Common Weakness Enumeration
CWE-841
Weakness AllowedImproper Enforcement of Behavioral Workflow
Abstraction: Class · Status: Incomplete
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence or timeframe.
Technical nuance
Workflow-related behaviors include:
Steps are performed in the expected order.
Required steps are not omitted.
Steps are not interrupted.
Steps are performed in a timely fashion.
Dimensions
- Behavior-Property: Improper
- Behavior-Type: Enforcement
- Behavior-Type: Behavioral Workflow
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Detection methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Notes
Relationship
This is different than CWE-696, which focuses on when the product performs actions in the wrong sequence; this entry is closely related, but it is focused on ensuring that the actor performs actions in the correct sequence.
Research Gap
This weakness is typically associated with business logic flaws, except when it produces resultant weaknesses.
The classification of business logic flaws has been under-studied, although exploitation of business flaws frequently happens in real-world systems, and many applied vulnerability researchers investigate them. The greatest focus is in web applications. There is debate within the community about whether these problems represent particularly new concepts, or if they are variations of well-known principles.
Many business logic flaws appear to be oriented toward business processes, application flows, and sequences of behaviors, which are not as well-represented in CWE as weaknesses related to input validation, memory management, etc.
Content history
Submission: CWE Content Team
· MITRE
· 2011-03-24
· CWE 1.12
Contribution: Anonymous External Contributor
· 2021-11-11
· CWE 4.7
Reported an error in a demonstrative example
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences
Modification: CWE Content Team
· MITRE
· 2011-06-27
· CWE 2.0
updated Common_Consequences, Observed_Examples, Related_Attack_Patterns, Relationships
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Demonstrative_Examples, Observed_Examples, Relationships
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Modes_of_Introduction, References, Relationships
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-04-28
· CWE 4.7
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2023-01-31
· CWE 4.10
updated Common_Consequences, Description
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated References, Relationships
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Applicable_Platforms, Detection_Factors, Relationships, Type, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2026-10-28
· CWE 5.0
updated Common_Consequences, Demonstrative_Examples, Description, Dimensions, Relationship_Notes, Relationships, Technical_Nuance
144 vulnerabilities reference this CWE, most recent first.
CVE-2026-128032 (GCVE-0-2026-128032)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:33 – Updated: 2026-11-13 16:01
VLAI
EPSS
VEX
Title
OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method
Summary
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:29 UTC
CWE
- CWE-841 - Improper Enforcement of Behavioral Workflow
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/OpenMage/magento-lts/security/… | vendor-advisory |
| https://github.com/OpenMage/magento-lts/commit/ae… | patch |
| https://www.vulncheck.com/advisories/openmage-mag… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| OpenMage | magento-lts |
Affected:
0 , < 20.18.2
(semver)
Unaffected: 20.18.2 (semver) |
|
| OpenMage | magento-lts |
Affected:
21.0.0-beta1 , < 21.0.0-beta3
(semver)
Unaffected: 21.0.0-beta3 (semver) |
Date Public
2026-10-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-128032",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:29:18.635951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T16:01:33.790Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "magento-lts",
"vendor": "OpenMage",
"versions": [
{
"lessThan": "20.18.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "20.18.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "magento-lts",
"vendor": "OpenMage",
"versions": [
{
"lessThan": "21.0.0-beta3",
"status": "affected",
"version": "21.0.0-beta1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "21.0.0-beta3",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hariprasanth9317-tech"
},
{
"lang": "en",
"type": "remediation developer",
"value": "colinmollenhour"
}
],
"datePublic": "2026-10-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart_payment.method while the total is zero, raise it with cart_coupon.remove, and submit cart.order to place an unpaid full-price order."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:33:59.721Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rmw8-7h79-p386)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-rmw8-7h79-p386"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/OpenMage/magento-lts/commit/ae520e9197c4bf86d6e3b39fdded23958bf9d2d1"
},
{
"name": "VulnCheck Advisory: OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openmage-magento-lts-before-20.18.2-payment-bypass-via-free-payment-method"
}
],
"title": "OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-128032",
