Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
18003 vulnerabilities reference this CWE, most recent first.
CVE-2026-47728 (GCVE-0-2026-47728)
Vulnerability from cvelistv5 – Published: 2026-05-26 16:16 – Updated: 2026-05-26 17:31
VLAI
EPSS
VEX
Title
Bugsink: Project scoping missing in sourcemap and debug-file lookup
Summary
Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-26 17:25 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/bugsink/bugsink/security/advis… | x_refsource_CONFIRM |
| https://github.com/bugsink/bugsink/releases/tag/2.2.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47728",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-26T17:25:58.254467Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T17:31:41.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bugsink",
"vendor": "bugsink",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the project that owned the uploaded metadata. An authenticated user with access to one project could cause event processing in that project to use sourcemap/debug-file metadata uploaded for another project in the same Bugsink instance, if the same debug ID was referenced. This vulnerability is fixed in 2.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-26T16:16:10.858Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-5389-f7vh-wxj8"
},
{
"name": "https://github.com/bugsink/bugsink/releases/tag/2.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bugsink/bugsink/releases/tag/2.2.0"
}
],
"source": {
"advisory": "GHSA-5389-f7vh-wxj8",
"discovery": "UNKNOWN"
},
"title": "Bugsink: Project scoping missing in sourcemap and debug-file lookup"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47728",
"datePublished": "2026-05-26T16:16:10.858Z",
"dateReserved": "2026-05-19T21:29:25.483Z",
"dateUpdated": "2026-05-26T17:31:41.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47724 (GCVE-0-2026-47724)
Vulnerability from cvelistv5 – Published: 2026-07-23 20:20 – Updated: 2026-07-28 14:55
VLAI
EPSS
VEX
Title
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
Summary
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case. Version 0.3.4 fixes the issue.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 14:29 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/forgekeep/nebula-mesh/security… | x_refsource_CONFIRM |
| https://github.com/forgekeep/nebula-mesh/commit/9… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| juev | nebula-mesh |
Affected:
< 0.3.4
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47724",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:29:11.247252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:55:31.612Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "nebula-mesh",
"vendor": "juev",
"versions": [
{
"status": "affected",
"version": "\u003c 0.3.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: \"API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer.\" The Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access \u2014 instant privilege escalation in the worst case. Version 0.3.4 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T20:20:59.494Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-598g-h2vc-h5vg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-598g-h2vc-h5vg"
},
{
"name": "https://github.com/forgekeep/nebula-mesh/commit/9d8bcd7667ecd0c2975cc71fb35a02fe131f76f2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/forgekeep/nebula-mesh/commit/9d8bcd7667ecd0c2975cc71fb35a02fe131f76f2"
}
],
"source": {
"advisory": "GHSA-598g-h2vc-h5vg",
"discovery": "UNKNOWN"
},
"title": "nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47724",
"datePublished": "2026-07-23T20:20:59.494Z",
"dateReserved": "2026-05-19T21:29:25.482Z",
"dateUpdated": "2026-07-28T14:55:31.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47721 (GCVE-0-2026-47721)
Vulnerability from cvelistv5 – Published: 2026-08-18 20:00 – Updated: 2026-08-19 15:21
VLAI
EPSS
VEX
Title
FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
Summary
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 15:21 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/frangoteam/FUXA/security/advis… | x_refsource_CONFIRM |
| https://github.com/frangoteam/FUXA/pull/2345 | x_refsource_MISC |
| https://github.com/frangoteam/FUXA/commit/3c945a0… | x_refsource_MISC |
| https://github.com/frangoteam/FUXA/releases/tag/v1.3.2 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| frangoteam | FUXA |
Affected:
< 1.3.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T15:21:25.802999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T15:21:35.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FUXA",
"vendor": "frangoteam",
"versions": [
{
"status": "affected",
"version": "\u003c 1.3.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator\u0027s session ends. This issue is fixed in version 1.3.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T20:00:19.405Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr"
},
{
"name": "https://github.com/frangoteam/FUXA/pull/2345",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frangoteam/FUXA/pull/2345"
},
{
"name": "https://github.com/frangoteam/FUXA/commit/3c945a03f9942fd45a793ab7e3c2d1f1b15b93bf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frangoteam/FUXA/commit/3c945a03f9942fd45a793ab7e3c2d1f1b15b93bf"
},
{
"name": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2"
}
],
"source": {
"advisory": "GHSA-8ghr-w65f-j3qr",
"discovery": "UNKNOWN"
},
"title": "FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47721",
"datePublished": "2026-08-18T20:00:19.405Z",
"dateReserved": "2026-05-19T21:29:25.482Z",
