https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 04:37:12 +0000 https://db.gcve.eu/vuln/pysec-2026-1494 <p><strong>Affected:</strong> PyPI: kinto-attachment</p> <p>### Impact</p> <p>The attachment file of an existing record can be replaced if the user has `&#34;read&#34;` permission on one of the parent (collection or bucket).</p> <p>And if the `&#34;read&#34;` permission is given to `&#34;system.Everyone&#34;` on one of the parent, then the attachment can be replaced on a record using an anonymous request.</p> <p>Note that if the parent has no explicit read permission, then the records attachments are safe.</p> <p>### Patches</p> <p>- Patch released in kinto-attachment 6.4.0 - https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1</p> <p>### Workarounds</p> <p>None if the read permission has to remain granted.</p> <p>Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.</p> <p>### References</p> <p>- https://bugzilla.mozilla.org/show_bug.cgi?id=1879034</p> <p><strong>Affected:</strong> PyPI: kinto-attachment</p> <p>### Impact</p> <p>The attachment file of an existing record can be replaced if the user has `&#34;read&#34;` permission on one of the parent (collection or bucket).</p> <p>And if the `&#34;read&#34;` permission is given to `&#34;system.Everyone&#34;` on one of the parent, then the attachment can be replaced on a record using an anonymous request.</p> <p>Note that if the parent has no explicit read permission, then the records attachments are safe.</p> <p>### Patches</p> <p>- Patch released in kinto-attachment 6.4.0 - https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1</p> <p>### Workarounds</p> <p>None if the read permission has to remain granted.</p> <p>Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.</p> <p>### References</p> <p>- https://bugzilla.mozilla.org/show_bug.cgi?id=1879034</p> https://db.gcve.eu/vuln/pysec-2026-1494