Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
17642 vulnerabilities reference this CWE, most recent first.
CVE-2026-83628 (GCVE-0-2026-83628)
Vulnerability from cvelistv5 – Published: 2026-09-05 05:30 – Updated: 2026-09-07 11:17
VLAI
EPSS
VEX
Title
Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
Summary
The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-07 11:08 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jfarthing84 | Theme My Login |
Affected:
0 , ≤ 7.1.15
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83628",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-07T11:08:28.886813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T11:17:26.627Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Theme My Login",
"vendor": "jfarthing84",
"versions": [
{
"lessThanOrEqual": "7.1.15",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Maksim Hayder (tr_jan)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function\u0027s `gimmeanotherblog` branch failing to enforce the network\u0027s `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login\u0027s signup route, bypassing the configured registration policy entirely \u2014 even when it is set to `none` or `user` \u2014 which causes `wpmu_create_blog()` to execute with the attacker\u0027s user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker\u0027s account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T05:30:55.158Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72585c12-baa9-4c63-8584-906a1d3b332f?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/theme-my-login/tags/7.1.15/includes/ms-functions.php#L708"
},
{
"url": "https://plugins.trac.wordpress.org/browser/theme-my-login/tags/7.1.15/includes/ms-functions.php#L661"
},
{
"url": "https://plugins.trac.wordpress.org/browser/theme-my-login/tags/7.1.15/includes/ms-functions.php#L580"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3669722%40theme-my-login%2Ftags%2F7.2.0\u0026old=3643898%40theme-my-login%2Ftags%2F7.1.15"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3669721/theme-my-login/trunk/includes/ms-functions.php"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Ftheme-my-login/tags/7.1.15\u0026new_path=%2Ftheme-my-login/tags/7.2.0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-04T17:10:41.000Z",
"value": "Disclosed"
}
],
"title": "Theme My Login \u003c= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via \u0027gimmeanotherblog\u0027 Signup Stage"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-83628",
"datePublished": "2026-09-05T05:30:55.158Z",
"dateReserved": "2026-08-31T21:17:50.889Z",
"dateUpdated": "2026-09-07T11:17:26.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-83621 (GCVE-0-2026-83621)
Vulnerability from cvelistv5 – Published: 2026-09-21 16:08 – Updated: 2026-09-21 20:45
VLAI
EPSS
VEX
Title
ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs
Summary
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:40 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ntop/ntopng/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/ntop/ntopng/commit/1d0627d802c… | x_refsource_MISC |
| https://github.com/ntop/ntopng/commit/669589fe208… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-83621",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:40:33.282816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:45:33.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ntopng",
"vendor": "ntop",
"versions": [
{
"status": "affected",
"version": "\u003c 6.7.260717"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng\u0027s threat-intelligence monitoring. This issue is fixed in version 6.7.260717."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:08:23.333Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ntop/ntopng/security/advisories/GHSA-ffg5-889g-f5q8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-ffg5-889g-f5q8"
},
{
"name": "https://github.com/ntop/ntopng/commit/1d0627d802c59130c82478a4eb7f14014064eae5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ntop/ntopng/commit/1d0627d802c59130c82478a4eb7f14014064eae5"
},
{
"name": "https://github.com/ntop/ntopng/commit/669589fe208fc932fe40a840e0de8e4d9df6023f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ntop/ntopng/commit/669589fe208fc932fe40a840e0de8e4d9df6023f"
}
],
"source": {
"advisory": "GHSA-ffg5-889g-f5q8",
"discovery": "UNKNOWN"
},
"title": "ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-83621",
"datePublished": "2026-09-21T16:08:23.333Z",
"dateReserved": "2026-08-31T20:36:25.744Z",
"dateUpdated": "2026-09-21T20:45:33.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82964 (GCVE-0-2026-82964)
Vulnerability from cvelistv5 – Published: 2026-09-16 14:01 – Updated: 2026-09-17 18:42
VLAI
EPSS
VEX
Title
Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys
Summary
Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.
When the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.
