Common Weakness Enumeration
CWE-266
Weakness AllowedIncorrect Privilege Assignment
Abstraction: Base · Status: Draft
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Mapping guidance
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Content history
Submission: PLOVER
· 2006-07-19
· CWE Draft 3
Modification: Eric Dalci
· Cigital
· 2008-07-01
· CWE 1.0
updated Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2008-09-08
· CWE 1.0
updated Description, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
Modification: CWE Content Team
· MITRE
· 2009-03-10
· CWE 1.3
updated Relationships
Modification: CWE Content Team
· MITRE
· 2009-12-28
· CWE 1.7
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2010-06-21
· CWE 1.9
updated Potential_Mitigations
Modification: CWE Content Team
· MITRE
· 2011-06-01
· CWE 1.13
updated Common_Consequences, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2012-05-11
· CWE 2.2
updated Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2012-10-30
· CWE 2.3
updated Potential_Mitigations, References
Modification: CWE Content Team
· MITRE
· 2014-02-18
· CWE 2.6
updated Applicable_Platforms, Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2017-11-08
· CWE 3.0
updated Causal_Nature, Modes_of_Introduction, References, Relationships
Modification: CWE Content Team
· MITRE
· 2019-01-03
· CWE 3.2
updated Relationships, Taxonomy_Mappings
Modification: CWE Content Team
· MITRE
· 2020-02-24
· CWE 4.0
updated Relationships
Modification: CWE Content Team
· MITRE
· 2021-03-15
· CWE 4.4
updated Demonstrative_Examples
Modification: CWE Content Team
· MITRE
· 2021-10-28
· CWE 4.6
updated Relationships
Modification: CWE Content Team
· MITRE
· 2022-10-13
· CWE 4.9
updated References
Modification: CWE Content Team
· MITRE
· 2023-04-27
· CWE 4.11
updated References, Relationships, Time_of_Introduction
Modification: CWE Content Team
· MITRE
· 2023-06-29
· CWE 4.12
updated Mapping_Notes
Modification: CWE Content Team
· MITRE
· 2025-12-11
· CWE 4.19
updated Relationships
2524 vulnerabilities reference this CWE, most recent first.
CVE-2026-129255 (GCVE-0-2026-129255)
Vulnerability from cvelistv5 – Published: 2026-11-14 12:30 – Updated: 2026-11-14 12:30
VLAI
EPSS
VEX
Title
CoolerMaster MASTERPLUS+ Device Driver WinRing0x64.sys sub_11504 default permission
Summary
A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/437286 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/437286/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-129255 | third-party-advisory |
| https://vuldb.com/submit/1042970 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CoolerMaster | MASTERPLUS+ |
Affected:
1.9.6
cpe:2.3:a:coolermaster:masterplus_:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:coolermaster:masterplus_:*:*:*:*:*:*:*:*"
],
"modules": [
"Device Driver"
],
"product": "MASTERPLUS+",
"vendor": "CoolerMaster",
"versions": [
{
"status": "affected",
"version": "1.9.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Element2023H (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T12:30:17.941Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-437286 | CoolerMaster MASTERPLUS+ Device Driver WinRing0x64.sys sub_11504 default permission",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/437286"
},
{
"name": "VDB-437286 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/437286/cti"
},
{
"name": "CVE-2026-129255 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-129255"
},
{
"name": "Submit #1042970 | CoolerMaster MASTERPLUS+ 1.9.6 Incorrect Default Permissions",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1042970"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-13T20:47:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "CoolerMaster MASTERPLUS+ Device Driver WinRing0x64.sys sub_11504 default permission",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-129255",
"datePublished": "2026-11-14T12:30:17.941Z",
"dateReserved": "2026-11-13T19:41:55.077Z",
"dateUpdated": "2026-11-14T12:30:17.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126785 (GCVE-0-2026-126785)
Vulnerability from cvelistv5 – Published: 2026-11-12 00:30 – Updated: 2026-11-13 00:02
VLAI
EPSS
VEX
Title
rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission
Summary
A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:01 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/435969 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/435969/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-126785 | third-party-advisory |
| https://vuldb.com/submit/1040412 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rmalright | TR-VISION HOME |
Affected:
2.0.5
cpe:2.3:a:rmalright:tr-vision_home:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126785",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:01:50.351489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T00:02:01.644Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rmalright:tr-vision_home:*:*:*:*:*:*:*:*"
],
"modules": [
"IOCTL Handler"
],
"product": "TR-VISION HOME",
"vendor": "rmalright",
"versions": [
{
"status": "affected",
"version": "2.0.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Element2023H (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carried out locally. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.8,
"vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T00:30:24.749Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-435969 | rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/435969"
},
{
"name": "VDB-435969 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/435969/cti"
},
{
"name": "CVE-2026-126785 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-126785"
},
{
"name": "Submit #1040412 | Thermalright TR-VISION HOME Software V2.0.5 Incorrect Default Permissions",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040412"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-11T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-11T20:21:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "rmalright TR-VISION HOME IOCTL WFanManager.sys sub_11504 default permission",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-126785",
"datePublished": "2026-11-12T00:30:24.749Z",
"dateReserved": "2026-11-11T19:16:48.153Z",
"dateUpdated": "2026-11-13T00:02:01.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126404 (GCVE-0-2026-126404)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:35 – Updated: 2026-11-13 20:26
VLAI
EPSS
VEX
Title
Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
Summary
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 20:25 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.4
(semver)
Unaffected: 2.38.4 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.8
(semver)
Unaffected: 2.37.8 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.11
(semver)
Unaffected: 2.36.11 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.16
(semver)
Unaffected: 2.34.16 (semver) |
|
| coder | coder |
Affected:
2.28.0 , < 2.29.24
(semver)
Unaffected: 2.29.24 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T20:25:47.107888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:26:01.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.4",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.8",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.11",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.16",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.24",
"status": "affected",
"version": "2.28.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.4",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.8",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.11",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.16",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.24",
"versionStartIncluding": "2.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "MutedCybersecurity"
},
{
"lang": "en",
"type": "remediation developer",
"value": "EhabY"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token\u0027s scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user\u0027s full privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:45.631Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x3gf-xv6p-56hf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf"
},
{
"name": "VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation"
}
],
"title": "Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126404",
"datePublished": "2026-11-13T09:35:45.631Z",
"dateReserved": "2026-11-10T21:32:21.765Z",
"dateUpdated": "2026-11-13T20:26:01.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-125879 (GCVE-0-2026-125879)
Vulnerability from cvelistv5 – Published: 2026-11-10 21:23 – Updated: 2026-11-12 04:56
VLAI
EPSS
VEX
Title
Local privilege escalation to root via nable-writable syslog-ng config
Summary
Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation.
This issue affects N-central: before 26.4.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-11 00:00 UTC
CWE
- CWE-266 - Incorrect privilege assignment
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://me.n-able.com/s/security-advisory/aArVy00… | vendor-advisory |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-125879",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-11T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T04:56:18.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "N-central",
"vendor": "N-able",
"versions": [
{
"lessThan": "26.4.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation.\u003cp\u003eThis issue affects N-central: before 26.4.1.\u003c/p\u003e"
}
],
"value": "Incorrect privilege assignment vulnerability in N-able N-central allows Privilege Escalation.\n\nThis issue affects N-central: before 26.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect privilege assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T21:23:18.540Z",
"orgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
"shortName": "N-able"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://me.n-able.com/s/security-advisory/aArVy0000002ikvKAA/cve2026125879-local-privilege-escalation-to-root-via-nablewritable-config"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Local privilege escalation to root via nable-writable syslog-ng config",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "a5532a13-c4dd-4202-bef1-e0b8f2f8d12b",
"assignerShortName": "N-able",
"cveId": "CVE-2026-125879",
"datePublished": "2026-11-10T21:23:18.540Z",
"dateReserved": "2026-11-10T12:55:11.705Z",
"dateUpdated": "2026-11-12T04:56:18.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124621 (GCVE-0-2026-124621)
Vulnerability from cvelistv5 – Published: 2026-11-09 11:00 – Updated: 2026-11-09 11:38
VLAI
EPSS
VEX
Title
kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization
Summary
A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 11:38 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433046 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433046/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124621 | third-party-advisory |
| https://vuldb.com/submit/1040541 | third-party-advisory |
| https://github.com/kongxin-github/Java_Library_Ma… | exploitissue-tracking |
| https://github.com/kongxin-github/Java_Library_Ma… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| kongxin-github | Java_Library_Management_System |
Affected:
70a6eb6b96fe64575d8051f1a59055bfc5dc5885
cpe:2.3:a:kongxin-github:java_library_management_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124621",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T11:38:34.347003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:38:46.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:kongxin-github:java_library_management_system:*:*:*:*:*:*:*:*"
],
"modules": [
"Swing UI Layer"
],
"product": "Java_Library_Management_System",
"vendor": "kongxin-github",
"versions": [
{
"status": "affected",
"version": "70a6eb6b96fe64575d8051f1a59055bfc5dc5885"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ME4Dream (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Book.modifybook/Book.deletebook/Category.addcategory/Category.setcategory/Landing.sureadmin of the file src/view/MainInterface.java of the component Swing UI Layer. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T11:00:17.473Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433046 | kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433046"
},
{
"name": "VDB-433046 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433046/cti"
},
{
"name": "CVE-2026-124621 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124621"
},
{
"name": "Submit #1040541 | kongxin-github Java_Library_Management_System 70a6eb6b96fe64575d8051f1a59055bfc5dc5885 Client-Side Enforcement of Server-Side Security",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040541"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/kongxin-github/Java_Library_Management_System/issues/4"
},
{
"tags": [