"datePublished": "2026-11-13T09:33:59.721Z",
"dateReserved": "2026-11-12T20:33:43.125Z",
"dateUpdated": "2026-11-13T16:01:33.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124576 (GCVE-0-2026-124576)
Vulnerability from cvelistv5 – Published: 2026-11-09 07:00 – Updated: 2026-11-12 14:39 X_Open Source
VLAI
EPSS
VEX
Title
BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
Summary
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 14:39 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432922 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432922/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124576 | third-party-advisory |
| https://vuldb.com/submit/1038160 | third-party-advisory |
| https://github.com/beikeshop/beikeshop/security/a… | broken-link |
| https://github.com/beikeshop/beikeshop/commit/6cf… | patch |
| https://github.com/beikeshop/beikeshop/releases/t… | patch |
| https://github.com/beikeshop/beikeshop/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | BeikeShop |
Affected:
2.0.0.0
Affected: 2.0.0.1 Affected: 2.0.0.2 Affected: 2.0.0.3 Affected: 2.0.0.4 Affected: 2.0.0.5 Affected: 2.0.0.6 Affected: 2.0.0.7 Affected: 2.0.0.8 Affected: 2.0.0.9 Affected: 2.0.0.10 Affected: 2.0.0.11 Affected: 2.0.0.12 Affected: 2.0.0.13 Affected: 2.0.0.14 Affected: 2.0.0.15 Affected: 2.0.0.16 Affected: 2.0.0.17 Affected: 2.0.0.18 Affected: 2.0.0.19 Affected: 2.0.0.20 Affected: 2.0.0.21 Affected: 2.0.0.22 Affected: 2.0.0.23 Affected: 2.0.0.24 Affected: 2.0.0.25 Affected: 2.0.0.26 Affected: 2.0.0.27 Affected: 2.0.0.28 Affected: 2.0.0.29 Affected: 2.0.0.30 Affected: 2.0.0.31 Unaffected: 2.0.0.32 cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124576",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T14:39:21.513940Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:39:41.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/1038160"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:beikeshop:beikeshop:*:*:*:*:*:*:*:*"
],
"modules": [
"Guest Order Lookup"
],
"product": "BeikeShop",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.0.0.0"
},
{
"status": "affected",
"version": "2.0.0.1"
},
{
"status": "affected",
"version": "2.0.0.2"
},
{
"status": "affected",
"version": "2.0.0.3"
},
{
"status": "affected",
"version": "2.0.0.4"
},
{
"status": "affected",
"version": "2.0.0.5"
},
{
"status": "affected",
"version": "2.0.0.6"
},
{
"status": "affected",
"version": "2.0.0.7"
},
{
"status": "affected",
"version": "2.0.0.8"
},
{
"status": "affected",
"version": "2.0.0.9"
},
{
"status": "affected",
"version": "2.0.0.10"
},
{
"status": "affected",
"version": "2.0.0.11"
},
{
"status": "affected",
"version": "2.0.0.12"
},
{
"status": "affected",
"version": "2.0.0.13"
},
{
"status": "affected",
"version": "2.0.0.14"
},
{
"status": "affected",
"version": "2.0.0.15"
},
{
"status": "affected",
"version": "2.0.0.16"
},
{
"status": "affected",
"version": "2.0.0.17"
},
{
"status": "affected",
"version": "2.0.0.18"
},
{
"status": "affected",
"version": "2.0.0.19"
},
{
"status": "affected",
"version": "2.0.0.20"
},
{
"status": "affected",
"version": "2.0.0.21"
},
{
"status": "affected",
"version": "2.0.0.22"
},
{
"status": "affected",
"version": "2.0.0.23"
},
{
"status": "affected",
"version": "2.0.0.24"
},
{
"status": "affected",
"version": "2.0.0.25"
},
{
"status": "affected",
"version": "2.0.0.26"
},
{
"status": "affected",
"version": "2.0.0.27"
},
{
"status": "affected",
"version": "2.0.0.28"
},
{
"status": "affected",
"version": "2.0.0.29"
},
{
"status": "affected",
"version": "2.0.0.30"
},
{
"status": "affected",
"version": "2.0.0.31"
},
{
"status": "unaffected",
"version": "2.0.0.32"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fernando viana (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number results in enforcement of behavioral workflow. The attack can be initiated remotely. Upgrading to version 2.0.0.32 is recommended to address this issue. The patch is named 6cf25f8c15d27d1ff14a848faf645c94d20ba5f1. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T07:00:23.096Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432922 | BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432922"
},
{
"name": "VDB-432922 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432922/cti"
},
{
"name": "CVE-2026-124576 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124576"
},
{
"name": "Submit #1038160 | beikeshop BeikeShop \u003c= 2.0.0.31 Improper Enforcement of Behavioral Workflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1038160"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/beikeshop/beikeshop/security/advisories/GHSA-p2x8-f9cm-m352"
},
{
"tags": [
"patch"
],
"url": "https://github.com/beikeshop/beikeshop/commit/6cf25f8c15d27d1ff14a848faf645c94d20ba5f1"
},
{
"tags": [
"patch"
],
"url": "https://github.com/beikeshop/beikeshop/releases/tag/v2.0.0.32"
},
{
"tags": [
"product"
],
"url": "https://github.com/beikeshop/beikeshop/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T18:04:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124576",
"datePublished": "2026-11-09T07:00:23.096Z",
"dateReserved": "2026-11-08T16:59:31.143Z",
"dateUpdated": "2026-11-12T14:39:41.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124566 (GCVE-0-2026-124566)
Vulnerability from cvelistv5 – Published: 2026-11-09 04:30 – Updated: 2026-11-09 14:06
