https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 18:04:34 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-16751 <p>Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim&#39;s emergency contact to bypass the configured recovery waiting period and take over the victim&#39;s account via a crafted `approve-recovery` API request.</p> <p>Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim&#39;s emergency contact to bypass the configured recovery waiting period and take over the victim&#39;s account via a crafted `approve-recovery` API request.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-16751 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0413 <p><strong>Affected:</strong> Penpot (open-source design and prototyping platform, Kaleidos)</p> <p>Posting this as an update rather than a first disclosure. The advisory went public on 2026-08-04 with no vendor fix. Penpot has shipped two releases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on 2026-08-27 -- and I re-checked the code this morning: the missing permission check is still missing in both, and in every release before them. It was fixed on develop the day after this advisory went public. That fix has never shipped. Anyone running a released version of self-hosted Penpot should know that, so here is the whole thing in one message.</p> <p>SUMMARY =======</p> <p>Penpot&#39;s file-import RPC command takes an optional caller-supplied file-id, meaning &#34;import into this existing file instead of creating a new one.&#34; The handler checks that the caller may edit the project they named -- a project they own, since they supplied it. It never checks that the file-id they supplied belongs to them.</p> <p>So any authenticated user can point that parameter at any file on the instance and overwrite it. The same operation also re-parents the file into the attacker&#39;s project, which is the part that matters: the attacker does not merely destroy the victim&#39;s design, they end up owning it. On a default install with open self-registration, the attacker needs no prior relationship to the target at all.</p> <p>AFFECTED ========</p> <p>Product: Penpot (open-source design and prototyping platform, Kaleidos) Affected: 1.20 through 2.17.2, self-hosted Community Edition and Penpot Cloud. The in-place…</p> <p><strong>Affected:</strong> Penpot (open-source design and prototyping platform, Kaleidos)</p> <p>Posting this as an update rather than a first disclosure. The advisory went public on 2026-08-04 with no vendor fix. Penpot has shipped two releases since then, 2.17.1 and 2.17.2 -- the latter 14 days ago, on 2026-08-27 -- and I re-checked the code this morning: the missing permission check is still missing in both, and in every release before them. It was fixed on develop the day after this advisory went public. That fix has never shipped. Anyone running a released version of self-hosted Penpot should know that, so here is the whole thing in one message.</p> <p>SUMMARY =======</p> <p>Penpot&#39;s file-import RPC command takes an optional caller-supplied file-id, meaning &#34;import into this existing file instead of creating a new one.&#34; The handler checks that the caller may edit the project they named -- a project they own, since they supplied it. It never checks that the file-id they supplied belongs to them.</p> <p>So any authenticated user can point that parameter at any file on the instance and overwrite it. The same operation also re-parents the file into the attacker&#39;s project, which is the part that matters: the attacker does not merely destroy the victim&#39;s design, they end up owning it. On a default install with open self-registration, the attacker needs no prior relationship to the target at all.</p> <p>AFFECTED ========</p> <p>Product: Penpot (open-source design and prototyping platform, Kaleidos) Affected: 1.20 through 2.17.2, self-hosted Community Edition and Penpot Cloud. The in-place…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0413 https://vulnerability.circl.lu/vuln/ghsa-jmh3-fv99-c329 <p>Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim&#39;s emergency contact to bypass the configured recovery waiting period and take over the victim&#39;s account via a crafted `approve-recovery` API request.</p> <p>Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim&#39;s emergency contact to bypass the configured recovery waiting period and take over the victim&#39;s account via a crafted `approve-recovery` API request.</p> https://vulnerability.circl.lu/vuln/ghsa-jmh3-fv99-c329