CWE-269

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/prefab-ui/",
          "defaultStatus": "unaffected",
          "packageName": "prefab-ui",
          "product": "prefab-ui",
          "programFiles": [
            "src/prefab_ui/sandbox/_pyodide.py",
            "src/prefab_ui/sandbox/runner.js"
          ],
          "repo": "git://github.com/PrefectHQ/prefab",
          "vendor": "PrefectHQ",
          "versions": [
            {
              "lessThan": "0.21.0",
              "status": "affected",
              "version": "0.14.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuval Moravchick"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePrefab UI\u0027s Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide\u0027s js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv\u0027s site-packages. The usual remote path is FastMCP\u0027s GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool\u0027s code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).\u003c/p\u003e"
            }
          ],
          "value": "Prefab UI\u0027s Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide\u0027s js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv\u0027s site-packages. The usual remote path is FastMCP\u0027s GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool\u0027s code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "FastMCP server with GenerativeUI enabled, Deno installed, and no authentication configured"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Authenticated client allowed to call tools on a server that executes untrusted code in the Generative UI sandbox"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T15:24:54.158Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Prefab repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/PrefectHQ/prefab"
        },
        {
          "name": "prefab-ui on PyPI",
          "tags": [
            "product"
          ],
          "url": "https://pypi.org/project/prefab-ui/"
        },
        {
          "name": "GHSA-595q-jv4r-q7j9",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/PrefectHQ/prefab/security/advisories/GHSA-595q-jv4r-q7j9"
        },
        {
          "name": "Refresh dependencies and fix renderer and sandbox regressions (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/PrefectHQ/prefab/pull/538"
        },
        {
          "name": "Fix commit 030f074",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/PrefectHQ/prefab/commit/030f074f85e0b1be0dd44b0283185aecb26337a2"
        },
        {
          "name": "v0.21.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/PrefectHQ/prefab/releases/tag/v0.21.0"
        },
        {
          "name": "prefab-ui 0.21.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://pypi.org/project/prefab-ui/0.21.0/"
        },
        {
          "name": "v0.20.2 (confirmed affected)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/PrefectHQ/prefab/releases/tag/v0.20.2"
        },
        {
          "name": "v0.14.0 (first release with the sandbox)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/PrefectHQ/prefab/releases/tag/v0.14.0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-24T17:21:00.000Z",
          "value": "Pyodide sandbox added with --allow-read, --allow-write, and --allow-net (commit fc4362f3, pull request 334)"
        },
        {
          "lang": "en",
          "time": "2026-03-27T02:36:00.000Z",
          "value": "prefab-ui 0.14.0 published on PyPI, the first release that includes the sandbox"
        },
        {
          "lang": "en",
          "time": "2026-06-03T02:13:00.000Z",
          "value": "prefab-ui 0.20.2 published. This is the release confirmed in testing."
        },
        {
          "lang": "en",
          "time": "2026-08-05T16:12:00.000Z",
          "value": "Reported to PrefectHQ as GHSA-595q-jv4r-q7j9. The advisory is still in triage and has no CVE id."
        },
        {
          "lang": "en",
          "time": "2026-10-25T18:48:00.000Z",
          "value": "Fix merged in pull request 538 (commit 030f074). The runner revokes read, write, and network permission before accepting code."
        },
        {
          "lang": "en",
          "time": "2026-10-26T19:00:00.000Z",
          "value": "prefab-ui 0.21.0 published on PyPI with the fix. No vendor advisory text was published with the release."