VLAI
EPSS
VEX
Title
fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow
Summary
A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:06 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432898 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432898/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124566 | third-party-advisory |
| https://vuldb.com/submit/1035644 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fushengqian | fuint |
Affected:
36cc31b08d77facc94e8959afa02224891b4fe5f
cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124566",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:06:20.988567Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:06:32.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:*"
],
"modules": [
"Alipay Callback Handler"
],
"product": "fuint",
"vendor": "fushengqian",
"versions": [
{
"status": "affected",
"version": "36cc31b08d77facc94e8959afa02224891b4fe5f"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Y1Daa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T04:30:20.609Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432898 | fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432898"
},
{
"name": "VDB-432898 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432898/cti"
},
{
"name": "CVE-2026-124566 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124566"
},
{
"name": "Submit #1035644 | fushengqian fuint up to cb498ad2 Improper Validation",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035644"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T16:00:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124566",
"datePublished": "2026-11-09T04:30:20.609Z",
"dateReserved": "2026-11-08T14:55:10.113Z",
"dateUpdated": "2026-11-09T14:06:32.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123788 (GCVE-0-2026-123788)
Vulnerability from cvelistv5 – Published: 2026-11-06 21:15 – Updated: 2026-11-11 03:36 X_Open Source
VLAI
EPSS
VEX
Title
chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow
Summary
A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-11 03:35 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/431934 | vdb-entry |
| https://vuldb.com/vuln/431934/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-123788 | third-party-advisory |
| https://vuldb.com/submit/1033606 | third-party-advisory |
| https://github.com/chenyme/grok2api/issues/1072 | issue-tracking |
| https://github.com/chenyme/grok2api/pull/1073 | issue-trackingpatch |
| https://github.com/chenyme/grok2api/commit/7ad0f7… | patch |
| https://github.com/chenyme/grok2api/releases/tag/v3.1.7 | patch |
| https://github.com/chenyme/grok2api/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123788",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-11T03:35:54.231283Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:36:37.238Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/chenyme/grok2api/issues/1072"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
],
"modules": [
"STT Billing"
],
"product": "grok2api",
"vendor": "chenyme",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.1"
},
{
"status": "affected",
"version": "3.1.2"
},
{
"status": "affected",
"version": "3.1.3"
},
{
"status": "affected",
"version": "3.1.4"
},
{
"status": "affected",
"version": "3.1.5"
},
{
"status": "affected",
"version": "3.1.6"
},
{
"status": "unaffected",
"version": "3.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "carfeii (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in chenyme grok2api up to 3.1.6. The impacted element is an unknown function of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component STT Billing. The manipulation leads to enforcement of behavioral workflow. The attack may be initiated remotely. Upgrading to version 3.1.7 is sufficient to resolve this issue. The identifier of the patch is 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T21:15:17.807Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-431934 | chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/431934"
},
{
"name": "VDB-431934 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/431934/cti"
},
{
"name": "CVE-2026-123788 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-123788"
},
{
"name": "Submit #1033606 | https://github.com/chenyme/ grok2api v3.1.6 Improper Enforcement of Behavioral Workflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1033606"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chenyme/grok2api/issues/1072"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/chenyme/grok2api/pull/1073"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/chenyme/grok2api/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-06T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-06T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-06T15:49:41.000Z",
"value": "VulDB entry last update"
}
],
"title": "chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-123788",
"datePublished": "2026-11-06T21:15:17.807Z",
"dateReserved": "2026-11-06T14:44:36.840Z",
"dateUpdated": "2026-11-11T03:36:37.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119558 (GCVE-0-2026-119558)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-11-04 22:19
VLAI
EPSS
VEX
Title
OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points
