https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T13:49:47.806423+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-126948 CVE-2026-126948 — Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints 2026-11-13T13:49:47.826670+00:00

Affected: diced zipline

Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.