The absence of an IRP_MJ_SET_SECURITY callback in the driver's operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:41 UTC
CWE
Assigner
References
6 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Gen Digital | Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security |
Affected:
0 , < 26.8
(custom)
|
|
| Gen Digital | AVG Antivirus Free, AVG Internet Security, AVG Ultimate |
Affected:
0 , < 26.8
(custom)
|
|
| Gen Digital | Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced |
Affected:
0 , < 26.8
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82964",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:41:32.262077Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:42:28.924Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "Avast Free Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "AVG Antivirus Free, AVG Internet Security, AVG Ultimate",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Windows"
],
"product": "Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced",
"vendor": "Gen Digital",
"versions": [
{
"lessThan": "26.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "MSNightmare, independent security researcher"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper preservation of permissions in the Avast sandbox minifilter driver (\u003ccode\u003easwSnx.sys\u003c/code\u003e) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.\u003c/p\u003e\u003cp\u003eWhen the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with \u003ccode\u003eGENERIC_WRITE\u003c/code\u003e and \u003ccode\u003eFILE_WRITE_ATTRIBUTES\u003c/code\u003e only, omitting \u003ccode\u003eWRITE_DAC\u003c/code\u003e. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the \u003ccode\u003eIRP_MJ_CREATE\u003c/code\u003e callback additionally did not strip \u003ccode\u003eWRITE_DAC\u003c/code\u003e for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.\u003c/p\u003e\u003cp\u003eThe absence of an \u003ccode\u003eIRP_MJ_SET_SECURITY\u003c/code\u003e callback in the driver\u0027s operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack.\u003c/p\u003e"
}
],
"value": "Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside the sandbox to escape file isolation and escalate to SYSTEM.\n\n\n\nWhen the sandbox virtualizes a file it copies the original security descriptor, but the driver opened the virtualization target object with GENERIC_WRITE and FILE_WRITE_ATTRIBUTES only, omitting WRITE_DAC. Every attempt to apply the original DACL therefore failed, and the failure was discarded silently, leaving virtualized copies of sensitive files with permissive permissions. Because the IRP_MJ_CREATE callback additionally did not strip WRITE_DAC for sensitive directories, a sandboxed process could rewrite the security descriptor of a virtualized object, read the virtualized copy of the SAM database, extract local NTLM password hashes and execute code as SYSTEM.\n\n\n\nThe absence of an IRP_MJ_SET_SECURITY callback in the driver\u0027s operation registration table is a related defense-in-depth gap, but it is not the control that prevents this attack."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Successful exploitation allows a local, low-privileged attacker to escape the Avast sandbox, read security-sensitive virtualized file copies including SAM content, extract local NTLM password hashes and execute code with SYSTEM privileges."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281: Improper Preservation of Permissions",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-653",
"description": "CWE-653: Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:41:18.249Z",
"orgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"shortName": "GEN"
},
"references": [
{
"name": "Gen Digital Security Advisories",
"tags": [
"vendor-advisory"
],
"url": "https://www.gendigital.com/us/en/contact-us/security-advisories/"
},
{
"name": "Avast: how to update Avast Antivirus or Avast One",
"tags": [
"patch"
],
"url": "https://support.avast.com/en-us/article/Update-Antivirus"
},
{
"name": "AVG: updating AVG AntiVirus",
"tags": [
"patch"
],
"url": "https://support.avg.com/SupportArticleView?l=en\u0026urlname=Update-AVG-Antivirus"
},
{
"name": "Norton: keep your Norton device security up to date",
"tags": [
"patch"
],
"url": "https://support.norton.com/sp/en/us/home/current/solutions/v20240108175512167"
},
{
"name": "PrettyPrague public proof-of-concept",
"tags": [
"exploit"
],
"url": "https://github.com/MSNightmare/PrettyPrague"
},
{
"name": "Finder\u0027s public disclosure announcement",
"url": "https://x.com/msnightmare2000/status/2094106041046765752"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGen Digital has released a fix as an \u003cstrong\u003eautomatic micro-update to the sandbox driver\u003c/strong\u003e. No product upgrade or reinstallation is required, and the product version number does not change.\u003c/p\u003e\u003cp\u003eBecause the fix replaces a kernel-mode driver, \u003cstrong\u003ea device restart is required to load it\u003c/strong\u003e. Until the device is restarted the previous driver stays active and the system remains vulnerable. The application notifies the user to restart.\u003c/p\u003e\u003cul\u003e\u003cli\u003e26.7 release line: fixed driver version \u003ccode\u003e26.7.1021.0\u003c/code\u003e\u003c/li\u003e\u003cli\u003e26.8 release line: fixed driver version \u003ccode\u003e26.8.1020.0\u003c/code\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eThe update was published for Avast, AVG and Norton on 2026-09-04.\u003c/p\u003e\u003cp\u003eBecause the fix is delivered as a driver replacement rather than a product version increment, administrators who need to confirm remediation should verify that the \u003cstrong\u003erunning sandbox driver\u003c/strong\u003e (\u003ccode\u003easwSnx.sys\u003c/code\u003e on Avast, \u003ccode\u003eavgSnx.sys\u003c/code\u003e on AVG, \u003ccode\u003enllSnx.sys\u003c/code\u003e on Norton) is at or above the fixed version after the restart, rather than checking the product version.\u003c/p\u003e\u003cp\u003eInstallations on release lines earlier than 26.7 do not receive these micro-updates and remain affected.\u003c/p\u003e"