Summary
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:18 UTC
CWE
- CWE-841 - Improper Enforcement of Behavioral Workflow
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/opencart/opencart/blob/4.1.0.4… | technical-description |
| https://github.com/opencart/opencart/blob/4.1.0.4… | technical-description |
| https://abraxaslabs.tech/research/opencart-reward… | third-party-advisory |
| https://github.com/opencart/opencart | product |
| https://www.vulncheck.com/advisories/opencart-thr… | third-party-advisory |
Impacted products
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:18:51.525209Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:19:00.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opencart/opencart",
"product": "OpenCart",
"repo": "https://github.com/opencart/opencart",
"vendor": "OpenCart",
"versions": [
{
"lessThanOrEqual": "4.1.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.1.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:07.587Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/checkout/reward.php#L89-L94"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/payment/free_checkout.php#L47-L55"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opencart-reward-free-checkout"
},
{
"tags": [
"product"
],
"url": "https://github.com/opencart/opencart"
},
{
"name": "VulnCheck Advisory: OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-checkout-reward-points"
}
],
"title": "OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119558",
"datePublished": "2026-10-30T11:31:07.587Z",
"dateReserved": "2026-10-30T10:53:28.953Z",
"dateUpdated": "2026-11-04T22:19:00.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115248 (GCVE-0-2026-115248)
Vulnerability from cvelistv5 – Published: 2026-10-22 13:30 – Updated: 2026-10-29 02:14
VLAI
EPSS
VEX
Title
subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow
Summary
A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 02:14 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/425221 | vdb-entry |
| https://vuldb.com/vuln/425221/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-115248 | third-party-advisory |
| https://vuldb.com/submit/1021709 | third-party-advisory |
| https://github.com/subhajitkhan/online-clinic-man… | exploitissue-tracking |
| https://github.com/subhajitkhan/online-clinic-man… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| subhajitkhan | online-clinic-management-system |
Affected:
e9ee77a8827a1446220fa07ee693dc4d9a29a578
cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115248",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T02:14:10.267838Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:14:19.530Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:subhajitkhan:online-clinic-management-system:*:*:*:*:*:*:*:*"
],
"modules": [
"Booking Handler"
],
"product": "online-clinic-management-system",
"vendor": "subhajitkhan",
"versions": [
{
"status": "affected",
"version": "e9ee77a8827a1446220fa07ee693dc4d9a29a578"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "yuanchao (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The patch is identified as e9ee77a8827a1446220fa07ee693dc4d9a29a578. It is advisable to implement a patch to correct this issue. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T13:30:10.769Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-425221 | subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/425221"
},
{
"name": "VDB-425221 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/425221/cti"
},
{
"name": "CVE-2026-115248 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-115248"
},
{
"name": "Submit #1021709 | subhajitkhan online-clinic-management-system e9ee77a8827a1446220fa07ee693dc4d9a29a578 Client-Side Enforcement of Server-Side Security",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1021709"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/subhajitkhan/online-clinic-management-system/issues/10"
},
{
"tags": [
"product"
],
"url": "https://github.com/subhajitkhan/online-clinic-management-system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-22T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-22T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-22T10:31:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-115248",
"datePublished": "2026-10-22T13:30:10.769Z",
"dateReserved": "2026-10-22T08:26:22.421Z",
"dateUpdated": "2026-10-29T02:14:19.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109231 (GCVE-0-2026-109231)
Vulnerability from cvelistv5 – Published: 2026-10-31 09:29 – Updated: 2026-11-03 19:10
VLAI
EPSS
VEX
Title
Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
Summary
The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account — only being registered inside the `is_double_opt_in_login_enabled()` branch when "Disable login for unactivated customers" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim's billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker's account and exposing the original buyer's billing name, street address, phone number, and purchased items on the attacker's My Account order page. Exploitation requires the site to have double opt-in enabled with "Disable login for unactivated customers" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:09 UTC
