Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an incorrect authorization vulnerability (CWE-863). This flaw allows a high privileged attacker with remote access to potentially elevate privileges and gain unauthorized access. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level.
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.
Ash.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash.read/2 and its page counts are not affected.
This issue affects ash: from 2.6.0 before 3.34.6.
CVE-2026-107728 is an incorrect authorization vulnerability in the strawberry-graphql library affecting versions from 0.217.0 up to but not including 0.326.1. The flaw occurs when a synchronous field resolver uses a custom permission whose has_permission() method is defined as a normal function returning an awaitable object. Because the awaitable is not awaited, its inherently truthy value incorrectly allows access to protected resolvers even when permission should be denied. This issue does not affect async has_permission() methods or synchronous permissions returning booleans. The vulnerability is fixed in version 0.326.1.
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than the original workflow owner, and thus the owner can neither see nor delete it. The third project can accept this membership (that it had not actually been granted by the owner), and then read and execute the owner's private workflow; only the accepting (not the owning) project can later revoke that access.
CVE-2026-107334 is an incorrect authorization vulnerability in the role-based access control (RBAC) implementation of CISA Malcolm's nginx Lua layer. The vulnerability arises because the RBAC check uses the raw, percent-encoded request URI, while nginx routes requests based on the percent-decoded URI. This discrepancy allows an authenticated low-privilege user to access admin-only paths by using percent-encoded variants of restricted URLs, bypassing the RBAC restrictions.
CVE-2026-107333 is a high-severity vulnerability in CISA Malcolm's nginx-based reverse proxy. It arises from a URL path normalization inconsistency between the Lua-based RBAC authorization layer and nginx's request routing logic. This flaw allows an authenticated user to bypass role-based access controls and access administrative or restricted endpoints, including file upload, PHP server, htadmin, and authentication management interfaces. The vulnerability affects all restricted paths protected by the RBAC layer in Malcolm versions from 0 up to and including 26.07.1.
CVE-2026-107336 is an authentication bypass vulnerability in CISA Malcolm's nginx reverse proxy configuration. The issue arises because a case-insensitive regex matcher allows requests with non-lowercase path segments to bypass a case-sensitive rewrite, leading to unauthenticated access to the Arkime backend. Additionally, the proxy forwards a client-supplied X-Forwarded-User header without overwriting it, and Arkime trusts this header for authentication. This combination allows an unauthenticated attacker to access Arkime with a forged identity.
CVE-2026-50055 is a medium severity vulnerability in Zimbra Collaboration Suite that allows an authenticated user to bypass disabled mail forwarding. This occurs due to a policy-enforcement flaw where the user can use a Sieve notify action to send copies of email content and headers to an arbitrary address. The vulnerability affects versions prior to 10.1.20. There is no indication of active exploitation in the wild or an official patch available at this time.
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions.
The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view.
Successful exploitation may expose sensitive user information and facilitate account enumeration.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.
These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.
Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler that allows authenticated users to operate task instances in projects they are not authorized to access. The vulnerability affects versions before 3.4.3 and can be exploited via specific API endpoints related to stopping task instances and saving task instance savepoints. The issue is fixed in version 3.4.3.
CVE-2026-66084 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. It allows authenticated users to modify task definitions in projects they are not authorized to access by exploiting a flaw in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint does not verify that the task definition code belongs to the specified project, enabling unauthorized modification of task definitions and their upstream dependencies. This can compromise workflow integrity and disrupt task execution in unauthorized projects. The issue is fixed in version 3.4.3.
CVE-2026-66082 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. Authenticated users with permissions in one project can perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects by exploiting improper verification of resource ownership. This allows altering workflow availability and interfering with task execution in projects they should not access. The issue is fixed in version 3.4.3.
In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.
In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.
AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain an origin validation error affecting connection pooling with NTLM and Negotiate authentication. The connection pool key does not include the authenticated principal, allowing a pooled socket authenticated for one user to be reused by another, causing the server to execute requests under the wrong identity. Basic and Digest authentication methods are not affected. This vulnerability is fixed in versions 3.0.13 and 2.16.1.
AsyncHttpClient versions from 2.0.0 up to 2.16.1 and from 3.0.0 up to but not including 3.0.14 contain an origin validation error related to connection-pool partitioning. This flaw allows reuse of sockets authenticated as different identities in Kerberos, SPNEGO, NTLM, and proxy connections, potentially exposing one user's data or authority to another. The issue is fixed in version 3.0.14.
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.