"dateUpdated": "2026-08-19T15:21:35.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47718 (GCVE-0-2026-47718)
Vulnerability from cvelistv5 – Published: 2026-08-12 22:21 – Updated: 2026-08-14 22:23
VLAI
EPSS
VEX
Title
FUXA provides guest and invalid-token access to protected read APIs in secure mode
Summary
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 22:22 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frangoteam/FUXA/security/advis… | x_refsource_CONFIRM |
| https://github.com/frangoteam/FUXA/releases/tag/v1.3.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| frangoteam | FUXA |
Affected:
= 1.3.0-2773
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47718",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T22:22:30.187312Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T22:23:07.950Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-r9g5-7q8j-958c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FUXA",
"vendor": "frangoteam",
"versions": [
{
"status": "affected",
"version": "= 1.3.0-2773"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T22:21:26.952Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-r9g5-7q8j-958c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-r9g5-7q8j-958c"
},
{
"name": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
}
],
"source": {
"advisory": "GHSA-r9g5-7q8j-958c",
"discovery": "UNKNOWN"
},
"title": "FUXA provides guest and invalid-token access to protected read APIs in secure mode"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47718",
"datePublished": "2026-08-12T22:21:26.952Z",
"dateReserved": "2026-05-19T21:29:25.482Z",
"dateUpdated": "2026-08-14T22:23:07.950Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47688 (GCVE-0-2026-47688)
Vulnerability from cvelistv5 – Published: 2026-07-21 20:40 – Updated: 2026-07-22 13:41
VLAI
EPSS
VEX
Title
FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules
Summary
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
Severity
8.2 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-22 13:41 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/FOGProject/fogproject/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| FOGProject | fogproject |
Affected:
< 1.5.10.1832
Affected: < 1.6.0-beta.2313 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47688",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T13:41:28.966954Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T13:41:39.164Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "fogproject",
"vendor": "FOGProject",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.10.1832"
},
{
"status": "affected",
"version": "\u003c 1.6.0-beta.2313"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T20:40:31.480Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg"
}
],
"source": {
"advisory": "GHSA-95pr-mcrf-x2qg",
"discovery": "UNKNOWN"
},
"title": "FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47688",
"datePublished": "2026-07-21T20:40:31.480Z",
"dateReserved": "2026-05-19T21:18:20.403Z",
"dateUpdated": "2026-07-22T13:41:39.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47657 (GCVE-0-2026-47657)
Vulnerability from cvelistv5 – Published: 2026-07-21 17:50 – Updated: 2026-07-21 18:36
VLAI
EPSS
VEX
Title
HumHub Missing Authorization on Remove All Space Members Action
Summary
HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 18:36 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/humhub/humhub/security/advisor… | x_refsource_CONFIRM |
| https://github.com/humhub/humhub/pull/8163 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47657",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T18:36:34.679489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T18:36:42.028Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "humhub",
"vendor": "humhub",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.13.0, \u003c 1.18.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Space, regardless of their own role or membership in that Space. Versions 1.13.0 through 1.18.2 are affected. The vulnerability has been patched in version 1.18.3, and all users are encouraged to upgrade to this version or later immediately. No known workaround is available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T17:50:08.427Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/humhub/humhub/security/advisories/GHSA-hj67-5q6h-j7c2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/humhub/humhub/security/advisories/GHSA-hj67-5q6h-j7c2"
},
{
"name": "https://github.com/humhub/humhub/pull/8163",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/humhub/humhub/pull/8163"
}
],
"source": {
"advisory": "GHSA-hj67-5q6h-j7c2",
"discovery": "UNKNOWN"
},
"title": "HumHub Missing Authorization on Remove All Space Members Action"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47657",
"datePublished": "2026-07-21T17:50:08.427Z",
"dateReserved": "2026-05-19T21:10:38.796Z",
"dateUpdated": "2026-07-21T18:36:42.028Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47625 (GCVE-0-2026-47625)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:09 – Updated: 2026-09-08 18:01
VLAI
EPSS
VEX
Summary
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 18:01 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | Triton Inference Server |
Affected:
0.0-26.03
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47625",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T18:01:40.172556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T18:01:46.533Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Triton Inference Server",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "0.0-26.03"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service."
