https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 22:02:51 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-9589 <p>Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren&#39;t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers&#39; accounts, via configuration read and write operations that target those entities.</p> <p>The Collaboration Server doesn&#39;t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren&#39;t allowed to edit, in any scope.</p> <p>Exploitation requires an authenticated session but no user interaction.</p> <p>Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren&#39;t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers&#39; accounts, via configuration read and write operations that target those entities.</p> <p>The Collaboration Server doesn&#39;t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren&#39;t allowed to edit, in any scope.</p> <p>Exploitation requires an authenticated session but no user interaction.</p> https://db.gcve.eu/vuln/fkie_cve-2026-9589 https://db.gcve.eu/vuln/ghsa-m9mc-chm4-qcpm <p>Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren&#39;t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers&#39; accounts, via configuration read and write operations that target those entities.</p> <p>The Collaboration Server doesn&#39;t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren&#39;t allowed to edit, in any scope.</p> <p>Exploitation requires an authenticated session but no user interaction.</p> <p>Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren&#39;t authorized to access, including other users, other accounts and, in Unblu Cloud, other customers&#39; accounts, via configuration read and write operations that target those entities.</p> <p>The Collaboration Server doesn&#39;t check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren&#39;t allowed to edit, in any scope.</p> <p>Exploitation requires an authenticated session but no user interaction.</p> https://db.gcve.eu/vuln/ghsa-m9mc-chm4-qcpm