Common Weakness Enumeration

CWE-639

Allowed

Authorization Bypass Through User-Controlled Key

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

4792 vulnerabilities reference this CWE, most recent first.

CVE-2026-87113 (GCVE-0-2026-87113)

Vulnerability from cvelistv5 – Published: 2026-09-16 19:42 – Updated: 2026-09-17 16:09
VLAI
Title
Tanium addressed an improper access controls vulnerability in Threat Response.
Summary
Tanium addressed an improper access controls vulnerability in Threat Response.
Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 16:09 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Tanium CNA under the mitre root
CNA scorecard D 59/100 over 40 records in the last 180 days details
References
Impacted products
Vendor Product Version
Tanium Threat Response Affected: 4.9 , < 4.9.449 (custom)
Affected: 4.12 , < 4.12.319 (custom)
Affected: 4.17 , < 4.17.291 (custom)
Create a notification for this product.
Date Public
2026-09-16 19:42
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87113",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T16:09:41.958500Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T16:09:56.333Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Threat Response",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "4.9.449",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.12.319",
              "status": "affected",
              "version": "4.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.17.291",
              "status": "affected",
              "version": "4.17",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-08T20:39:21.462Z",
      "datePublic": "2026-09-16T19:42:32.588Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an improper access controls vulnerability in Threat Response."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T20:30:08.540Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2026-048",
          "url": "https://security.tanium.com/TAN-2026-048"
        }
      ],
      "title": "Tanium addressed an improper access controls vulnerability in Threat Response."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2026-87113",
    "datePublished": "2026-09-16T19:42:46.501Z",
    "dateReserved": "2026-09-08T20:39:21.860Z",
    "dateUpdated": "2026-09-17T16:09:56.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87108 (GCVE-0-2026-87108)

Vulnerability from cvelistv5 – Published: 2026-10-09 05:54 – Updated: 2026-10-09 16:47
VLAI
Title
Ops Manager Improper Authorization in Daily Host Monitoring Retrieval
Summary
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 16:15 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
mongodb CNA under the mitre root
CNA scorecard C 70/100 over 199 records in the last 180 days details
References
Impacted products
Vendor Product Version
MongoDB Ops Manager Affected: 7.0.0 , ≤ 7.0.23 (semver)
Affected: 8.0.0 , < 8.0.27 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87108",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T16:15:38.736817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T16:47:33.826Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Ops Manager",
          "vendor": "MongoDB",
          "versions": [
            {
              "lessThanOrEqual": "7.0.23",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.0.27",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details."
            }
          ],
          "value": "An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T05:54:58.769Z",
        "orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
        "shortName": "mongodb"
      },
      "references": [
        {
          "url": "https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#ops-manager-server-8027"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Ops Manager Improper Authorization in Daily Host Monitoring Retrieval",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "assignerShortName": "mongodb",
    "cveId": "CVE-2026-87108",
    "datePublished": "2026-10-09T05:54:58.769Z",
    "dateReserved": "2026-09-08T20:27:56.733Z",
    "dateUpdated": "2026-10-09T16:47:33.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87047 (GCVE-0-2026-87047)

Vulnerability from cvelistv5 – Published: 2026-09-09 02:06 – Updated: 2026-09-09 16:10
VLAI
Title
Tanium addressed an improper access controls vulnerability in Comply.
Summary
Tanium addressed an improper access controls vulnerability in Comply.
Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:59 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Tanium CNA under the mitre root
CNA scorecard D 59/100 over 40 records in the last 180 days details
References
Impacted products
Vendor Product Version
Tanium Comply Affected: 2.32 , < 2.32.252 (custom)
Affected: 2.35 , < 2.35.306 (custom)
Affected: 2.37 , < 2.37.308 (custom)
Create a notification for this product.
Date Public
2026-09-09 02:04
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87047",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:59:57.410721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:10:31.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Comply",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "2.32.252",
              "status": "affected",
              "version": "2.32",
              "versionType": "custom"
            },
            {
              "lessThan": "2.35.306",
              "status": "affected",
              "version": "2.35",
              "versionType": "custom"
            },
            {
              "lessThan": "2.37.308",
              "status": "affected",
              "version": "2.37",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-08T18:48:32.209Z",
      "datePublic": "2026-09-09T02:04:26.462Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an improper access controls vulnerability in Comply."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T02:06:56.913Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2026-038",
          "url": "https://security.tanium.com/TAN-2026-038"
        }
      ],
      "title": "Tanium addressed an improper access controls vulnerability in Comply."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2026-87047",
    "datePublished": "2026-09-09T02:06:56.913Z",
    "dateReserved": "2026-09-08T18:48:32.711Z",
    "dateUpdated": "2026-09-09T16:10:31.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87033 (GCVE-0-2026-87033)