}
],
"value": "Gen Digital has released a fix as an automatic micro-update to the sandbox driver. No product upgrade or reinstallation is required, and the product version number does not change.\n\n\n\nBecause the fix replaces a kernel-mode driver, a device restart is required to load it. Until the device is restarted the previous driver stays active and the system remains vulnerable. The application notifies the user to restart.\n\n * 26.7 release line: fixed driver version 26.7.1021.0\n * 26.8 release line: fixed driver version 26.8.1020.0\n\n\n\n\nThe update was published for Avast, AVG and Norton on 2026-09-04.\n\n\n\nBecause the fix is delivered as a driver replacement rather than a product version increment, administrators who need to confirm remediation should verify that the running sandbox driver (aswSnx.sys on Avast, avgSnx.sys on AVG, nllSnx.sys on Norton) is at or above the fixed version after the restart, rather than checking the product version.\n\n\n\nInstallations on release lines earlier than 26.7 do not receive these micro-updates and remain affected."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApplying the driver micro-update described under Solution is the only complete remediation.\u003c/p\u003e\u003cp\u003eWhere that update cannot be applied, Gen Digital ships detection for exploitation attempts against this issue, so keeping product virus definitions current provides detection of the publicly released proof-of-concept. \u003cstrong\u003eDetection of a known proof-of-concept is not equivalent to the code fix and does not prevent variants.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eWhere the sandbox feature is not required, disabling it removes exposure to this attack path.\u003c/p\u003e"
}
],
"value": "Applying the driver micro-update described under Solution is the only complete remediation.\n\n\n\nWhere that update cannot be applied, Gen Digital ships detection for exploitation attempts against this issue, so keeping product virus definitions current provides detection of the publicly released proof-of-concept. Detection of a known proof-of-concept is not equivalent to the code fix and does not prevent variants.\n\n\n\nWhere the sandbox feature is not required, disabling it removes exposure to this attack path."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbd8429d-f261-4b1e-94cc-ae3132817e2e",
"assignerShortName": "GEN",
"cveId": "CVE-2026-82964",
"datePublished": "2026-09-16T14:01:47.369Z",
"dateReserved": "2026-08-31T13:57:13.454Z",
"dateUpdated": "2026-09-17T18:42:28.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82885 (GCVE-0-2026-82885)
Vulnerability from cvelistv5 – Published: 2026-09-18 19:31 – Updated: 2026-09-23 03:55
VLAI
EPSS
VEX
Title
IBM Guardium Data Protection is affected by multiple vulnerabilities.
Summary
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 00:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7288035 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Guardium Data Protection |
Affected:
12.2
cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82885",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T03:55:47.883Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"
],
"product": "Guardium Data Protection",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "12.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.\u003c/p\u003e"
}
],
"value": "IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:31:10.794Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7288035"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eIBM encourages customers to update their systems promptly.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Product\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersions\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Fix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Data Protection\u003c/td\u003e\u003ctd\u003e12.2\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=12.2\u0026amp;platform=Linux\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p233_FixPack\u0026amp;includeSupersedes=0\u0026amp;source=fc\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=12.2\u0026amp;platform=Linux\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p233_FixPack\u0026amp;includeSupersedes=0\u0026amp;source=fc\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.2 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026product=ibm/Information+Management/InfoSphere+Guardium\u0026release=12.2\u0026platform=Linux\u0026function=fixId\u0026fixids=SqlGuard_12.0p233_FixPack\u0026includeSupersedes=0\u0026source=fc"
}
],
"title": "IBM Guardium Data Protection is affected by multiple vulnerabilities."