        }
      ],
      "title": "Prefab UI Pyodide sandbox escape to host RCE",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120338",
    "datePublished": "2026-11-01T15:24:54.158Z",
    "dateReserved": "2026-11-01T15:12:50.987Z",
    "dateUpdated": "2026-11-01T15:24:54.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/beam-cloud/beta9/releases",
          "defaultStatus": "unaffected",
          "packageName": "github.com/beam-cloud/beta9",
          "product": "Beta9 worker",
          "programFiles": [
            "docker/Dockerfile.worker",
            "pkg/worker/image.go",
            "pkg/worker/image_build_layered.go",
            "pkg/abstractions/image/builder.go",
            "pkg/scheduler/pool_local.go"
          ],
          "repo": "git://github.com/beam-cloud/beta9",
          "vendor": "beam-cloud",
          "versions": [
            {
              "lessThan": "0.1.756",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Natan Nehorai"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "JFrog Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eBeta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod\u0027s PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container\u0027s filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker\u0027s Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker\u0027s runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container.\u003c/p\u003e"
            }
          ],
          "value": "Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --isolation, so the step only changes its filesystem root. It keeps the worker pod\u0027s PID, network, IPC, and user namespaces, runs as uid 0, and holds CAP_DAC_OVERRIDE. PID 1 in that procfs is the worker entrypoint, so /proc/1/root is the worker container\u0027s filesystem and is writable. That filesystem contains the runc, buildah, and runsc binaries the worker uses to start tenant containers, the worker\u0027s Kubernetes service account token, and the host directories mounted into the pod. Worker pods are privileged. Clip v2 layered builds are the default, so a tenant with a workspace token reaches this by submitting one image build. The read-only proof confirmed the shared namespaces, CAP_DAC_OVERRIDE, and that the worker\u0027s runc binary is visible at /proc/1/root. Fixed in worker 0.1.756: Buildah RUN steps, including the WORKDIR mkdir, use OCI isolation with private PID, IPC, and network namespaces, and tenant ARG values are passed only into the build container."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "Default clip v2 layered image build on a privileged build-pool worker"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-653",
              "description": "CWE-653: Improper Isolation or Compartmentalization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T12:49:05.857Z",
        "orgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
        "shortName": "JFROG"
      },
      "references": [
        {
          "name": "Beta9 repository",
          "tags": [
            "product"
          ],
          "url": "https://github.com/beam-cloud/beta9"
        },
        {
          "name": "Handle sandbox edge cases (fix pull request)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/pull/1897"
        },
        {
          "name": "Fix commit a28bf12",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/beam-cloud/beta9/commit/a28bf12cf0007c792a25d8ed282b4e8bf6f30393"
        },
        {
          "name": "worker-0.1.756",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/beam-cloud/beta9/releases/tag/worker-0.1.756"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade the Beta9 worker to 0.1.756 or later. That release drops chroot isolation: Buildah RUN steps use OCI isolation with private PID, IPC, and network namespaces, and tenant build arguments are applied inside the build container rather than in the Buildah process environment. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15. Gateway 0.1.776 is the gateway tag cut from the same commit; the isolation change itself is in the worker image.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade the Beta9 worker to 0.1.756 or later. That release drops chroot isolation: Buildah RUN steps use OCI isolation with private PID, IPC, and network namespaces, and tenant build arguments are applied inside the build container rather than in the Buildah process environment. The fix is commit a28bf12 (pull request 1897), released as worker-0.1.756 on 2026-09-15. Gateway 0.1.776 is the gateway tag cut from the same commit; the isolation change itself is in the worker image."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fix merged in pull request 1897 (commit a28bf12)"
        },
        {
          "lang": "en",
          "time": "2026-09-15T04:03:00.000Z",
          "value": "Fixed release worker-0.1.756 published. No vendor security advisory was filed with the pull request."