"product"
],
"url": "https://github.com/kongxin-github/Java_Library_Management_System/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T08:00:00.000Z",
"value": "VulDB entry last update"
}
],
"title": "kongxin-github Java_Library_Management_System Swing UI Layer MainInterface.java Landing.sureadmin improper authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124621",
"datePublished": "2026-11-09T11:00:17.473Z",
"dateReserved": "2026-11-09T06:53:10.396Z",
"dateUpdated": "2026-11-09T11:38:46.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124590 (GCVE-0-2026-124590)
Vulnerability from cvelistv5 – Published: 2026-11-09 10:15 – Updated: 2026-11-10 17:51
VLAI
EPSS
VEX
Title
zhangbw409 library_manager_system UserController.java BookController.addBook improper authorization
Summary
A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:41 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433014 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433014/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124590 | third-party-advisory |
| https://vuldb.com/submit/1040539 | third-party-advisory |
| https://github.com/zhangbw409/library_manager_sys… | exploitissue-tracking |
| https://github.com/zhangbw409/library_manager_system/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zhangbw409 | library_manager_system |
Affected:
56514767a5207caf5e04c2cea379dfaa8cb5f00b
Affected: f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b cpe:2.3:a:zhangbw409:library_manager_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124590",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:41:14.875144Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:51:26.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:zhangbw409:library_manager_system:*:*:*:*:*:*:*:*"
],
"product": "library_manager_system",
"vendor": "zhangbw409",
"versions": [
{
"status": "affected",
"version": "56514767a5207caf5e04c2cea379dfaa8cb5f00b"
},
{
"status": "affected",
"version": "f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ME4Dream (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/com/zbw/controller/UserController.java. The manipulation of the argument userName/userPwd/userEmail/userId leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T10:15:21.119Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433014 | zhangbw409 library_manager_system UserController.java BookController.addBook improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433014"
},
{
"name": "VDB-433014 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433014/cti"
},
{
"name": "CVE-2026-124590 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124590"
},
{
"name": "Submit #1040539 | zhangbw409 library_manager_system 56514767a5207caf5e04c2cea379dfaa8cb5f00b Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040539"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/zhangbw409/library_manager_system/issues/15"
},
{
"tags": [
"product"
],
"url": "https://github.com/zhangbw409/library_manager_system/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T21:41:20.000Z",
"value": "VulDB entry last update"
}
],
"title": "zhangbw409 library_manager_system UserController.java BookController.addBook improper authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124590",
"datePublished": "2026-11-09T10:15:21.119Z",
"dateReserved": "2026-11-08T20:36:15.437Z",
"dateUpdated": "2026-11-10T17:51:26.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124574 (GCVE-0-2026-124574)
Vulnerability from cvelistv5 – Published: 2026-11-09 06:30 – Updated: 2026-11-09 22:38 X_Open Source
VLAI
EPSS
VEX
Title
chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization
Summary
A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:38 UTC
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432920 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432920/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124574 | third-party-advisory |
| https://vuldb.com/submit/1036006 | third-party-advisory |
| https://github.com/chenyme/grok2api/issues/1066 | issue-tracking |
| https://github.com/chenyme/grok2api/pull/1067 | issue-trackingpatch |
| https://github.com/chenyme/grok2api/commit/199b3a… | patch |
| https://github.com/chenyme/grok2api/releases/tag/v3.1.7 | patch |
| https://github.com/chenyme/grok2api/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124574",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:38:25.650900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:38:36.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*"
],
"modules": [
"Video Job Retry Handler"
],
"product": "grok2api",
"vendor": "chenyme",
"versions": [
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.1.1"
},
{
"status": "affected",
"version": "3.1.2"
},
{
"status": "affected",
"version": "3.1.3"
},
{
"status": "affected",
"version": "3.1.4"
},
{
"status": "affected",
"version": "3.1.5"
},
{
"status": "affected",
"version": "3.1.6"
},
{
"status": "unaffected",
"version": "3.1.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "carfeii (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T06:30:32.946Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432920 | chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432920"
},
{
"name": "VDB-432920 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432920/cti"
},
{
"name": "CVE-2026-124574 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124574"
},
{
"name": "Submit #1036006 | https://github.com/chenyme/grok2api/issues/1066 grok2api v3.1.6 (commit 906b9493b099d192381c698d4e320fafeccb851c) Incorrect Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1036006"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/chenyme/grok2api/issues/1066"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/chenyme/grok2api/pull/1067"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/chenyme/grok2api/releases/tag/v3.1.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/chenyme/grok2api/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T17:58:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124574",
"datePublished": "2026-11-09T06:30:32.946Z",
"dateReserved": "2026-11-08T16:53:01.460Z",
"dateUpdated": "2026-11-09T22:38:36.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124569 (GCVE-0-2026-124569)
Vulnerability from cvelistv5 – Published: 2026-11-09 05:15 – Updated: 2026-11-10 17:52
VLAI
EPSS
VEX
Title
fushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access control
Summary