}
],
"value": "NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "data tampering, denial of service, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:09:09.303Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47625"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47625"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5875"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-47625",
"datePublished": "2026-09-08T16:09:09.303Z",
"dateReserved": "2026-05-19T19:55:52.529Z",
"dateUpdated": "2026-09-08T18:01:46.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47604 (GCVE-0-2026-47604)
Vulnerability from cvelistv5 – Published: 2026-09-30 15:54 – Updated: 2026-09-30 17:29
VLAI
EPSS
VEX
Summary
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 16:45 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
30 products
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 610.88
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 610.88
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 616.56
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 616.92
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 582.78
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 596.86
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 596.86
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 616.92
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 610.88
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 615.71.09
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 610.57.04
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 615.71.09
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 610.57.04
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 595.91.07
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 580.178.04
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 615.71.09
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 610.57.04
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 595.91.07
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 580.178.04
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 595.91.07
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 580.178.04
|
|
| NVIDIA | Guest driver |
Affected:
596.36(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Guest driver |
Affected:
582.53(All versions prior to and including vGPU 19.5)
|
|
| NVIDIA | Guest driver |
Affected:
595.71.05(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Guest driver |
Affected:
580.159.03(All versions prior to and including vGPU 19.5)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
595.71.03(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
580.159.01(All versions prior to and including vGPU 19.5)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
596.38(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
582.51(All versions prior to and including vGPU 19.5)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47604",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T16:45:58.913327Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:29:28.388Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.56"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.92"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected."
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 582.78"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R595)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R595)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.92"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R615)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 615.71.09"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R610)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.57.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R615)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 615.71.09"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R610)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.57.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R595)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 595.91.07"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R580)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 580.178.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R615)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 615.71.09"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R610)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.57.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R595)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 595.91.07"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R580)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 580.178.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R595)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 595.91.07"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R580)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 580.178.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(vGPU 20)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "596.36(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(vGPU 19)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "582.53(All versions prior to and including vGPU 19.5)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(vGPU 20)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "595.71.05(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(vGPU 19)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "580.159.03(All versions prior to and including vGPU 19.5)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "595.71.03(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "580.159.01(All versions prior to and including vGPU 19.5)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Azure Local, Windows Server(vGPU 20)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "596.38(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Azure Local, Windows Server(vGPU 19)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "582.51(All versions prior to and including vGPU 19.5)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process\u0027s GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."
