https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:52:20.570840+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-197760 EUVD-2026-197760 2026-10-06T18:52:20.572941+00:00 EUVD-2026-197760 https://cve.radiocsirt.org/vuln/fkie_cve-2024-49376 fkie_cve-2024-49376 2026-10-06T18:52:20.572973+00:00

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.

 https://cve.radiocsirt.org/vuln/ghsa-v46j-h43h-rwrm GHSA-v46j-h43h-rwrm — Autolab Misconfigured Reset Password Permissions 2026-10-06T18:52:20.573004+00:00

Affected: RubyGems: Autolab

### Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords.

### Patches This is fixed in v3.0.1.

### Workarounds No workarounds.

### For more information If you have any questions or comments about this advisory:

Open an issue in https://github.com/autolab/Autolab/ Email us at [autolab-dev@andrew.cmu.edu](mailto:autolab-dev@andrew.cmu.edu)