RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
CVE-2026-84719 is a critical missing authorization vulnerability in Red Hat Ansible Automation Platform 2.4 for RHEL 8. The flaw occurs when copying a WorkflowJobTemplate, where the deep-copy permission sanitizer fails to verify authorization on instance_groups, execution_environment, and labels preserved from the original. This allows a user with organization workflow-admin permission but no role on certain instance groups to copy a workflow, gain administrator rights on it, and launch jobs on unauthorized instance groups, including the control-plane instance group. This bypasses intended role boundaries and enables attacker-influenced automation to run with elevated privileges in the control-plane execution context.
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31.
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31.
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31.
CVE-2026-71460 is a moderate information disclosure vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The /api/v2/config/ API endpoint is protected only by authentication, allowing any authenticated user to access license information such as account number, subscription ID, pool ID, SKU, support level, and instance counts. This information exposure can facilitate social engineering and estate-sizing reconnaissance but does not affect data integrity or availability. A fix is being pursued for maintained platform streams, but no fix is planned for the older 2.4 stream.
CVE-2026-76648 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.7 involving missing authorization checks in the CopyAPIView. The POST method lacks proper object-level read permission validation, allowing users with certain roles to copy JobTemplate objects without having read access to the source. This could lead to unauthorized information disclosure. Red Hat has released an update to address this issue.
CVE-2026-71459 is an information disclosure vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8. The JobJobEventsChildrenSummary API view lacks proper object-level permission checks, allowing any authenticated user, even with zero privileges, to read job event tree structures, event processing status, and enumerate job IDs across the platform. This bypasses role-based access controls that protect related endpoints. The flaw affects versions 2.5, 2.6, and 2.7, with no fix for 2.4. The impact is limited to confidentiality without modification or availability risks.
Cinnamon AI Kotaemon up to version 0.12.0 has multiple authorization vulnerabilities in its multi-user chat interface. Four handler methods fail to verify that the requesting user owns the conversation record they are accessing. This flaw allows any authenticated user to read, rename, delete, or overwrite chat conversations belonging to other users without proper authorization.
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1.
CVE-2026-18179 is a medium severity vulnerability in IBM Financial Transaction Manager (FTM) for RedHat OpenShift. It involves missing authorization controls that could allow a remote attacker to clear active chat sessions without proper permissions. The vulnerability affects versions from 4.0.6.0 through 4.0.10.0 inclusive. There is no indication of confidentiality impact, but integrity and availability impacts are present. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.