        }
      ],
      "title": "Beta9 build sandbox escape via chroot-only isolation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "48a46f29-ae42-4e1d-90dd-c1676c1e5e6d",
    "assignerShortName": "JFROG",
    "cveId": "CVE-2026-120306",
    "datePublished": "2026-11-01T12:49:05.857Z",
    "dateReserved": "2026-11-01T12:32:40.057Z",
    "dateUpdated": "2026-11-01T12:49:05.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T14:38:42.410773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T14:39:02.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:yzncms:yzncms:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Auth Group Handler"
          ],
          "product": "YznCMS",
          "vendor": "ken678",
          "versions": [
            {
              "status": "affected",
              "version": "2.0"
            },
            {
              "status": "affected",
              "version": "2.1"
            },
            {
              "status": "affected",
              "version": "2.2.0"
            },
            {
              "status": "unaffected",
              "version": "2.2.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "danieluec (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can be initiated remotely. Upgrading to version 2.2.1 is sufficient to fix this issue. The patch is named ed16cd7f7f73e0316ffa8a148d. You should upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T22:15:20.469Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-429502 | ken678 YznCMS Auth Group Group.php Backend privileges management",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/429502"
        },
        {
          "name": "VDB-429502 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/429502/cti"
        },
        {
          "name": "CVE-2026-120185 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-120185"
        },
        {
          "name": "Submit #1026603 | YZNCMS YznCMS 2.1.5 Privilege Escalation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1026603"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitee.com/ken678/YZNCMS/commit/ed16cd7f7f73e0316ffa8a148d"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitee.com/ken678/YZNCMS/tree/v2.2.1"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://gitee.com/ken678/YZNCMS/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-31T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-31T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-31T08:06:51.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "ken678 YznCMS Auth Group Group.php Backend privileges management",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-120185",
    "datePublished": "2026-10-31T22:15:20.469Z",
    "dateReserved": "2026-10-31T07:01:45.637Z",
    "dateUpdated": "2026-11-02T14:39:02.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "User Frontend \u2013 Membership, User Registration, User Profile, User Directory \u0026 Content Restriction with Frontend Post Submission",
          "vendor": "wedevs",
          "versions": [
            {
              "lessThanOrEqual": "4.3.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The User Frontend \u2013 Membership, User Registration, User Profile, User Directory \u0026 Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.3.13 via the `post_content` parameter of the `submit_post()` function. The vulnerability exists because the protected-shortcode blocklist guard inspects the `sanitize_textarea_field()` copy of the submitted `post_content`, while the copy actually persisted to the database is processed through `wp_kses()`, whose `wp_kses_no_null()` step strips C0 control bytes \u2014 allowing an attacker to inject a single `\\x01` byte inside the `[wpuf-registration]` tag name to defeat the `strpos()` blocklist check while the clean, functional shortcode is stored verbatim; `strip_shortcodes()` does not neutralize the stored shortcode either, because the Frontend container that registers it via `add_shortcode()` is only instantiated when `is_admin()` is false, and `admin-ajax` requests have `is_admin() === true`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a `[wpuf-registration role=\"editor\"]` shortcode into a published post, causing a live Editor-role registration form to be rendered publicly on the frontend that any visitor \u2014 or the attacker themselves \u2014 can submit to mint a WordPress Editor account with an immediately active privileged session when the default `autologin_after_registration` setting is enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T07:46:53.190Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f84b6767-f254-45c9-8e78-36d4beac2a98?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L253"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Ajax/Frontend_Form_Ajax.php#L132"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Frontend/Registration.php#L116"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-user-frontend/tags/4.3.13/includes/Frontend/Registration.php#L362"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3770255/wp-user-frontend/trunk/includes/Ajax/Frontend_Form_Ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T18:22:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T19:33:59.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "User Frontend \u003c= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120070",
    "datePublished": "2026-10-31T07:46:53.190Z",
    "dateReserved": "2026-10-30T19:33:19.204Z",
    "dateUpdated": "2026-10-31T07:46:53.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mail logging \u0026 Catcher",
          "vendor": "wardee",
          "versions": [
            {
