AsyncHttpClient versions from 2.0.0 up to 2.16.1 and from 3.0.0 up to but not including 3.0.14 contain an origin validation error related to connection-pool partitioning. This flaw allows reuse of sockets authenticated as different identities in Kerberos, SPNEGO, NTLM, and proxy connections, potentially exposing one user's data or authority to another. The issue is fixed in version 3.0.14.
PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.
wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard (`gym_a != gym_b`) that silently passes when both operands are `None`. A trainer with `gym.gym_trainer` and `gym.add_adminusernote` permissions and no gym assignment (`gym=None`) can read private admin notes, uploaded documents, gym contracts, user configuration, and user permission data for **any other unaffiliated user** on the instance. The subsequent querysets filter only on the attacker-supplied `member_id` with no secondary gym-scoped validation, so all records are disclosed. Version 2.6 fixes the issue.
In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.
CVE-2026-106458 is an authorization vulnerability in the Backstage open framework affecting the @backstage/plugin-catalog-backend-module-bitbucket-server package versions from 0.4.0 up to 0.5.15. The issue involves inconsistent filtering of Bitbucket Server repositories during event-driven catalog updates, allowing an authenticated user with push access to a filtered-out repository to cause the system to ingest catalog locations from that repository despite it being excluded by configured filters. This could lead to unauthorized inclusion of repository data in the catalog. The vulnerability is fixed in version 0.5.15.
CVE-2026-106456 is an authorization vulnerability in the Backstage open framework affecting the @backstage/plugin-proxy-backend package versions from 0.5.0 up to 0.6.18. The issue arises from inconsistent credential enforcement when overlapping proxy routes are configured with different authentication requirements. Specifically, if a parent proxy path allows unauthenticated access while a nested path requires credentials, the unauthenticated exemption from the parent path can incorrectly apply to the nested path. This allows unauthenticated users to access nested upstream services, potentially using static credentials configured for that proxy. The vulnerability is fixed in version 0.6.18.
CVE-2026-103007 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows privilege escalation. It arises from a delegated administrative privilege whose scope is not fully enforced during authorization checks. A user with this delegated privilege can exploit the flaw to update their own role and gain unauthorized access to restricted indices, including internal security data, potentially escalating to full administrative control of the cluster.
CVE-2026-102412 is an incorrect authorization vulnerability in Elastic Kibana affecting versions 9.3.0 through 9.3.8, 9.4.0 through 9.4.7, and 9.5.0 through 9.5.4. It allows an authenticated user with limited Fleet management privileges to access sensitive credential material that should be restricted to Fleet settings administrators. This could lead to disclosure of private cryptographic key material used for Fleet Server host connections. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-102407 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows an authenticated user with privileges on one resource to modify data streams they are not authorized to access. This vulnerability affects multiple Elasticsearch versions from 7.17.5 through 9.4.3. It does not permit unauthorized reading of data stream contents but can lead to unauthorized modification or injection of data, potentially disrupting search functionality. The CVSS score is 5.4, indicating medium severity.
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
### Impact
An authenticated user limited to one tenant could create a record in another tenant. This requires the multi-tenant plugin with at least one tenant-enabled collection.
Reads and direct edits to an existing target-tenant document were not bypassed.
You are affected if:
- You are using @payloadcms/plugin-multi-tenant
### Patches
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
### Workarounds
You can add access control with `accessResultOverride` on the multi-tenant collection config to ensure a user has access to the tenant before creating.
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
### Impact
Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
### Patches
Payload now applies field-level access checks to sort fields before executing queries.
Users should upgrade to `>= 3.88.0` or `>= 4.0.0-canary.27`.
### Workarounds
Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.
A privilege management vulnerability in TryGhost Ghost allows staff users with Editor or Super Editor roles to assign their own role to Author and Contributor users, despite lacking permission to do so. This issue affects Ghost versions from 0.5.0 up to but not including 6.64.0. The vulnerability has a medium severity with a CVSS score of 4.3. Version 6.64.0 contains a fix that addresses this issue.
Plane, an open-source project management tool, had an authorization flaw prior to version 1.4.0. Authenticated users could access the project invitation list endpoint if they knew the workspace slug and project ID. Additionally, the public project invitation join endpoint accepted invitations based solely on a submitted email address without mailbox verification. This allowed attackers to enumerate invitations, register accounts with invited email addresses, and join targeted workspaces and projects. The vulnerability is fixed in Plane version 1.4.0.
CVE-2026-78411 is a vulnerability in Rapid7 Velociraptor where the SetClientMetadata function uses an incorrect permission check. This flaw allows users with LABEL_CLIENTS permission to update server metadata, which is typically reserved for server administrators. Server metadata often contains site-wide configuration data, so unauthorized modification could impact system integrity. The vulnerability affects Velociraptor versions from initial releases up to but not including 0.77.3. The CVSS score is 6.5, indicating a medium severity level.