CVE-2026-49376 is a medium severity vulnerability in JetBrains TeamCity prior to version 2026.1 involving insufficient username validation in the SAML plugin. This weakness corresponds to CWE-863, which relates to improper authorization. The vulnerability could allow unauthorized access or actions due to inadequate validation of usernames during SAML authentication. No official patch or remediation level has been confirmed yet, and there are no known exploits in the wild at this time.
CVE-2026-49369 is a medium severity vulnerability in JetBrains YouTrack versions before 2026.1.13162 that allows information disclosure on the Users and Groups pages. The issue is classified under CWE-863, which relates to improper authorization. The vulnerability does not require user interaction and can be exploited remotely with low complexity, but requires some level of privileges. There is no official patch or remediation level confirmed yet. No known exploits are reported in the wild. The impact is limited to confidentiality loss without affecting integrity or availability.
CVE-2026-9808 is an authorization bypass vulnerability in Mautic 7.0.0 API v2 endpoints. Roles with owner-scope restrictions such as 'viewown' or 'editown' are not properly enforced, allowing low-privilege authenticated API users to access or modify resources owned by other users. This vulnerability has a high severity with a CVSS score of 7.1.
CVE-2026-49299 is an authorization vulnerability in OpenStack Neutron before version 28.0.1. The issue arises because the tagging controller uses plural policy action names for single-tag write operations, while the policy rules use singular names. This mismatch causes the default policy to allow project readers to create and update tags on resources within the same project. Versions 26.0.0, 27.0.0, and 28.0.0 of Neutron are affected.
A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. A user could successfully send a message to an address or consume a message from a queue with a routing-type not supported by the corresponding address when that operation should actually be rejected on the basis that the user doesn't have permission to change the routing-type of the address. Even though the user was already granted permission to send and/or consume messages, they should not be able to augment the routing-type of the address without the createAddress permission.
This issue affects Apache Artemis: from 2.50.0 through 2.53.0; Apache ActiveMQ Artemis: from 2.0.0 through 2.44.0.
Users are recommended to upgrade to version 2.54.0, which fixes the issue.
CVE-2026-44394 is a medium severity vulnerability in OpenStack Keystone affecting federated identity deployments using SAML2 or OpenID Connect. The flaw allows the federated token rescoping mechanism to issue new tokens without propagating the original token's expiry time, enabling indefinite token reuse and bypassing token lifetime policies. This impacts token expiration enforcement in federated authentication scenarios. The vulnerability affects specific versions of Keystone and is a variant of a previously known issue (CVE-2012-3426).
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Keystone trusts. The impersonated token carries the victim's identity, which passes the trustor validation check. Keystone then validates the delegated roles against the victim's actual role assignments in the database, not the roles on the requesting token. This allows the attacker to create a trust delegating the victim's admin role to themselves. The trust persists independently, and additional trusts and application credentials can be created to maintain access. All actions are logged under the victim's identity.
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trusted target data that was previously set from database lookups. Because flask.request.get_json is called with force=True, this works regardless of Content-Type or HTTP method. Any authenticated user can inject arbitrary policy target attributes (e.g., user_id, project_id) into the request body to bypass RBAC checks and perform unauthorized operations on resources belonging to other users or projects. This was introduced in commit 5ea59f52 (Rocky/14.0.0).
A vulnerability in OpenStack Keystone before version 29.0.2 allows an attacker to impersonate another user by authenticating with their own application credential but specifying a different user's name and domain. This results in Keystone issuing a token attributed to the victim user with project-scoped roles that combine the attacker's and victim's permissions. The flaw enables audit evasion, unauthorized reading of victim credentials, and acting as the victim within shared projects.
pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, when a PAM service is configured with deny_remote=false in pam_usb (commonly done for display managers such as gdm-password or lightdm to bypass process/TTY heuristics for local sessions), the PAM_RHOST check in pusb_do_auth() is also skipped. PAM_RHOST is set by remote daemons (sshd, XDMCP servers) to identify the remote client address. Because the check is gated inside if (opts.deny_remote), a genuine remote XDMCP connection reaches the USB device authentication step instead of being rejected. This vulnerability is fixed in 0.9.1.
Himmelblau versions from 2.0.0 up to but not including 2.3.11, and from 3.0.0-alpha up to but not including 3.1.5, contain an authentication bypass vulnerability in the Device Authorization Grant flow. This flaw allows a user within the same Microsoft Azure Entra ID domain to gain a local Unix session as another user by using their own valid credentials.
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0.
CVE-2026-44473 is a high-severity vulnerability in ellanetworks core (Ella Core), a 5G core designed for private networks. Versions prior to 1.10.0 allow a radio with a valid NG Setup to send a forged PDUSessionResourceSetupResponse containing any UE's AMF-UE-NGAP-ID. The core fails to verify that the message arrived on the SCTP association bound to that UE's logical NG-connection, resulting in the creation of a GTP tunnel towards the radio. This improper security check can lead to denial of service or disruption of network operations. The vulnerability is fixed in version 1.10.0. No known exploits in the wild have been reported.
CVE-2026-44838 is a medium severity vulnerability in RabbitMQ's MQTT plugin versions 4.2.0 up to but not including 4.2.4. It involves incorrect authorization due to improper handling of user-supplied client_id values in topic-level authorization regex patterns. Because the client_id is inserted into regex patterns without escaping special characters, an authenticated MQTT user can inject regex operators to bypass topic access restrictions. This flaw is fixed in RabbitMQ versions 4.2.4 and 4.
A vulnerability exists in Auth0.js versions 8.11.0 through 9.32.0 where, under specific conditions, the SDK may improperly return user profile information when presented with a valid access token and a specifically crafted invalid ID token. This incorrect authorization issue is identified as CWE-863 and is fixed in version 10.0.0. The vulnerability has a CVSS score of 7.
Snipe-IT is an IT asset/license management system. Prior to 8.4.1, aAn authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
CVE-2026-8046 is a high-severity vulnerability in CODESYS Control RTE (SL) version 3.0.0.0 where insufficient authorization checks allow an authenticated low-privileged remote user to delete other user accounts, including those with higher privileges. This flaw could lead to unauthorized account deletions and potential disruption of system access controls.
authentik is an open-source identity provider. In versions prior to 2025.12.5 and 2026.2.0-rc1 through 2026.2.2, authenticated non-admin users with at least one OAuth2 access token can retrieve the client_secret of confidential OAuth2 providers they have previously authenticated against, exposing sensitive information to users without the correct permissions. This logic is GET /api/v3/oauth2/access_tokens/. The API response includes a nested provider object containing client_id and client_secret for providers configured with client_type: confidential, which should not be accessible to low-privilege users. This issue has been fixed in versions 2025.12.5 and 2026.2.3.
CVE-2026-6406 is a high-severity vulnerability in Docker Desktop version 4.41.0 where the Docker CLI's --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions. This occurs because the ECI enforcement only inspects certain mount fields, allowing a container to gain unauthorized access to the Docker Engine socket and potentially the host user's container registry credentials. A local attacker with Docker CLI access can exploit this to escape ECI restrictions and escalate privileges.