              "lessThanOrEqual": "2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Duc Manh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mail logging \u0026 Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.0 via the \u0027message\u0027 parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract valid administrator password-reset keys from stored email logs and complete the WordPress password-reset flow to escalate privileges to administrator. Exploitation requires an administrator to have previously configured the plugin\u0027s default_view_role setting to a capability held by low-privileged users such as \u0027read\u0027; on an untouched install the default of \u0027manage_options\u0027 restricts log access to administrators only."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T06:44:18.179Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/599e46ed-a71c-41d1-839f-6bb76808a58f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L259"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Bootstrap.php#L101"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Loggers/WpMail.php#L42"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/TextMessage.php#L10"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-mail-catcher/tags/2.2.0/src/Views/HtmlMessage.php#L9"
        },
        {
          "url": "https://github.com/JWardee/wp-mail-catcher/releases/tag/v2.3.0"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T18:32:02.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T18:37:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Mail logging \u0026 Catcher \u003c= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-120040",
    "datePublished": "2026-10-31T06:44:18.179Z",
    "dateReserved": "2026-10-30T18:32:56.733Z",
    "dateUpdated": "2026-10-31T06:44:18.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118205",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T17:32:07.636874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:08:57.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Essential Addons for Elementor \u2013 Popular Elementor Templates \u0026 Widgets",
          "vendor": "wpdevteam",
          "versions": [
            {
              "lessThanOrEqual": "6.8.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "crow"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Essential Addons for Elementor \u2013 Popular Elementor Templates \u0026 Widgets plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.8.7 via the `page_id` parameter of the `register_user()` function. The vulnerability exists because the handler\u0027s post status deny-list rejects `future`, `draft`, and `pending` but admits `inherit` \u2014 the status carried by every WordPress revision \u2014 allowing an attacker to substitute a revision ID for a live page ID, while a flawed \"last saved by administrator\" check reads `post_author` on revisions (which reflects the editing administrator) rather than the `_edit_last` meta that is never copied to revisions, and the nonce gate is rendered ineffective because any unauthenticated visitor can freely obtain a valid nonce via the `wp_ajax_nopriv_eael_get_token` endpoint. This makes it possible for unauthenticated attackers to register an account with a role as high as Editor \u2014 gaining capabilities including `edit_others_posts`, `publish_pages`, `upload_files`, and `unfiltered_html` \u2014 by naming a revision whose `_elementor_data` contains an elevated role an administrator previously saved and later reverted on a page bearing the Login/Register widget. Successful exploitation requires that the site has \"Anyone can register\" enabled and that an administrator has at some point saved and then reverted a non-default \"New User Role\" on an affected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T17:15:30.431Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a739cb9a-0b09-4303-8d4a-16fca1152adf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L1059"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L887"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L552"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Login_Registration.php#L2762"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Traits/Ajax_Handler.php#L1817"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/6.8.5/includes/Classes/Bootstrap.php#L216"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3770535/essential-addons-for-elementor-lite/trunk/includes/Traits/Login_Registration.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-27T19:24:04.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-30T14:51:24.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Essential Addons for Elementor \u003c= 6.8.7 - Unauthenticated Privilege Escalation to \u0027page_id\u0027 Parameter via Elementor Revision"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118205",
    "datePublished": "2026-10-30T17:15:30.431Z",
    "dateReserved": "2026-10-27T19:08:29.796Z",
    "dateUpdated": "2026-10-30T18:08:57.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Psono Server Community Edition",
            "Psono Server Enterprise Edition"
          ],
          "product": "Psono",
          "programFiles": [
            "psono/restapi/views/device_code_claim.py",
            "psono/restapi/views/device_code_token.py"
          ],
          "repo": "https://gitlab.com/esaqa/psono/psono-server",
          "vendor": "esaqa GmbH",
          "versions": [
            {
              "lessThan": "7.2.4",
              "status": "affected",
              "version": "5.3.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ryan Chaplin"
        }
      ],
      "datePublic": "2026-10-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePsono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token\u0027s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.\u003c/p\u003e"
            }
          ],
          "value": "Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token\u0027s scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A restricted, short-lived API key session could be escalated to a full read-write session lasting up to 365 days, enabling unauthorized modification of encrypted secrets and shares."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T05:59:08.920Z",
