",
          "versions": [
            {
              "lessThanOrEqual": "2.9.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:netgate:pfsense:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.9.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        }
      ],
      "datePublic": "2026-10-15T17:21:08.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the \u0027User - Config: Deny Config Write\u0027 privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:46:31.461Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "technical-description"
          ],
          "url": "https://github.com/abraxas/pfsense-config-readonly-restore"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L743-L798"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L588-L597"
        },
        {
          "name": "VulnCheck Advisory: Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-authorization-bypass-via-config-restore-and-config-install"
        }
      ],
      "title": "Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111231",
    "datePublished": "2026-10-15T18:46:31.461Z",
    "dateReserved": "2026-10-15T18:21:23.999Z",
    "dateUpdated": "2026-10-15T18:46:31.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111044 (GCVE-0-2026-111044)

Vulnerability from cvelistv5 – Published: 2026-10-16 21:59 – Updated: 2026-10-16 21:59
VLAI
Title
Disabled Sunshine clients can bypass revocation with a derived client certificate
Summary
Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525.
Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CWE
  • CWE-863 - Incorrect Authorization
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7610 records in the last 180 days details
References
Impacted products
Vendor Product Version
LizardByte Sunshine Affected: >= 2026.329.165800, < 2026.906.222525
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Sunshine",
          "vendor": "LizardByte",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2026.329.165800, \u003c 2026.906.222525"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate text was also compared without canonicalizing equivalent PEM encodings. A previously paired client that retains its private key can present an alternate certificate derived from its paired certificate and bypass the Disable control. Equivalent PEM encodings could also cause inconsistent client identity handling. A client that was never paired cannot use this issue, and removing the paired client removes its trust relationship. This issue is fixed in version 2026.906.222525."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T21:59:00.939Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6jvv-jqr7-m6m3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6jvv-jqr7-m6m3"
        },
        {
          "name": "https://github.com/LizardByte/Sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/LizardByte/Sunshine/commit/4d768847fcd88cc94ac745c4611715c67d7d67e1"
        },
        {
          "name": "https://github.com/LizardByte/Sunshine/releases/tag/v2026.906.222525",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/LizardByte/Sunshine/releases/tag/v2026.906.222525"
        }
      ],
      "source": {
        "advisory": "GHSA-6jvv-jqr7-m6m3",
        "discovery": "UNKNOWN"
      },
      "title": "Disabled Sunshine clients can bypass revocation with a derived client certificate"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-111044",
    "datePublished": "2026-10-16T21:59:00.939Z",
    "dateReserved": "2026-10-15T12:47:13.663Z",
    "dateUpdated": "2026-10-16T21:59:00.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110904 (GCVE-0-2026-110904)

Vulnerability from cvelistv5 – Published: 2026-10-15 01:15 – Updated: 2026-10-15 13:24
VLAI
Summary
ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 13:23 UTC
CWE
  • CWE-863 - Incorrect Authorization
Assigner
mitre CNA under the mitre root
CNA scorecard E 28/100 over 2338 records in the last 180 days details
References
Impacted products
Vendor Product Version
apostrophecms ApostropheCMS Affected: 0 , < 4.33.0 (semver)
    cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110904",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:23:44.360759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T13:24:32.663Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/apostrophe",
          "product": "ApostropheCMS",
          "vendor": "apostrophecms",
          "versions": [
            {
              "lessThan": "4.33.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:apostrophecms:apostrophecms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.33.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T01:15:08.642Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-2j32-q6rx-h844"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-110904",
    "datePublished": "2026-10-15T01:15:08.642Z",
    "dateReserved": "2026-10-15T01:15:08.231Z",
    "dateUpdated": "2026-10-15T13:24:32.663Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list