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-82885",
"datePublished": "2026-09-18T19:31:10.794Z",
"dateReserved": "2026-08-31T09:02:30.446Z",
"dateUpdated": "2026-09-23T03:55:47.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82882 (GCVE-0-2026-82882)
Vulnerability from cvelistv5 – Published: 2026-08-31 21:11 – Updated: 2026-09-24 14:20
VLAI
EPSS
VEX
Title
Devtron through 2.2.0 Missing Authorization via webhook API token endpoint
Summary
Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 14:55 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/devtron-labs/devtron/issues/7013 | issue-tracking |
| https://github.com/devtron-labs/devtron | product |
| https://github.com/devtron-labs/devtron/blob/v2.2… | technical-description |
| https://github.com/devtron-labs/devtron/blob/v2.2… | technical-description |
| https://www.vulncheck.com/advisories/devtron-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| devtron-labs | devtron |
Affected:
0 , ≤ 2.2.0
(semver)
cpe:2.3:a:devtron:devtron:*:*:*:*:*:*:*:* |
Date Public
2026-08-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82882",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T14:55:22.356310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T14:55:30.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/devtron-labs/devtron/issues/7013"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/devtron-labs/devtron",
"product": "devtron",
"vendor": "devtron-labs",
"versions": [
{
"lessThanOrEqual": "2.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:devtron:devtron:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:20:36.690Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #7013",
"tags": [
"issue-tracking"
],
"url": "https://github.com/devtron-labs/devtron/issues/7013"
},
{
"tags": [
"product"
],
"url": "https://github.com/devtron-labs/devtron"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/devtron-labs/devtron/blob/v2.2.0/api/apiToken/ApiTokenRestHandler.go"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/devtron-labs/devtron/blob/v2.2.0/pkg/apiToken/ApiTokenService.go"
},
{
"name": "VulnCheck Advisory: Devtron through 2.2.0 Missing Authorization via webhook API token endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/devtron-through-2.2.0-missing-authorization-via-webhook-api-token-endpoint"
}
],
"title": "Devtron through 2.2.0 Missing Authorization via webhook API token endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82882",
"datePublished": "2026-08-31T21:11:01.297Z",
"dateReserved": "2026-08-31T08:38:43.269Z",
"dateUpdated": "2026-09-24T14:20:36.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82878 (GCVE-0-2026-82878)
Vulnerability from cvelistv5 – Published: 2026-08-31 10:51 – Updated: 2026-08-31 15:21
VLAI
EPSS
VEX
Title
DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
Summary
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 15:20 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/dataease/dataease/security/adv… | vendor-advisory |
| https://github.com/dataease/dataease/commit/5fe46… | patch |
| https://github.com/dataease/dataease/releases/tag… | release-notes |
| https://github.com/dataease/dataease | product |
| https://www.vulncheck.com/advisories/dataease-bef… | third-party-advisory |
Impacted products
Date Public
2026-07-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82878",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T15:20:11.483819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T15:21:51.410Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/dataease/dataease",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/dataease/dataease",
"product": "dataease",
"repo": "https://github.com/dataease/dataease",
"vendor": "dataease",
"versions": [
{
"lessThan": "2.10.26",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.10.26",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:dataease:dataease:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.10.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dikai Zou"
}
],
"datePublic": "2026-07-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete map geometry, modify dashboard linkages, and retrieve chart metadata and configuration for resources they do not own by supplying arbitrary identifiers in requests."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T10:51:04.541Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-494p-38q6-9gx5)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/dataease/dataease/security/advisories/GHSA-494p-38q6-9gx5"
},
{
"tags": [
"patch"
],
"url": "https://github.com/dataease/dataease/commit/5fe46c489876d5decdfcde36d20b1c618d472cbb"
},
{
"name": "DataEase v2.10.26 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/dataease/dataease/releases/tag/v2.10.26"
},
{
"tags": [
"product"
],
"url": "https://github.com/dataease/dataease"
},
{
"name": "VulnCheck Advisory: DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/dataease-before-2.10.26-missing-object-level-authorization-on-geographic-linkage-and-chart-endpoints"
}
],
"title": "DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82878",
"datePublished": "2026-08-31T10:51:04.541Z",
"dateReserved": "2026-08-31T08:38:43.268Z",
"dateUpdated": "2026-08-31T15:21:51.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82871 (GCVE-0-2026-82871)
Vulnerability from cvelistv5 – Published: 2026-08-31 08:46 – Updated: 2026-09-17 17:54
VLAI
EPSS
VEX
Title
ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes
Summary
ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 15:52 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ToolJet/ToolJet/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/tooljet-befo… | third-party-advisory |
Impacted products
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82871",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T15:52:35.933498Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T15:53:30.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xqqj-pfc2-vf48"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/ToolJet/ToolJet",
"product": "ToolJet",
"vendor": "ToolJet",
"versions": [
{
"lessThan": "3.16.208",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.16.208",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tooljet:tooljet:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.208",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "komyunghan"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations\u0027 table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and execute join queries to read actual stored data from victim organizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:54:47.377Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xqqj-pfc2-vf48)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/ToolJet/ToolJet/security/advisories/GHSA-xqqj-pfc2-vf48"
},
{
"name": "VulnCheck Advisory: ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tooljet-before-3.16.208-cross-organization-data-read-via-database-routes"
}
],
"title": "ToolJet before v3.16.208 Cross-Organization Data Read via Database Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82871",
"datePublished": "2026-08-31T08:46:40.261Z",
"dateReserved": "2026-08-31T08:37:53.170Z",
"dateUpdated": "2026-09-17T17:54:47.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82746 (GCVE-0-2026-82746)
Vulnerability from cvelistv5 – Published: 2026-09-01 03:47 – Updated: 2026-09-01 15:17
VLAI
EPSS
VEX
Title
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
Summary
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4.
Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource's policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.
This issue affects ash: from 3.29.0 before 3.32.2.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/ash-project/ash/security/advis… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-82746.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82746 | related |
| https://github.com/ash-project/ash/commit/ed4e656… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ash-project | ash |
Affected:
3.29.0 , < 3.32.2
(semver)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
|
| ash-project | ash |
Affected:
45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335 , < ed4e656822ffe83f8e960d5de0b573c0d1ae7f29
(git)
cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82746",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:16:54.224249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:17:12.056Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j7c9-3fw3-jc64"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027"
],
"packageName": "ash",
"packageURL": "pkg:hex/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/update/update_many.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027:run/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "3.29.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027"
],
"packageName": "ash-project/ash",
"packageURL": "pkg:github/ash-project/ash",
"product": "ash",
"programFiles": [
"lib/ash/actions/update/update_many.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Ash.Actions.Update.UpdateMany\u0027:run/5"
}
],
"repo": "https://github.com/ash-project/ash",
"vendor": "ash-project",
"versions": [
{
"lessThan": "ed4e656822ffe83f8e960d5de0b573c0d1ae7f29",
"status": "affected",
"version": "45e6b4ec7b2dc076afe614aa7aef7e1f15b5e335",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ash-project:ash:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"versionStartIncluding": "3.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Zach Daniel / Ash Project"
},
{
"lang": "en",
"type": "reporter",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMissing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of \u003ccode\u003eAsh.update_many/4\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eAsh.update_many/4\u003c/code\u003e runs as a single atomic statement (a data-layer \u003ccode\u003eupdate_many\u003c/code\u003e, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. \u003ccode\u003eAsh.Actions.Update.UpdateMany\u003c/code\u003e (\u003ccode\u003elib/ash/actions/update/update_many.ex\u003c/code\u003e) took that path even under \u003ccode\u003eauthorize?: true\u003c/code\u003e without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\u003c/p\u003e\n\u003cp\u003eThis issue affects ash: from 3.29.0 before 3.32.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of `Ash.update_many/4`.\n\n`Ash.update_many/4` runs as a single atomic statement (a data-layer `update_many`, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. `Ash.Actions.Update.UpdateMany` (`lib/ash/actions/update/update_many.ex`) took that path even under `authorize?: true` without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\n\nThis issue affects ash: from 3.29.0 before 3.32.2."