        "orgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
        "shortName": "esaqa"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/blob/v7.2.3/psono/restapi/views/device_code_claim.py"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/commit/19ed5a192c704fece1645d946b6f4c36045bacbe"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server/-/releases/v7.2.4"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://gitlab.com/esaqa/psono/psono-server"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://gitlab.com/esaqa/esaqa/security-advisories/-/blob/master/advisories/CVE-2026-117468.md"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Psono Server 7.2.4 or later.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Psono Server 7.2.4 or later."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-29T16:10:00.000Z",
          "value": "Vulnerability reported to vendor"
        },
        {
          "lang": "en",
          "time": "2026-07-30T07:13:00.000Z",
          "value": "Vendor fix implemented"
        },
        {
          "lang": "en",
          "time": "2026-07-30T13:16:00.000Z",
          "value": "Psono CE \u0026 EE Server 7.2.4 released"
        }
      ],
      "title": "Device-code claim permits restricted token escalation in Psono Server",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "fdf66990-8419-4c8c-8848-ec15d75773b4",
    "assignerShortName": "esaqa",
    "cveId": "CVE-2026-117468",
    "datePublished": "2026-10-27T05:41:30.742Z",
    "dateReserved": "2026-10-27T05:33:18.001Z",
    "dateUpdated": "2026-10-27T05:59:08.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "Linux"
          ],
          "product": "Octopus Server",
          "vendor": "Octopus Deploy",
          "versions": [
            {
              "lessThan": "2026.2.13469",
              "status": "affected",
              "version": "2019.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2026.3.15863",
              "status": "affected",
              "version": "2026.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was found by Nathan Willoughby"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator."
            }
          ],
          "value": "In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T10:40:49.413Z",
        "orgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
        "shortName": "Octopus"
      },
      "references": [
        {
          "url": "https://advisories.octopus.com/post/2026/sa2026-17"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6f4f8c89-ef06-4bae-a2a5-6734ddf76272",
    "assignerShortName": "Octopus",
    "cveId": "CVE-2026-117466",
    "datePublished": "2026-10-27T10:40:49.413Z",
    "dateReserved": "2026-10-27T05:16:33.514Z",
    "dateUpdated": "2026-10-27T10:40:49.413Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "openpanel",
          "vendor": "Openpanel-dev",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openpanel:openpanel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Shad0w35"
        }
      ],
      "datePublic": "2026-10-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization\u0027s usage budget."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T23:05:37.220Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5f38-q67m-mcmp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-5f38-q67m-mcmp"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Openpanel-dev/openpanel/commit/35c2a138fb9f8dde67dadfd426892f3762b25b78"
        },
        {
          "name": "VulnCheck Advisory: OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openpanel-before-3.0.0-privilege-escalation-via-onboarding-project-trpc-mutation"
        }
      ],
      "title": "OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116806",
    "datePublished": "2026-10-26T23:05:37.220Z",
    "dateReserved": "2026-10-26T22:13:13.606Z",
    "dateUpdated": "2026-10-26T23:05:37.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116471",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-31T01:42:20.747022Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-31T01:42:29.614Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:bkwld:decoy:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Authorization Policy"
          ],
          "product": "Decoy",
          "vendor": "BKWLD",
          "versions": [
            {
              "status": "affected",
              "version": "5.11.0"
            },
            {
              "status": "affected",
              "version": "5.11.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Rony Ahmed (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T18:30:15.152Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-426379 | BKWLD Decoy Authorization Policy Policy.php privileges management",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/426379"
        },
        {
          "name": "VDB-426379 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/426379/cti"
        },
        {
          "name": "CVE-2026-116471 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-116471"
        },
        {
          "name": "Submit #1014294 | BKWLD Decoy 5.11.1 Improper Access Control / Authorization Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1014294"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://docs.google.com/document/d/1aMqfRWKalkL5v9tM5nIxrOWKLbN23KLyr0jSZtan4U4/edit?usp=sharing"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-26T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-26T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-26T11:45:53.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "BKWLD Decoy Authorization Policy Policy.php privileges management",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-116471",
    "datePublished": "2026-10-26T18:30:15.152Z",
    "dateReserved": "2026-10-26T10:40:46.395Z",
    "dateUpdated": "2026-10-31T01:42:29.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}