https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T18:45:20.874107+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/bit-consul-2026-19016 BIT-consul-2026-19016 — Authorization bypass for session deletion in the transaction API 2026-09-28T18:45:20.904897+00:00

Affected: Bitnami: consul

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

 https://db.gcve.eu/vuln/fkie_cve-2026-19016 fkie_cve-2026-19016 2026-09-28T18:45:20.905342+00:00

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

 https://db.gcve.eu/vuln/ghsa-7qhj-3fg3-mh5r GHSA-7qhj-3fg3-mh5r 2026-09-28T18:45:20.905464+00:00

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-19016 UBUNTU-CVE-2026-19016 2026-09-28T18:45:20.905526+00:00

Affected: Ubuntu:18.04:LTS: consul, Ubuntu:20.04:LTS: consul, Ubuntu:22.04:LTS: consul

Consul Community Edition and Consul Enterprise 1.19.1 through 2.0.2 did not enforce the {{session:write}} ACL permission for session deletion operations submitted through the transaction API. An authenticated caller with network access to the Consul server RPC port could delete arbitrary sessions without holding the required permission. This vulnerability, CVE-2026-19016, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.