CVE-2026-115712 is an incorrect authorization vulnerability in Elastic Cloud Enterprise (ECE) that allows an authenticated user with read-only access to modify platform-level settings that should be restricted to platform administrators. This flaw arises from functionality not properly constrained by access control lists (ACLs). The vulnerability affects versions from 3.8.0 through 3.8.5 and 4.0.0 through 4.2.0. The CVSS score is 4.3, indicating medium severity, with impact limited to unauthorized modification of installation-wide account settings without confidentiality or availability impact.
OAuthLib versions prior to 4.0.0 contain an incorrect authorization vulnerability in the client_credentials and Resource Owner Password Credentials token grant handlers. This flaw allows a lower-privilege authenticated client to impersonate another client's identity by supplying a different client_id, potentially resulting in issuance of tokens with unauthorized grants or scopes. The issue is resolved in version 4.0.0.
A vulnerability in langgraph-api versions from 0.1.2 up to but not including 0.15.0 allows an authenticated user to bypass authorization controls due to improper handling of namespace rewriting in JavaScript or TypeScript custom authentication Store authorization handlers. This flaw enables unauthorized access to another user's Store namespace, potentially leading to unauthorized reads, overwrites, searches, or deletions. The issue is resolved in version 0.15.0.
CVE-2026-118650 is a high-severity vulnerability in the labstack Echo Go web framework affecting versions prior to 4.16.0 and 5.4.0. It involves improper handling of URL encoding in the globally mounted middleware.Static instance, where the static handler decodes the URL path differently than the router, leading to inconsistent route protection. This discrepancy can allow an encoded slash to resolve to files under the static root that might otherwise be guarded. The issue is fixed in versions 4.16.0 and 5.4.0.
CVE-2026-118264 is a critical HTTP request smuggling vulnerability in the labstack Echo Go web framework. It affects versions from 4.0.0 up to but not including 4.16.1, and from 5.0.0 up to but not including 5.4.1. The flaw arises in Echo's Proxy middleware, which improperly handles client WebSocket upgrade requests by selecting a raw tunnel before verifying if the upstream server accepted the upgrade. If the upstream rejects the upgrade with a keep-alive response, subsequent HTTP requests bypass Echo's router and route-specific middleware, potentially circumventing authentication or authorization controls enforced by Echo routes. This vulnerability requires a specific setup including an accessible proxy route, a cooperating rejected-upgrade response, and an upstream target lacking independent authorization. The issue is fixed in versions 4.16.1 and 5.4.1.
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).
CVE-2026-111960 is a medium-severity vulnerability in the Royal MCP WordPress plugin versions from 1.4.38 up to but not including 1.5.10. The plugin fails to perform proper object-level or post-type authorization checks in one of its search tools. This flaw allows authenticated users with low privileges, such as subscribers, to access the title and content of non-public entries, potentially exposing personal data stored by the plugin. The issue is fixed in version 1.5.10.
CVE-2026-111032 is an authorization vulnerability in the Welcart e-Commerce WordPress plugin versions before 2.12.6. The plugin does not properly verify authorization tied to the specific product when processing SKU changes. This flaw allows any authenticated user with Author-level access or higher to manipulate SKU data—including prices, confidential cost prices, and stock levels—of any product, even those owned by other users.
CVE-2026-57200 is a path traversal vulnerability in Asterisk affecting versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 22.8-cert3. An authenticated attacker with read-only Asterisk REST Interface (ARI) credentials can bypass authorization under certain conditions to perform write operations via REST-over-WebSocket, potentially leading to arbitrary module path loading and remote code execution. The vulnerability requires the Asterisk HTTP server to be enabled and reachable, which is disabled by default and bound to localhost. This issue has been fixed in the specified versions.
CVE-2026-116684 is an authorization vulnerability in the Model Context Protocol Python SDK versions 1.10.0 through before 1.30.0 and 2.0.0 through before 2.2.0. The flaw occurs when server-side bearer authentication accepts a valid token issued for a different service due to lack of independent audience (aud) validation by the TokenVerifier. This allows an attacker holding a token for one resource to authenticate to a different MCP server and gain unauthorized access. The issue is fixed in versions 1.30.0 and 2.2.0.
Neko versions 3.0.0 through 3.1.4 have an incorrect authorization vulnerability in legacy mode with session.implicit_hosting enabled. This flaw allows an authenticated room member to send mouse and keyboard events via the legacy WebRTC data-channel even when controls are locked or the member is unauthorized by the modern control API. The issue is resolved in version 3.1.5.
Adobe Campaign Classic contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability changes the security scope and has a critical severity rating with a CVSS score of 9.9.
CVE-2026-106077 is a high-severity vulnerability in Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014. It allows a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges, potentially exposing sensitive data.
A missing authentication vulnerability in the 3D Viewer app for Nextcloud versions 1.7.9 through 3.3.1 allowed unauthorized access to password-protected shared 3D model files. The app's public file endpoint did not enforce share password checks, enabling anyone with a share token to retrieve the file contents without authentication. This issue affects only 3D file formats supported by the app and was fixed in version 3.3.2.
CVE-2026-117472 is an authorization vulnerability in esaqa GmbH's Psono Server CE and EE versions 4.0.33 through 7.2.3. The issue occurs when deployments use a URL_PREFIX configuration, causing the bulk-secret-read endpoint to incorrectly authorize requests with write scope instead of read scope. This allows an authenticated attacker with a write-enabled but read-disabled API key to retrieve encrypted secret data and nonces without proper read permissions. Default configurations without URL_PREFIX are not affected. The vulnerability is fixed in version 7.2.4.
CVE-2026-116575 is a vulnerability in mem0, a persistent memory infrastructure for AI agents. Before Python SDK 2.0.18 and TypeScript SDK 3.1.6, session scope keys were constructed by joining user-controlled identifiers with unescaped delimiters, allowing attackers to craft identifiers that cause cross-tenant session key collisions. This flaw enables unauthorized access to other tenants' conversation histories, leading to exposure and potential manipulation of sensitive information. The issue is fixed in versions 2.0.18 (Python) and 3.1.6 (TypeScript).
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
CVE-2026-102649 is a critical vulnerability in padok-team's burrito Kubernetes operator versions prior to 0.13.0. The vulnerability arises from missing authentication on the POST /api/webhook endpoint when the webhookSecret is omitted or empty in TerraformRepository credentials. This allows unauthenticated attackers who can reach the endpoint and know a tracked repository URL to forge GitHub or GitLab webhook events. Exploitation can lead to unauthorized creation or deletion of TerraformPullRequest custom resources with attacker-controlled branch, base, and ID fields. This can cause unauthorized terraform plan operations and disclosure of plan details in pull request comments. The issue is fixed in version 0.13.0.
Mattermost versions 11.7.0 through 11.7.10 contain an authorization vulnerability where the API does not properly restrict which built-in roles a team admin can assign to team members. This flaw allows a team admin to grant permissions beyond the intended permission scheme via the update-team-member-roles REST API endpoint. The issue is tracked as CVE-2026-93846 with a low severity rating.