CVE-2026-70386 is a high-severity OS command injection vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. It allows any locally installed Android app, without declared permissions or user interaction beyond launch, to execute arbitrary shell commands as root in the dumpstate SELinux domain. This occurs due to lack of authorization on a binder interface and unsanitized input passed to a system command. Fixed versions are 15.0.0.2000 and 16.0.5.1200.
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment identifier obtained from any single genuine payment.
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
CVE-2026-71195 is a critical authorization vulnerability in OpenStack Manila before version 23.0.1. It allows any authenticated project member to perform unauthorized operations on public shares owned by other tenants. These operations include granting or revoking access, escalating access levels, creating backups to exfiltrate data, deleting or restoring shares, modifying export location metadata, and listing access rules that disclose sensitive information. The flaw arises because the API controllers authorize operations based on the caller's project context but fail to re-authorize against the actual share owner for public shares.
Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.
To remediate this issue, users should upgrade to version 0.7.2.
CVE-2026-97406 is a critical vulnerability in the Xerj Console API version 1.0.0-rc.11 where bearer tokens can bypass the intended passkey-only authentication. This flaw allows unauthorized users to invoke the API-token creation endpoint directly, enabling them to mint persistent successor credentials without proper authorization.
CVE-2026-92539 is an authorization bypass vulnerability in Grafana Enterprise affecting instances with SCIM enabled. A service account with user-management permissions in one organization can improperly access and manipulate users in other organizations on the same Grafana instance via the SCIM API. This issue arises from insecure direct object references. The vulnerability has a CVSS score of 6.7 (medium severity) and affects multiple versions of Grafana Enterprise prior to fixed releases.
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or expressly enabled public API. Inadequately limited templates, including serialization of an entire related user object, can conditionally disclose user fields, but relationships do not automatically publish full user objects and password hashes are stored separately and are not affected. This issue is fixed in version 4.33.0.
SolarWinds Observability Self-Hosted contains an incorrect authorization vulnerability (CWE-863) that allows low-privileged users to access and modify data beyond their permissions. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high CVSS score of 8.8, indicating significant risk. No affected versions or patch information are provided.
## Review scope and evidence limits
Package: @apostrophecms/import-export, version 3.7.0.
Release tag reviewed: @apostrophecms/import-export@3.7.0, commit 9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce (September 30, 2026).
Current main reviewed: 5ce3732be0ebdebb4db0f8ef160c81e8671157e6.
The importer, gzip extractor, import permission gate, and core permission implementation have no differences between that release tag and the reviewed main. This follow-up is a static remediation review. We have not repeated the original end-to-end reproductions against the latest release or tested a deployed site. Current exploitability and impact therefore still require maintainer validation; the observations below establish that the reported security checks remain absent in public source. The original emailed PDF contains the original reproduction material. Please refer to that existing private attachment.
## Archive duplicate continuation permits unauthorized published-content replacement
The overrideDuplicates() continuation still accepts client-supplied replacement choices, rather than binding them to a server-maintained, user-owned duplicate analysis. The replacement and write helpers do not establish a single canonical resource identity and authorization context before the update. This leaves the reported gap between draft editing authority and the published target selected for replacement unresolved at source level.
The original report describes a contributor crossing the publication boundary through duplicate replacement on an import-enabled localized type. We have not repeated that end-to-end sequence on 3.7.0.
Suggested remediation: bind continuation state to the initiating user, archive, job, permitted source/target mapping, locale and mode; reject inconsistent identity metadata; derive permissions from the actual loaded target and require publication authority for published targets.
Source: overrideDuplicates(), replaceDocId(), and insertOrUpdateDoc() in the [importer](https://github.com/apostrophecms/apostrophe/blob/5ce3732be0ebdebb4db0f8ef160c81e8671157e6/packages/import-export/lib/methods/import.js).
## Coordination
Vivek R / Winfunc
Original reporting team: Mufeed VH / Winfunc
CVE-2026-12489 is an incorrect authorization vulnerability in the Data Access Layer of Zyxel EX3501-T0 firmware up to version 5.44(ACHR.6)C0. It allows an authenticated attacker to escalate privileges by modifying login privilege data on the device. The vulnerability has a CVSS score of 6.5, indicating medium severity. No patch or remediation information is provided in the available data.
CVE-2026-111046 is a low-severity missing authorization vulnerability in FOSSBilling versions 0.8.4 through 0.8.5. It allows a low-privileged staff user with module-level extension access to read and overwrite configuration of deactivated non-core modules via specific API endpoints. The flaw arises because the permission check fails to enforce restrictions on inactive modules, exposing decrypted extension secrets. This issue was fixed in version 0.8.6.
CVE-2026-67249 is an authorization vulnerability in Apache Answer versions up to 2.0.2. It allows a verification code issued for one email-based workflow to be improperly accepted by another sensitive workflow, potentially enabling unauthorized actions. The issue is resolved in version 2.0.3.
CVE-2026-64945 is an authorization vulnerability in Apache Answer versions up to 2.0.2. The question operation controller incorrectly uses the unpin permission check instead of the hide permission check for gating hide/show operations. This allows users with only the question.unpin permission to hide or restore questions without having the proper question.hide or question.show permissions. The issue is fixed in version 2.0.3.
CVE-2026-103091 is a critical vulnerability in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authorization and insecure default initialization in the MCP proxy and OIDC registration flow, allowing remote attackers to self-enroll and gain full read, write, and execution access on backend services. The flaw arises because the GET /info endpoint publicly exposes OIDC configuration, and the POST /register endpoint auto-enrolls any valid OIDC token holder without claim filtering or ban checks. The default policy binds authenticated users to wildcard services and targets, enabling broad unauthorized access. The issue is fixed in version 0.1.0-alpha.9, which enforces stricter policy controls and ban checks.
CVE-2026-97204 is an authorization vulnerability in Gitea affecting versions up to 28.1.0. It allows a user with write access to repository issues to delete organization labels if the numeric ID of the repository matches that of the organization. This occurs due to improper ID comparison when deleting labels. The issue has a low severity score and no known exploits in the wild.
The Salon Booking System WordPress plugin before version 10.31.11 contains an authorization flaw that allows users with Salon Staff or Salon Worker roles to modify other user accounts. This includes resetting any user's role, even administrators, to a customer and overwriting profile fields, which can lead to loss of administrative access and potential site lockout.
CVE-2026-111044 is an incorrect authorization vulnerability in LizardByte Sunshine, a self-hosted game stream host for Moonlight. Between versions 2026.329.165800 and before 2026.906.222525, Sunshine accepted any client certificate chaining to a stored paired-client certificate without requiring the exact paired identity. This allowed a previously paired client to bypass the Disable control by presenting an alternate certificate derived from its paired certificate. The issue also involved inconsistent client identity handling due to lack of canonicalization of equivalent PEM encodings. The vulnerability does not affect clients that were never paired and is fixed in version 2026.906.222525.