CWE
- CWE-841 - Improper Enforcement of Behavioral Workflow
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| vendidero | Germanized for WooCommerce |
Affected:
0 , ≤ 4.1.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109231",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:09:50.876055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:10:03.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Germanized for WooCommerce",
"vendor": "vendidero",
"versions": [
{
"lessThanOrEqual": "4.1.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sawyer"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook \u2014 which is responsible for rotating the activation token and recording a pending-email-change marker on an unactivated Customer account \u2014 only being registered inside the `is_double_opt_in_login_enabled()` branch when \"Disable login for unactivated customers\" is set to Yes, leaving the original `?activate=` token valid and entirely unbound to the email address it was issued for when that setting is No. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change their account email to a victim\u0027s billing email via the standard `/my-account/edit-account/` form and then redeem their original activation token through `customer_account_activate()`, triggering `link_customer_past_orders()` to reassign any matching guest order to the attacker\u0027s account and exposing the original buyer\u0027s billing name, street address, phone number, and purchased items on the attacker\u0027s My Account order page. Exploitation requires the site to have double opt-in enabled with \"Disable login for unactivated customers\" explicitly set to No (a non-default configuration), public customer registration enabled, and the original activation token redeemed within its one-day expiry window."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "CWE-841 Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T09:29:27.848Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b661e8d7-c50e-4cbf-86a8-3e44d7b61871?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L915"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L88"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L687"
},
{
"url": "https://plugins.trac.wordpress.org/browser/woocommerce-germanized/tags/4.1.4/includes/class-wc-gzd-customer-helper.php#L127"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3743210%40woocommerce-germanized\u0026new=3743210%40woocommerce-germanized"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T14:14:46.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-30T21:04:17.000Z",
"value": "Disclosed"
}
],
"title": "Germanized for WooCommerce \u003c= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-109231",
"datePublished": "2026-10-31T09:29:27.848Z",
"dateReserved": "2026-10-12T13:59:09.025Z",
"dateUpdated": "2026-11-03T19:10:03.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108789 (GCVE-0-2026-108789)
Vulnerability from cvelistv5 – Published: 2026-10-12 02:15 – Updated: 2026-10-13 14:22
VLAI
EPSS
VEX
Title
deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow
Summary
A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 14:22 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416568 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416568/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-108789 | third-party-advisory |
| https://vuldb.com/submit/959699 | third-party-advisory |
| https://github.com/deepseek-ai/deepseek-harness/d… | related |
| https://mcniyfj5bw9b.feishu.cn/docx/M5H6d9AbioNft… | exploit |
| https://github.com/deepseek-ai/deepseek-harness/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| deepseek-ai | deepseek-harness |
Affected:
0.1.1-rc.0
Affected: 0.1.1-rc.1 Affected: 0.1.1-rc.2 cpe:2.3:a:deepseek-ai:deepseek-harness:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108789",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T14:22:30.481471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:22:56.082Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:deepseek-ai:deepseek-harness:*:*:*:*:*:*:*:*"
],
"modules": [
"dsh-workflow-worker-thread"
],
"product": "deepseek-harness",
"vendor": "deepseek-ai",
"versions": [
{
"status": "affected",
"version": "0.1.1-rc.0"
},
{
"status": "affected",
"version": "0.1.1-rc.1"
},
{
"status": "affected",
"version": "0.1.1-rc.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ShiyuFan_BinYuan (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-840",
"description": "Business Logic Errors",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T02:15:31.636Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416568 | deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416568"
},
{
"name": "VDB-416568 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416568/cti"
},
{
"name": "CVE-2026-108789 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-108789"
},
{
"name": "Submit #959699 | \u676d\u5dde\u6df1\u5ea6\u6c42\u7d22\u4eba\u5de5\u667a\u80fd\u57fa\u7840\u6280\u672f\u7814\u7a76\u6709\u9650\u516c\u53f8 DeepSeek Harness 0.1.1-rc.2 \u903b\u8f91\u7f3a\u9677",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/959699"
},
{
"tags": [
"related"
],
"url": "https://github.com/deepseek-ai/deepseek-harness/discussions/243"
