CVE-2026-115732 is an incorrect authorization vulnerability in the certificate-name matching logic of trapperkeeper-authorization used by Puppet Server in Puppet Enterprise. It allows a client holding a CA-signed certificate with a name that extends or shortens an authorized hostname to impersonate other nodes. This can lead to unauthorized access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name issued by the certificate authority through approval or autosign. The vulnerability affects multiple versions of Puppet Enterprise and has a critical severity rating.
A critical improper authorization vulnerability (CVE-2026-95860) exists in node-opcua versions from 2.42.0 up to but not including 2.180.0. The issue arises because namespace-level default role permissions configured via setDefaultRolePermissions are not enforced for nodes lacking explicit per-node RolePermissions. This allows anonymous clients to write variables or invoke methods despite restrictive namespace defaults. The flaw is fixed in version 2.180.0.
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.
NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.
Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API.
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.
CVE-2026-119625 is an incorrect authorization vulnerability in Gitea affecting versions prior to 28.3.0. The issue involves the `/{username}` web route accepting personal access tokens over HTTP Basic authentication without properly checking token scopes. This allowed tokens with unrelated or limited scopes to access private user and organization activity feeds and private repository information. The vulnerability was fixed in version 28.3.0 by restricting token acceptance on this route to feeds requiring appropriate scopes such as `read:user` or `read:organization`.
CVE-2026-119441 is an authorization vulnerability in Gitea affecting versions from 1.27.0 up to but not including 28.3.0. The DELETE API endpoint for deleting all repositories of an organization did not properly enforce restrictions on public-only access tokens. This allowed a public-only token belonging to an owner of a public organization to delete private repositories within that organization, which should have been inaccessible with such a token. The issue has been fixed in version 28.3.0 by rejecting public-only tokens on routes requiring organization ownership.
CVE-2026-118394 is an information exposure vulnerability in Gitea's OAuth2 userinfo endpoint. The flaw caused the endpoint to incorrectly determine the scope of OAuth2 tokens, leading to unauthorized disclosure of private organization and team membership information of the token owner. No repository content was exposed. The issue is fixed in Gitea version 28.3.0.
CVE-2026-117685 is an authorization vulnerability in Gitea's OCI registry cross-repository blob mount feature. It allows a public-only token with write:package scope, whose owner has read access to a private package and write access to a public package namespace, to mount a private package blob into a public package. This misauthorization enables anyone to download the private blob via the public package.
Gitea versions prior to 28.3.0 contain an authorization flaw where personal access tokens restricted to public resources can be used to register organization-level runners that access private repository workflows, secrets, and variables. This vulnerability allows an attacker with a token having write:organization scope from a public organization owner to gain unintended access to private repository jobs. The issue is fixed in version 28.3.0.
CVE-2026-118386 is an incorrect authorization vulnerability in Gitea affecting versions from 1.19.0 up to but not including 28.3.0. It allows a user with read access to a repository to trigger workflows with elevated privileges by submitting a pull request review referencing a commit they control, bypassing fork restrictions. This leads to unauthorized execution of workflows with access to repository secrets and a token granting write access. The issue is fixed in Gitea version 28.3.0.
CVE-2026-110176 is a high-severity authorization vulnerability in the Drupal 7 File Force Download module versions 7.1.0 through 7.1.2. The module improperly grants access to files in the temporary:// scheme or other stream wrappers by returning download headers without proper access checks when the download=1 parameter is appended to the file URL. This allows unauthenticated users to bypass intended access restrictions and download files they should not be able to access. The issue does not affect files in the public or private schemes. The vulnerability is fixed in version 7.1.3.
Shopify App is a Rails engine for building Shopify applications. From 22.1.0 until 23.0.3, `token-exchange` authenticated controllers can expose a request-derived `shop` context instead of the identity from a verified Shopify ID token or active Shopify session. `current_shopify_domain` can resolve to the sanitized `shop` query parameter, so a request authenticated for one `shop` can cause application code to treat a different requested `shop` as current. Affected applications use `shopify_app` `token-exchange` authentication, accept authenticated requests with a `shop` query parameter, and rely on `current_shopify_domain` or `params[:shop]` for authorization, tenant lookup, stored access-token selection or `shop`-scoped data access. An attacker with a valid Shopify session token for one `shop` can supply another `shop` in that parameter and potentially obtain unauthorized application data or perform `shop`-scoped actions, depending on the application's authorization model. This issue is fixed in version 23.0.3.
CVE-2026-63338 is an authorization vulnerability in inex IXP-Manager versions prior to 7.3.0. Authenticated users could view and edit API key resources belonging to other users due to insufficient authorization checks in the ApiKeyController. This flaw allows unauthorized access and modification of another user's API key. The issue is resolved in version 7.3.0.
ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. This permits removal of an existing `follow` relationship or `repost` belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6.
CVE-2026-58412 is an authorization vulnerability in filecoin-project's filecoin-pin prior to version 1.1.0. The flaw arises from improper fork detection in the GitHub Action upload workflow, allowing an external contributor to cause attacker-controlled artifacts to be uploaded using the repository owner's Filecoin wallet. This leads to unauthorized storage costs, dataset pollution, and consumption of wallet funds without requiring disclosure of the wallet private key. The issue is fixed in version 1.1.0.
Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the remediation of `CVE-2026-47735` leaves a cross-database authorization bypass through DuckDB table-valued I/O functions. In `internal/database/sandbox.go`, `allowed_directories` uses `cfg.LocalStorageRoot`, configured by `storage.local_path`, while `enable_external_access=false` blocks access outside that entire multi-tenant root. `GetStoragePath` in `internal/storage/util.go` stores all databases beneath it. In `internal/api/query.go`, `extractTableReferences` skips names followed by an opening parenthesis and `checkQueryPermissions` allows queries with no extracted table references, including tokens with `permissions: []`. The `userSQLReadParquetPattern` denylist catches literal `read_parquet(` and the earlier protection also blocks `arc_partition_agg(`, but misses the `parquet_scan` alias and `glob`, `parquet_metadata`, `parquet_schema`, `read_blob`, `read_csv_auto`, `read_json` and `read_text`. A request to `POST /api/v1/query` using these unblocked functions passes `ValidateSQLRequest` and `convertSQLToStoragePaths` without tenant authorization, allowing reads and enumeration of other databases' time-series data, schema and per-column value-range statistics within the allowlisted root. The sandbox still blocks out-of-root OS files and HTTP SSRF, and the sibling SQLite token database outside the root is not exposed by this mechanism. The earlier 26.06.1 remediation does not comprehensively deny these I/O functions. Repository tag 26.06.2 contains the I/O-function repair and supplies the provisional remediation boundary; conflicting advisory affected-version statements require curator adjudication.