}
],
"value": "Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4.\n\nAsh.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a SQL MERGE) whenever an atomic strategy is used and the data layer supports it. Ash.Actions.Update.UpdateMany (lib/ash/actions/update/update_many.ex) took that path even under authorize?: true without applying the resource\u0027s policies, so the statement updated every row matched by primary key regardless of the policy filter that authorization would impose. An actor could therefore update records the policies forbid, such as rows belonging to another actor or tenant. The fix restricts the atomic path to data layers supporting changeset filters when authorizing, authorizes each changeset, and merges the resulting policy filter into each changeset so the statement only touches authorized rows.\n\nThis issue affects ash: from 3.29.0 before 3.32.2."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T03:47:14.278Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-j7c9-3fw3-jc64"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82746.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82746"
},
{
"tags": [
"patch"
],
"url": "https://github.com/ash-project/ash/commit/ed4e656822ffe83f8e960d5de0b573c0d1ae7f29"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82746",
"datePublished": "2026-09-01T03:47:14.278Z",
"dateReserved": "2026-08-31T01:00:09.774Z",
"dateUpdated": "2026-09-01T15:17:12.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82684 (GCVE-0-2026-82684)
Vulnerability from cvelistv5 – Published: 2026-09-04 21:01 – Updated: 2026-09-08 15:53
VLAI
EPSS
VEX
Title
Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization
Summary
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 15:53 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Tycon Systems | TPDIN-Monitor-WEB3 |
Affected:
0 , ≤ 2.2.9
(custom)
Unaffected: v2.4.2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82684",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T15:53:46.245943Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T15:53:53.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "TPDIN-Monitor-WEB3",
"vendor": "Tycon Systems",
"versions": [
{
"lessThanOrEqual": "2.2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "v2.4.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abdiwelli Guled reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents."
}
],
"value": "Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T21:01:16.030Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw"
},
{
"url": "https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-08"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-246-08.json"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTycon Systems has released TPDIN-Monitor-WEB3 Firmware v2.4.2.\u003c/p\u003e\n\u003cp\u003eUnits already running v2.4.2, for subsequent updates (signed container):\u0026nbsp;\u003cbr\u003e\u003ca href=\"https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw\"\u003ehttps://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eAll units currently in the field, including the v2.2.9 covered by this report (legacy Intel HEX):\u0026nbsp;\u003cbr\u003e\u003ca href=\"https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex\"\u003ehttps://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eA unit running v2.2.9 installs the .hex build directly and arrives at v2.4.2 in a single step; no intermediate version is required. The signed .tfw container cannot be read by a v2.2.9 updater, which accepts only Intel HEX, so the .hex artifact is the one every deployed unit needs.\u003c/p\u003e\n\u003cp\u003eFor more information, contact Tycon Systems:\u0026nbsp;\u003cbr\u003e\u003ca href=\"https://www.tyconsystems.com/contact\"\u003ehttps://www.tyconsystems.com/contact\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Tycon Systems has released TPDIN-Monitor-WEB3 Firmware v2.4.2.\n\n\n\n\nUnits already running v2.4.2, for subsequent updates (signed container):\u00a0\n https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw \n\n\n\n\nAll units currently in the field, including the v2.2.9 covered by this report (legacy Intel HEX):\u00a0\n https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex \n\n\n\n\nA unit running v2.2.9 installs the .hex build directly and arrives at v2.4.2 in a single step; no intermediate version is required. The signed .tfw container cannot be read by a v2.2.9 updater, which accepts only Intel HEX, so the .hex artifact is the one every deployed unit needs.\n\n\n\n\nFor more information, contact Tycon Systems:\u00a0\n https://www.tyconsystems.com/contact"
}
],
"source": {
"advisory": "ICSA-26-246-08",
"discovery": "EXTERNAL"
},
"title": "Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2026-82684",
"datePublished": "2026-09-04T21:01:16.030Z",
"dateReserved": "2026-09-01T17:01:04.761Z",
"dateUpdated": "2026-09-08T15:53:53.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82660 (GCVE-0-2026-82660)
Vulnerability from cvelistv5 – Published: 2026-08-31 08:46 – Updated: 2026-08-31 14:39
VLAI
EPSS
VEX
Title
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess
Summary
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:39 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/nodemailer/nodemailer/security… | vendor-advisory |
| https://www.vulncheck.com/advisories/nodemailer-j… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nodemailer | nodemailer |
Affected:
0 , < 8.0.9
(semver)
Unaffected: 8.0.9 (semver) cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:* |
Date Public
2026-05-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82660",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:39:08.906941Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:39:52.418Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/nodemailer",
"product": "nodemailer",
"vendor": "nodemailer",
"versions": [
{
"lessThan": "8.0.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.0.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodemailer:nodemailer:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "sondt99"
},
{
"lang": "en",
"type": "reporter",
"value": "dungNHVhust"
}
],
"datePublic": "2026-05-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T08:46:25.605Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wqvq-jvpq-h66f)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f"
},
{
"name": "VulnCheck Advisory: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess"
}
],
"title": "Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82660",
"datePublished": "2026-08-31T08:46:25.605Z",
"dateReserved": "2026-08-30T13:38:29.951Z",
"dateUpdated": "2026-08-31T14:39:52.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.