},
{
"tags": [
"exploit"
],
"url": "https://mcniyfj5bw9b.feishu.cn/docx/M5H6d9AbioNftYxwk9CchJgGnHc"
},
{
"tags": [
"product"
],
"url": "https://github.com/deepseek-ai/deepseek-harness/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-11T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-11T10:50:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-108789",
"datePublished": "2026-10-12T02:15:31.636Z",
"dateReserved": "2026-10-11T08:45:05.631Z",
"dateUpdated": "2026-10-13T14:22:56.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104626 (GCVE-0-2026-104626)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:23 – Updated: 2026-10-07 20:19
VLAI
EPSS
VEX
Title
Gitea fork workflow job revival through later approval
Summary
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 20:19 UTC
CWE
- CWE-841 - Improper Enforcement of Behavioral Workflow
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/go-gitea/gitea/security/adviso… | vendor-advisory |
| https://github.com/go-gitea/gitea/pull/39399 | patch |
| https://blog.gitea.com/release-of-28.0.0/ | release-notes |
| https://github.com/go-gitea/gitea/releases/tag/v28.0.0 | release-notes |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104626",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T20:19:04.289390Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T20:19:46.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "gitea.dev",
"product": "Gitea",
"vendor": "Gitea",
"versions": [
{
"lessThanOrEqual": "1.27.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "https://github.com/opensec-intelligence"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/mayank-jangid-moon"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/Kushalkhemka"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/skigeek16"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/nithissh7"
},
{
"lang": "en",
"type": "reporter",
"value": "https://github.com/kewmine"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/bircni"
},
{
"lang": "en",
"type": "remediation developer",
"value": "https://github.com/silverwind"
}
],
"descriptions": [
{
"lang": "en",
"value": "A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer\u0027s later approval action, Actions to be enabled, and a runner that accepts the repository\u0027s jobs."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "CWE-841: Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:23:03.330Z",
"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"shortName": "Gitea"
},
"references": [
{
"name": "GitHub Security Advisory GHSA-93pj-3x56-5gc2",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2"
},
{
"name": "Fix: go-gitea/gitea pull request #39399",
"tags": [
"patch"
],
"url": "https://github.com/go-gitea/gitea/pull/39399"
},
{
"name": "Gitea 28.0.0 release announcement",
"tags": [
"release-notes"
],
"url": "https://blog.gitea.com/release-of-28.0.0/"
},
{
"name": "go-gitea/gitea v28.0.0 release",
"tags": [
"release-notes"
],
"url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0"
}
],
"title": "Gitea fork workflow job revival through later approval"
}
},
"cveMetadata": {
"assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
"assignerShortName": "Gitea",
"cveId": "CVE-2026-104626",
"datePublished": "2026-10-06T19:23:03.330Z",
"dateReserved": "2026-10-04T21:57:35.546Z",
"dateUpdated": "2026-10-07T20:19:46.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-103977 (GCVE-0-2026-103977)
Vulnerability from cvelistv5 – Published: 2026-10-14 20:38 – Updated: 2026-10-20 02:10
VLAI
EPSS
VEX
Title
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
Summary
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 02:10 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/error311/FileRise/security/adv… | x_refsource_CONFIRM |
| https://github.com/error311/FileRise/commit/cc111… | x_refsource_MISC |
| https://github.com/error311/FileRise/releases/tag… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103977",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T02:10:15.462870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T02:10:25.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "FileRise",
"vendor": "error311",
"versions": [
{
"status": "affected",
"version": "\u003c 3.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account\u0027s valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-841",
"description": "CWE-841: Improper Enforcement of Behavioral Workflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T20:38:39.485Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/error311/FileRise/security/advisories/GHSA-4hfj-6478-5cv7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/error311/FileRise/security/advisories/GHSA-4hfj-6478-5cv7"
},
{
"name": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a"
},
{
"name": "https://github.com/error311/FileRise/releases/tag/v3.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/error311/FileRise/releases/tag/v3.23.0"
}
],
"source": {
"advisory": "GHSA-4hfj-6478-5cv7",
"discovery": "UNKNOWN"
},
"title": "FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-103977",
"datePublished": "2026-10-14T20:38:39.485Z",
"dateReserved": "2026-10-01T16:09:08.456Z",
"dateUpdated": "2026-10-20T02:10:25.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.