🚨 CVE-2026-84795
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
🎖@cveNotify
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
🎖@cveNotify
GitHub
Public registration inherits admin flag from deactivated admin accounts via missing guard
`User::afterSave()` writes `$record->admin = $this->admin` unconditionally, with no guard — while `active`, `pending`, `locked`, and `suspended` all have change-detection guards that ...
🚨 CVE-2026-84796
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.
🎖@cveNotify
Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, modify, or delete entries across unauthorized sites by passing siteId directly in mutation arguments.
🎖@cveNotify
GitHub
GQL entry mutation siteId bypasses schema site scope, enabling cross-site content read/write/delete
Craft CMS GraphQL entry mutation resolvers (`saveEntry`, `deleteEntry`) read `siteId` directly from `$arguments` without passing through `ArgumentManager::prepareArguments()`, which is the function...
🚨 CVE-2026-84797
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content.
🎖@cveNotify
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content.
🎖@cveNotify
GitHub
actionDuplicate with deleteProvisionalDraft side-effect deletes peer drafts
`ElementsController::actionDuplicate()` accepts a `deleteProvisionalDraft` request parameter. After successfully duplicating an element, if the source is a provisional draft and this flag is set, t...
🚨 CVE-2026-84798
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry's site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft's recycle bin.
🎖@cveNotify
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry's site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft's recycle bin.
🎖@cveNotify
GitHub
actionDeleteForSite propagates deletion to canonical element without independent authorization check
`ElementsController::actionDeleteForSite()` loads an element with `checkForProvisionalDraft: true`, which returns the user’s provisional draft if one exists. It then calls `canDeleteForSite()` on t...
🚨 CVE-2026-84799
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.
🎖@cveNotify
Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relations to read usernames, email addresses, and full names of any content author or uploader including administrators.
🎖@cveNotify
GitHub
PII disclosure with GraphQL native user relations
Craft’s GraphQL schemas are scoped per user group, and the top-level `users` query correctly enforces that scope.
However, the native element→User relations — `author`, `authors`, `uploader`, `d...
However, the native element→User relations — `author`, `authors`, `uploader`, `d...
🚨 CVE-2026-84800
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11.
🎖@cveNotify
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11.
🎖@cveNotify
GitHub
Peer asset file overwrite via assets/replace-file late-discovered target skips permission check
`AssetsController::actionReplaceFile` allows a low-privilege author to overwrite the file content of an arbitrary peer’s asset. When the request supplies `sourceAssetId` and `targetFilename` but NO...
🚨 CVE-2026-84801
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.
🎖@cveNotify
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.
🎖@cveNotify
GitHub
Non-admin with administrateUsers permissions can mint an admin password reset URL
`UsersController::actionGetPasswordResetUrl` lets a non-admin control-panel user who holds the `administrateUsers` permission mint a valid password reset URL for any user, including administrators....
🚨 CVE-2026-84802
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
🎖@cveNotify
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
🎖@cveNotify
GitHub
Missing volume permission in AssetsController::actionMoveInfo leaks cross-volume asset count and total size
`AssetsController::actionMoveInfo` (added in 5.7.0) enforces only `requireCpRequest` + `requirePostRequest`, then computes `count()` + `sum(size)` over the assets table for arbitrary `folderIds`/`a...
🚨 CVE-2026-84803
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
🎖@cveNotify
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
🎖@cveNotify
GitHub
Incomplete Asset Blocklist Bypasses the GHSA-mjf3-jwmf-r6wf Fix (Stored XSS, API Token Theft)
## Summary
The GHSA-mjf3-jwmf-r6wf fix forces `Content-Disposition: attachment` on script-capable assets using a hardcoded extension blocklist, with a fallback that forces attachment when Go doe...
The GHSA-mjf3-jwmf-r6wf fix forces `Content-Disposition: attachment` on script-capable assets using a hardcoded extension blocklist, with a fallback that forces attachment when Go doe...
🚨 CVE-2026-84805
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
🎖@cveNotify
Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behind the contract_other_profile admin permission, the WorkContractPreferenceSubscriber (introduced in 2.61.0) registers the preferences as enabled without a permission check, so an authenticated regular user can use the API to modify their own admin-only work-contract data. The issue is fixed in 2.63.0 by applying the same permission check to the API endpoint.
🎖@cveNotify
GitHub
Regular users can set admin-only work-contract fields via API
## Summary
The API endpoint `PATCH /api/users/{id}/preferences` gates each submitted preference by`UserPreference::isEnabled()`.
The rate preferences are correctly disabled for low-privilege u...
The API endpoint `PATCH /api/users/{id}/preferences` gates each submitted preference by`UserPreference::isEnabled()`.
The rate preferences are correctly disabled for low-privilege u...
🚨 CVE-2026-84806
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.
🎖@cveNotify
Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.
🎖@cveNotify
GitHub
Team Access endpoints allow ACL modification with `view` entity permission
## Summary
A business logic / improper authorization vulnerability in Kimai allows an authenticated user with team edit permissions and read-only access to a customer, project, or activity to gr...
A business logic / improper authorization vulnerability in Kimai allows an authenticated user with team edit permissions and read-only access to a customer, project, or activity to gr...
🚨 CVE-2026-84807
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.
🎖@cveNotify
Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0.
🎖@cveNotify
GitHub
Creating a default team could grant team lead rights on an existing team
## Summary
A business logic / improper authorization vulnerability in Kimai allows an authenticated user with project permission-management privileges to become a teamlead of an existing team by...
A business logic / improper authorization vulnerability in Kimai allows an authenticated user with project permission-management privileges to become a teamlead of an existing team by...
🚨 CVE-2026-84808
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
🎖@cveNotify
Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets using activities restricted to teams they do not belong to, bypassing intended data isolation.
🎖@cveNotify
GitHub
API Timesheet lists ignore team restrictions on activities
## Summary
The Kimai REST API timesheet collection endpoint (`GET /api/timesheets`) returns records that bypass activity-team access controls. A teamlead or any user with `view_other_timesheet` ...
The Kimai REST API timesheet collection endpoint (`GET /api/timesheets`) returns records that bypass activity-team access controls. A teamlead or any user with `view_other_timesheet` ...
🚨 CVE-2026-84835
Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Rentsyst: from n/a through 2.1.2.
🎖@cveNotify
Missing Authorization vulnerability in DimaFreund Rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Rentsyst: from n/a through 2.1.2.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Rentsyst Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-16647
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
🎖@cveNotify
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
🎖@cveNotify
Drupal.org
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may…
🚨 CVE-2026-18986
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.
🎖@cveNotify
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.
🎖@cveNotify
Drupal.org
Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting (XSS) vulnerability. The vulnerability…
🚨 CVE-2026-73474
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
🎖@cveNotify
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
🎖@cveNotify
Drupal.org
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks.
🚨 CVE-2026-73475
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
🎖@cveNotify
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
🎖@cveNotify
Drupal.org
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only…
🚨 CVE-2026-73476
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
🎖@cveNotify
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
🎖@cveNotify
Drupal.org
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database…
🚨 CVE-2026-73477
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
🎖@cveNotify
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
🎖@cveNotify
Drupal.org
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant…
🚨 CVE-2026-73478
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
🎖@cveNotify
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
🎖@cveNotify
Drupal.org
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the…