}
],
"value": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process\u0027s GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:54:18.109Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47604"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47604"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-47604",
"datePublished": "2026-09-30T15:54:18.109Z",
"dateReserved": "2026-05-19T19:55:50.277Z",
"dateUpdated": "2026-09-30T17:29:28.388Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47603 (GCVE-0-2026-47603)
Vulnerability from cvelistv5 – Published: 2026-09-30 15:54 – Updated: 2026-09-30 17:59
VLAI
EPSS
VEX
Summary
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 17:41 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
30 products
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 610.88
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 610.88
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 616.56
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 616.92
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 582.78
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 596.86
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 596.86
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 616.92
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 610.88
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 615.71.09
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 610.57.04
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 615.71.09
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 610.57.04
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 595.91.07
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 580.178.04
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 615.71.09
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 610.57.04
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 595.91.07
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 580.178.04
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 595.91.07
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 580.178.04
|
|
| NVIDIA | Guest driver |
Affected:
596.36(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Guest driver |
Affected:
582.53(All versions prior to and including vGPU 19.5)
|
|
| NVIDIA | Guest driver |
Affected:
595.71.05(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Guest driver |
Affected:
580.159.03(All versions prior to and including vGPU 19.5)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
595.71.03(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
580.159.01(All versions prior to and including vGPU 19.5)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
596.38(All versions prior to and including vGPU 20.1)
|
|
| NVIDIA | Virtual GPU Manager |
Affected:
582.51(All versions prior to and including vGPU 19.5)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T17:41:47.656066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:59:45.231Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.56"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.92"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected."
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 582.78"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R595)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R595)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.92"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R615)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 615.71.09"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R610)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.57.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R615)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 615.71.09"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R610)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.57.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R595)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 595.91.07"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R580)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 580.178.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R615)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 615.71.09"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R610)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.57.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R595)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 595.91.07"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R580)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 580.178.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R595)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 595.91.07"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(R580)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 580.178.04"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(vGPU 20)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "596.36(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(vGPU 19)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "582.53(All versions prior to and including vGPU 19.5)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(vGPU 20)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "595.71.05(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux(vGPU 19)"
],
"product": "Guest driver",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "580.159.03(All versions prior to and including vGPU 19.5)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 20)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "595.71.03(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"XenServer, VMware vSphere, Red Hat Enterprise Linux KVM, Ubuntu(vGPU 19)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "580.159.01(All versions prior to and including vGPU 19.5)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Azure Local, Windows Server(vGPU 20)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "596.38(All versions prior to and including vGPU 20.1)"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Azure Local, Windows Server(vGPU 19)"
],
"product": "Virtual GPU Manager",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "582.51(All versions prior to and including vGPU 19.5)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process\u0027s GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."
}
],
"value": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process\u0027s GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:54:16.928Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47603"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47603"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-47603",
"datePublished": "2026-09-30T15:54:16.928Z",
"dateReserved": "2026-05-19T19:55:50.277Z",
"dateUpdated": "2026-09-30T17:59:45.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47580 (GCVE-0-2026-47580)
Vulnerability from cvelistv5 – Published: 2026-09-30 15:51 – Updated: 2026-09-30 17:29
VLAI
EPSS
VEX
Summary
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 17:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 610.60
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 610.88
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 616.56
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 616.92
|
|
| NVIDIA | GeForce |
Affected:
All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected.
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 582.78
|
|
| NVIDIA | RTX, Quadro, NVS |
Affected:
All driver versions prior to 596.86
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 596.86
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 616.92
|
|
| NVIDIA | Tesla |
Affected:
All driver versions prior to 610.88
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T17:17:15.181410Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:29:30.749Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.60"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.56"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.92"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "GeForce",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 582.78 Only GPUs based on the NVIDIA Maxwell, Volta, and Pascal GPU architectures are affected."
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 582.78"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R595)"
],
"product": "RTX, Quadro, NVS",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R595)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R580)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 596.86"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R615)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 616.92"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows(R610)"
],
"product": "Tesla",
"vendor": "NVIDIA",
"versions": [
{
"status": "affected",
"version": "All driver versions prior to 610.88"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering."
}
],
"value": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "data tampering, information disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T15:51:26.126Z",
"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"shortName": "nvidia"
},
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47580"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47580"
},
{
"url": "https://github.com/NVIDIA/product-security/tree/main/2026/5861"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "NVIDIA PSIRT"
}
}
},
"cveMetadata": {
"assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6",
"assignerShortName": "nvidia",
"cveId": "CVE-2026-47580",
"datePublished": "2026-09-30T15:51:26.126Z",
"dateReserved": "2026-05-19T19:55:47.438Z",
"dateUpdated": "2026-09-30T17:29:30.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.