A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 15:42 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432901 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432901/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124569 | third-party-advisory |
| https://vuldb.com/submit/1035650 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fushengqian | fuintCatering |
Affected:
6d054f5788ac8645eb491f79242bb8a625efc133
cpe:2.3:a:fushengqian:fuintcatering:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124569",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T15:42:42.644466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:52:03.954Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fushengqian:fuintcatering:*:*:*:*:*:*:*:*"
],
"product": "fuintCatering",
"vendor": "fushengqian",
"versions": [
{
"status": "affected",
"version": "6d054f5788ac8645eb491f79242bb8a625efc133"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Y1Daa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument Status results in improper access controls. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T05:15:07.727Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432901 | fushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432901"
},
{
"name": "VDB-432901 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432901/cti"
},
{
"name": "CVE-2026-124569 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124569"
},
{
"name": "Submit #1035650 | fushengqian fuintCatering up to 06e744dd Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035650"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T16:00:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "fushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access control",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124569",
"datePublished": "2026-11-09T05:15:07.727Z",
"dateReserved": "2026-11-08T14:55:21.665Z",
"dateUpdated": "2026-11-10T17:52:03.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124568 (GCVE-0-2026-124568)
Vulnerability from cvelistv5 – Published: 2026-11-09 05:00 – Updated: 2026-11-12 14:38
VLAI
EPSS
VEX
Title
fushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access control
Summary
A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 14:36 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432900 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432900/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124568 | third-party-advisory |
| https://vuldb.com/submit/1035643 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fushengqian | fuintCatering |
Affected:
6d054f5788ac8645eb491f79242bb8a625efc133
cpe:2.3:a:fushengqian:fuintcatering:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124568",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T14:36:57.859891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:38:05.605Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fushengqian:fuintcatering:*:*:*:*:*:*:*:*"
],
"modules": [
"Refund Agreement"
],
"product": "fuintCatering",
"vendor": "fushengqian",
"versions": [
{
"status": "affected",
"version": "6d054f5788ac8645eb491f79242bb8a625efc133"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Y1Daa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T05:00:22.396Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432900 | fushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432900"
},
{
"name": "VDB-432900 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432900/cti"
},
{
"name": "CVE-2026-124568 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124568"
},
{
"name": "Submit #1035643 | fushengqian fuintCatering up to 06e744dd Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035643"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T16:00:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "fushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access control",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124568",
"datePublished": "2026-11-09T05:00:22.396Z",
"dateReserved": "2026-11-08T14:55:18.061Z",
"dateUpdated": "2026-11-12T14:38:05.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124565 (GCVE-0-2026-124565)
Vulnerability from cvelistv5 – Published: 2026-11-09 04:15 – Updated: 2026-11-10 17:52
VLAI
EPSS
VEX
Title
fushengqian fuint Order Verification MerchantOrderController.java confirm access control
Summary
A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 15:42 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432897 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432897/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124565 | third-party-advisory |
| https://vuldb.com/submit/1035641 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| fushengqian | fuint |
Affected:
36cc31b08d77facc94e8959afa02224891b4fe5f
cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124565",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T15:42:40.412867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:52:14.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:*"
],
"modules": [
"Order Verification"
],
"product": "fuint",
"vendor": "fushengqian",
"versions": [
{
"status": "affected",
"version": "36cc31b08d77facc94e8959afa02224891b4fe5f"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Y1Daa (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulation leads to improper access controls. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T04:15:20.046Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432897 | fushengqian fuint Order Verification MerchantOrderController.java confirm access control",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432897"
},
{
"name": "VDB-432897 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432897/cti"
},
{
"name": "CVE-2026-124565 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124565"
},
{
"name": "Submit #1035641 | fushengqian fuint up to cb498ad2 Improper Access Controls",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035641"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T16:00:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "fushengqian fuint Order Verification MerchantOrderController.java confirm access control",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124565",
"datePublished": "2026-11-09T04:15:20.046Z",
"dateReserved": "2026-11-08T14:55:05.807Z",
"dateUpdated": "2026-11-10T17:52:14.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
No CAPEC attack patterns related to this CWE.