CWE-915: Mass Assignment vulnerabilities

CVE-2026-123294 is a critical vulnerability in JetBrains Hub versions before 2026.2.52556 that allows privilege escalation. The flaw involves improperly controlled modification of dynamically-determined object attributes, specifically by changing email authentication details during the verification flow. This can lead to an attacker gaining elevated privileges without user interaction. The issue is fixed in version 2026.2.52556.

CVE-2026-100361 is a vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. It involves improper control over modification of dynamically-determined object attributes in the V8 API write path. Authenticated users can exploit this flaw to mass-assign internal authentication fields, modify password hashes, or change external authentication flags, leading to unauthorized account access.

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.

A vulnerability in the Drupal Monster Menus module (versions before 9.5.6) allows improper control over modification of dynamically-determined object attributes, leading to potential object injection. This flaw is identified as CWE-915 and affects Monster Menus versions from 0.0.0 up to but not including 9.5.6. The issue has been fixed in version 9.5.6.

Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.

CVE-2026-58255 is a privilege escalation vulnerability in Cronicle task scheduler versions prior to 0.9.121. It allows a non-administrator user or scoped API key with certain privileges to inject arbitrary user and group IDs into event creation or update API calls. This injection leads to jobs running with elevated privileges, including root, bypassing intended access controls. The issue is fixed in version 0.9.121.

CVE-2026-115933 is a critical authentication bypass vulnerability in GitroomHQ's postiz-app affecting versions from 2.15.0 up to but not including 2.25.3. The application uses a single shared secret to sign multiple types of tokens (session, invitation, password reset) without distinguishing token purposes. This flaw allows an attacker to craft a valid signed token with arbitrary claims, which the application accepts as legitimate for various sensitive operations including session authentication, organization invitations with chosen roles, password resets, and enterprise provisioning. A narrower related flaw affects team invitation creation. The vulnerability has a CVSS score of 9.9 and is fixed in version 2.25.3.

CVE-2026-96378 is a vulnerability in Drupal Commerce Decoupled Checkout versions 1.0.0 through 1.7.x that allows improper modification of dynamically-determined object attributes, leading to object injection. The issue is fixed in version 1.8.0. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with limited impact on integrity and no impact on confidentiality or availability.

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

CVE-2026-97858 is a vulnerability in the EseeCloud App by Guangzhou Juan IoT Technology Co., Ltd. It allows an attacker to cause the server to unbind a target device from its current owner and rebind it to the attacker's account. This occurs regardless of whether the device is currently bound to a different account, enabling the attacker to obtain the device's full serial ID. The vulnerability is classified under CWE-915, indicating improperly controlled modification of dynamically-determined object attributes. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No patch or remediation information is provided in the available data.

CVE-2026-110804 is a vulnerability in Devolutions Server versions prior to 2026.3.10 that allows an authenticated user with PAM checkout access to improperly modify JIT elevation settings. This flaw can enable deletion of arbitrary Active Directory groups or retention of elevated privileges through client-supplied JIT elevation settings in a checkout update request.

Lychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an unrestricted additional_data array and CheckoutService::preparePurchaseParameters() merges it after server-computed purchase parameters. Because later string keys overwrite earlier keys, an unauthenticated buyer can replace amount, currency, returnUrl, cancelUrl, or transactionId before CheckoutService::processPayment() passes the parameters to a non-PayPal Omnipay gateway. An attacker can therefore make a gateway accept a successful payment for an attacker-selected amount and obtain auto-fulfilled goods while underpaying the merchant. The issue requires an enabled webshop, a purchasable item, and an affected Omnipay gateway. This issue is fixed in version 7.7.1.

CVE-2026-92119 is a critical REST API mass assignment vulnerability in Apache Allura affecting versions up to 1.21.0. It allows improper modification of dynamically-determined object attributes. The issue is fixed in version 1.22.0.

Mozilla's Node-convict version 6.2.2 is affected by a prototype pollution vulnerability in the config.set() function. This flaw allows an attacker who can control configuration keys to overwrite core JavaScript methods such as Object.assign by writing arbitrary properties to constructor.<key>. The vulnerability bypasses existing filters and can cause persistent process-wide failures, resulting in denial of service that requires a restart. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().

Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.

PayloadCMS versions from 3.0.0 up to but not including 3.90.0, and certain 4.0.0-canary versions, contain an authentication bypass vulnerability. This occurs when a custom field is mapped to a reserved authentication claim name, allowing unintended values to be placed in authentication tokens at login. The issue is fixed in version 3.90.0.

A missing authorization vulnerability exists in the Joomla extension TF Content versions 2.9.0 through 2.9.4. The extension's public RecordController allows unauthenticated users to create and edit records without proper permission checks. Attackers can use a valid token from Joomla's public login form to modify any TF Content record, including sensitive fields such as published status, access level, and creator ID.

CVE-2026-103918 is a medium severity vulnerability in the middleapi orpc package affecting the ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin. These plugins improperly handle object keys that match Object.prototype members, allowing an attacker to replace the prototype of a coerced input object or cause unhandled TypeErrors by sending keys like 'constructor'. The issue is limited to the request payload and does not affect global state or other requests. It is fixed in version 1.14.10.

CVE-2026-103036 is a medium severity vulnerability in the orpc component of middleapi prior to version 1.14.9. It involves improper control of dynamically-determined object attributes during JSON schema coercion, allowing a remote client to supply crafted __proto__ or Object.prototype properties that influence the behavior of the coerced request object. This can affect handler logic and configuration lookups without modifying global objects or other users' requests. The issue is fixed in version 1.14.9.