Vulnerability from cvelistv5 – Published: 2026-09-09 02:08 – Updated: 2026-09-09 16:10
VLAI
Title
Tanium addressed an improper access controls vulnerability in Comply.
Summary
Tanium addressed an improper access controls vulnerability in Comply.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:59 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Tanium CNA under the mitre root
CNA scorecard D 59/100 over 40 records in the last 180 days details
References
Impacted products
Vendor Product Version
Tanium Comply Affected: 2.32 , < 2.32.252 (custom)
Affected: 2.35 , < 2.35.306 (custom)
Affected: 2.37 , < 2.37.308 (custom)
Create a notification for this product.
Date Public
2026-09-09 02:04
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:59:32.551163Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:10:30.767Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Comply",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "2.32.252",
              "status": "affected",
              "version": "2.32",
              "versionType": "custom"
            },
            {
              "lessThan": "2.35.306",
              "status": "affected",
              "version": "2.35",
              "versionType": "custom"
            },
            {
              "lessThan": "2.37.308",
              "status": "affected",
              "version": "2.37",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-08T18:25:03.987Z",
      "datePublic": "2026-09-09T02:04:26.847Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an improper access controls vulnerability in Comply."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T02:08:07.834Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2026-039",
          "url": "https://security.tanium.com/TAN-2026-039"
        }
      ],
      "title": "Tanium addressed an improper access controls vulnerability in Comply."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2026-87033",
    "datePublished": "2026-09-09T02:08:07.834Z",
    "dateReserved": "2026-09-08T18:25:04.388Z",
    "dateUpdated": "2026-09-09T16:10:30.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87025 (GCVE-0-2026-87025)

Vulnerability from cvelistv5 – Published: 2026-09-09 02:07 – Updated: 2026-09-09 16:10
VLAI
Title
Tanium addressed an improper access controls vulnerability in Comply.
Summary
Tanium addressed an improper access controls vulnerability in Comply.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 15:59 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Tanium CNA under the mitre root
CNA scorecard D 59/100 over 40 records in the last 180 days details
References
Impacted products
Vendor Product Version
Tanium Comply Affected: 2.32 , < 2.32.252 (custom)
Affected: 2.35 , < 2.35.306 (custom)
Affected: 2.37 , < 2.37.308 (custom)
Create a notification for this product.
Date Public
2026-09-09 02:04
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87025",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T15:59:42.726606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:10:31.401Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Comply",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "2.32.252",
              "status": "affected",
              "version": "2.32",
              "versionType": "custom"
            },
            {
              "lessThan": "2.35.306",
              "status": "affected",
              "version": "2.35",
              "versionType": "custom"
            },
            {
              "lessThan": "2.37.308",
              "status": "affected",
              "version": "2.37",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-08T17:59:40.600Z",
      "datePublic": "2026-09-09T02:04:29.441Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an improper access controls vulnerability in Comply."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T02:07:11.512Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2026-045",
          "url": "https://security.tanium.com/TAN-2026-045"
        }
      ],
      "title": "Tanium addressed an improper access controls vulnerability in Comply."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2026-87025",
    "datePublished": "2026-09-09T02:07:11.512Z",
    "dateReserved": "2026-09-08T17:59:41.117Z",
    "dateUpdated": "2026-09-09T16:10:31.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87019 (GCVE-0-2026-87019)

Vulnerability from cvelistv5 – Published: 2026-09-09 02:06 – Updated: 2026-09-09 16:10
VLAI
Title
Tanium addressed an improper access controls vulnerability in Comply.
Summary
Tanium addressed an improper access controls vulnerability in Comply.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 16:00 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Tanium CNA under the mitre root
CNA scorecard D 59/100 over 40 records in the last 180 days details
References
Impacted products
Vendor Product Version
Tanium Comply Affected: 2.32.252 , < 2.32.252 (custom)
Affected: 2.35.306 , < 2.35.306 (custom)
Affected: 2.37.308 , < 2.37.308 (custom)
Create a notification for this product.
Date Public
2026-09-09 02:04
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87019",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T16:00:20.158674Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T16:10:31.830Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Comply",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "2.32.252",
              "status": "affected",
              "version": "2.32.252",
              "versionType": "custom"
            },
            {
              "lessThan": "2.35.306",
              "status": "affected",
              "version": "2.35.306",
              "versionType": "custom"
            },
            {
              "lessThan": "2.37.308",
              "status": "affected",
              "version": "2.37.308",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2026-09-08T17:02:36.927Z",
      "datePublic": "2026-09-09T02:04:25.050Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an improper access controls vulnerability in Comply."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T02:06:42.496Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2026-035",
          "url": "https://security.tanium.com/TAN-2026-035"
        }
      ],
      "title": "Tanium addressed an improper access controls vulnerability in Comply."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2026-87019",
    "datePublished": "2026-09-09T02:06:42.496Z",
    "dateReserved": "2026-09-08T17:02:37.401Z",
    "dateUpdated": "2026-09-09T16:10:31.830Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86763 (GCVE-0-2026-86763)

Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:30
VLAI
Title
snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer
Summary
Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.index route). The component only checked the broad 'import' ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file_path, filesize, import_type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user's record, exposing its stored preview data (header_row column headers and first_row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.5 (Low)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:30 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5495 records in the last 180 days details
References
Impacted products
Vendor Product Version
grokability snipe-it Affected: 7.0.12 , ≤ 8.7.2 (semver)
    cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-24 00:00
Credits
pavelkohout396
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86763",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:30:07.882516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:30:21.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "snipe-it",
          "vendor": "grokability",
          "versions": [
            {
              "lessThanOrEqual": "8.7.2",
              "status": "affected",
              "version": "7.0.12",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "8.7.2",
                  "versionStartIncluding": "7.0.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "pavelkohout396"
        }
      ],
      "datePublic": "2026-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Snipe-IT versions \u003e= 7.0.12 and \u003c= 8.6.3 contain an authorization bypass in the Livewire importer component (App\\Livewire\\Importer, mounted at the imports.index route). The component only checked the broad \u0027import\u0027 ability at mount time, while its files() and activeFile() computed properties queried the imports table with no owner or company scope. As a result, any authenticated non-superuser holding the import permission could view every Import record on the instance (original filename, file_path, filesize, import_type and creation timestamp) and could invoke the selectFile($id) Livewire action with any auto-incrementing Import ID to load another user\u0027s record, exposing its stored preview data (header_row column headers and first_row, the first data row of the CSV). Because import CSVs commonly contain personal data, asset serial numbers and license keys, this discloses sensitive information; in Full Multiple Companies Support (FMCS) deployments the disclosure also crosses company/tenant boundaries. Impact is limited to preview data rather than the full CSV file, and superusers were unaffected. Fixed in version 8.7.0, which scopes non-superuser reads to imports owned by the caller."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:22.445Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-89q3-jmfm-hvcm)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-89q3-jmfm-hvcm"
        },
        {
          "name": "VulnCheck Advisory: snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/snipe-it-7.0.12-through-8.6.3-authorization-bypass-via-importer"
        }
      ],
      "title": "snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86763",
    "datePublished": "2026-09-09T13:32:22.445Z",
    "dateReserved": "2026-09-08T11:33:02.641Z",
    "dateUpdated": "2026-09-09T14:30:21.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86761 (GCVE-0-2026-86761)

Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:21
VLAI
Title
snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints
Summary
snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:20 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5495 records in the last 180 days details
References
Impacted products
Vendor Product Version
grokability snipe-it Affected: 8.6.3 , < 8.7.0 (semver)
Unaffected: 8.7.0 (semver)
    cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-24 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86761",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:20:38.231057Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:21:08.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "snipe-it",
          "vendor": "grokability",
          "versions": [
            {
              "lessThan": "8.7.0",
              "status": "affected",
              "version": "8.6.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.7.0",
                  "versionStartIncluding": "8.6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks. Authenticated attackers with location view permission can access printassigned and printallassigned endpoints to retrieve related users, assets, accessories, consumables, and components regardless of their individual model permissions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:21.065Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-cg5w-9662-73vx)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-cg5w-9662-73vx"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/grokability/snipe-it/commit/7865bc56e372447631b6c0d6eb6774faf896553a"
        },
        {
          "name": "VulnCheck Advisory: snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/snipe-it-8.6.3-before-8.7.0-authorization-bypass-via-print-endpoints"
        }
      ],
      "title": "snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86761",
    "datePublished": "2026-09-09T13:32:21.065Z",
    "dateReserved": "2026-09-08T11:33:02.641Z",
    "dateUpdated": "2026-09-09T14:21:08.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86743 (GCVE-0-2026-86743)

Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-09 14:26
VLAI
Title
Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report
Summary
Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 14:25 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5495 records in the last 180 days details
References
Impacted products
Vendor Product Version
grokability snipe-it Affected: 0 , < 8.7.0 (semver)
Unaffected: 8.7.0 (semver)
    cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-24 00:00
Credits
arpitjain099 snipe
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86743",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T14:25:48.320551Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-09T14:26:20.877Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-7xrr-xm47-rc6w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "snipe-it",
          "vendor": "grokability",
          "versions": [
            {
              "lessThan": "8.7.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "arpitjain099"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "snipe"
        }
      ],
      "datePublic": "2026-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unaccepted_assets report page or CSV export to disclose cross-company inventory details and assignee names without per-row access validation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:08.614Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-7xrr-xm47-rc6w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-7xrr-xm47-rc6w"
        },
        {
          "name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-authorization-bypass-via-asset-acceptance-report"
        }
      ],
      "title": "Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86743",
    "datePublished": "2026-09-09T13:32:08.614Z",
    "dateReserved": "2026-09-08T11:31:38.679Z",
    "dateUpdated": "2026-09-09T14:26:20.877Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-86725 (GCVE-0-2026-86725)

Vulnerability from cvelistv5 – Published: 2026-09-08 15:13 – Updated: 2026-09-08 15:35
VLAI
Title
AVideo SocialMediaPublisher Missing Authorization via add.json.php
Summary
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user's stored access_token and refresh_token, then delete the compromised record to destroy the victim's provider linkage.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 15:35 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5495 records in the last 180 days details
References
Impacted products
Vendor Product Version
WWBN AVideo Affected: 0 , ≤ c3edcc274c389816d434acadac07ee78eaf330c1 (git)
    cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-24 00:00
Credits
santhreal
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86725",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T15:35:08.034496Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T15:35:26.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-rp73-gjpj-w92v"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "lessThanOrEqual": "c3edcc274c389816d434acadac07ee78eaf330c1",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wwbn:avideo:-:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "santhreal"
        }
      ],
      "datePublic": "2026-08-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin\u0027s add.json.php endpoint that allows authenticated users to modify other users\u0027 OAuth token records. Attackers can supply arbitrary row IDs to overwrite another user\u0027s stored access_token and refresh_token, then delete the compromised record to destroy the victim\u0027s provider linkage."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T15:13:57.546Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-rp73-gjpj-w92v)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-rp73-gjpj-w92v"
        },
        {
          "name": "VulnCheck Advisory: AVideo SocialMediaPublisher Missing Authorization via add.json.php",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/avideo-socialmediapublisher-missing-authorization-via-add-json-php"
        }
      ],
      "title": "AVideo SocialMediaPublisher Missing Authorization via add.json.php",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-86725",
    "datePublished": "2026-09-08T15:13:57.546Z",
    "dateReserved": "2026-09-08T11:30:41.420Z",
    "dateUpdated": "2026-09-08T15:35:26.750Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design

For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.

Mitigation
Architecture and Design Implementation

Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Mitigation
Architecture and Design

Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list