Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by SpecterOps
CVE-2026-85241 (GCVE-0-2026-85241)
Vulnerability from nvd – Published: 2026-09-03 22:30 – Updated: 2026-09-03 22:30 X_Open Source
VLAI
EPSS
VEX
Title
SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization
Summary
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398471 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/398471/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-85241 | third-party-advisory |
| https://vuldb.com/submit/894488 | third-party-advisory |
| https://github.com/SpecterOps/BloodHound/commit/3… | patch |
| https://github.com/SpecterOps/BloodHound/releases… | patch |
| https://github.com/SpecterOps/BloodHound/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpecterOps | BloodHound |
Affected:
9.0.0
Affected: 9.1.0 Affected: 9.2.2 Affected: 9.4.0 Affected: 9.5.0 Affected: 9.5.1 Unaffected: 9.6.0-rc1 Unaffected: 9.6.0 Unaffected: 9.7.0-rc3 cpe:2.3:a:specterops:bloodhound:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:specterops:bloodhound:*:*:*:*:*:*:*:*"
],
"modules": [
"Graph Write Endpoint"
],
"product": "BloodHound",
"vendor": "SpecterOps",
"versions": [
{
"status": "affected",
"version": "9.0.0"
},
{
"status": "affected",
"version": "9.1.0"
},
{
"status": "affected",
"version": "9.2.2"
},
{
"status": "affected",
"version": "9.4.0"
},
{
"status": "affected",
"version": "9.5.0"
},
{
"status": "affected",
"version": "9.5.1"
},
{
"status": "unaffected",
"version": "9.6.0-rc1"
},
{
"status": "unaffected",
"version": "9.6.0"
},
{
"status": "unaffected",
"version": "9.7.0-rc3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "b1d0ws (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB Vulnerability Moderation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T22:30:14.587Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398471 | SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/398471"
},
{
"name": "VDB-398471 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398471/cti"
},
{
"name": "CVE-2026-85241 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-85241"
},
{
"name": "Submit #894488 | SpecterOps BloodHound 9.4.0 Improper Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/894488"
},
{
"tags": [
"patch"
],
"url": "https://github.com/SpecterOps/BloodHound/commit/39d1276a63e95a7713f954dea632a19651d9cebb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/SpecterOps/BloodHound/releases/tag/v9.6.0-rc1"
},
{
"tags": [
"product"
],
"url": "https://github.com/SpecterOps/BloodHound/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-03T17:52:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-85241",
"datePublished": "2026-09-03T22:30:14.587Z",
"dateReserved": "2026-09-03T15:45:24.645Z",
"dateUpdated": "2026-09-03T22:30:14.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59255 (GCVE-0-2026-59255)
Vulnerability from nvd – Published: 2026-07-15 17:03 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
BloodHound Missing Authorization on Custom Node Management API
Summary
BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 18:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SpecterOps/BloodHound/issues/2910 | technical-descriptionexploit |
| https://github.com/SpecterOps/BloodHound/pull/2989 | issue-tracking |
| https://github.com/SpecterOps/BloodHound/commit/8… | patch |
| https://www.vulncheck.com/advisories/bloodhound-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpecterOps | BloodHound |
Affected:
0 , ≤ 9.4.0
(semver)
Unaffected: 8f790351349fd87bcb04377aba84cba6495825b3 (git) cpe:2.3:a:bloodhound_project:bloodhound:*:*:*:*:*:*:*:* |
Date Public
2026-06-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59255",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T18:03:35.694495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T18:04:05.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/bloodhound-ce",
"product": "BloodHound",
"repo": "https://github.com/SpecterOps/BloodHound",
"vendor": "SpecterOps",
"versions": [
{
"lessThanOrEqual": "9.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8f790351349fd87bcb04377aba84cba6495825b3",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bloodhound_project:bloodhound:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:48.861Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/SpecterOps/BloodHound/issues/2910"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/SpecterOps/BloodHound/pull/2989"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/SpecterOps/BloodHound/commit/8f790351349fd87bcb04377aba84cba6495825b3"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bloodhound-missing-authorization-on-custom-node-management-api"
}
],
"tags": [
"x_open-source"
],
"title": "BloodHound Missing Authorization on Custom Node Management API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-59255",
"datePublished": "2026-07-15T17:03:38.361Z",
"dateReserved": "2026-07-04T12:17:14.301Z",
"dateUpdated": "2026-07-28T01:49:48.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85241 (GCVE-0-2026-85241)
Vulnerability from cvelistv5 – Published: 2026-09-03 22:30 – Updated: 2026-09-03 22:30 X_Open Source
VLAI
EPSS
VEX
Title
SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization
Summary
A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/398471 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/398471/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-85241 | third-party-advisory |
| https://vuldb.com/submit/894488 | third-party-advisory |
| https://github.com/SpecterOps/BloodHound/commit/3… | patch |
| https://github.com/SpecterOps/BloodHound/releases… | patch |
| https://github.com/SpecterOps/BloodHound/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpecterOps | BloodHound |
Affected:
9.0.0
Affected: 9.1.0 Affected: 9.2.2 Affected: 9.4.0 Affected: 9.5.0 Affected: 9.5.1 Unaffected: 9.6.0-rc1 Unaffected: 9.6.0 Unaffected: 9.7.0-rc3 cpe:2.3:a:specterops:bloodhound:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:specterops:bloodhound:*:*:*:*:*:*:*:*"
],
"modules": [
"Graph Write Endpoint"
],
"product": "BloodHound",
"vendor": "SpecterOps",
"versions": [
{
"status": "affected",
"version": "9.0.0"
},
{
"status": "affected",
"version": "9.1.0"
},
{
"status": "affected",
"version": "9.2.2"
},
{
"status": "affected",
"version": "9.4.0"
},
{
"status": "affected",
"version": "9.5.0"
},
{
"status": "affected",
"version": "9.5.1"
},
{
"status": "unaffected",
"version": "9.6.0-rc1"
},
{
"status": "unaffected",
"version": "9.6.0"
},
{
"status": "unaffected",
"version": "9.7.0-rc3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "b1d0ws (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB Vulnerability Moderation Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. Upgrading to version 9.6.0-rc1, 9.6.0 and 9.7.0-rc3 is sufficient to fix this issue. This patch is called 39d1276a63e95a7713f954dea632a19651d9cebb. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T22:30:14.587Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-398471 | SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/398471"
},
{
"name": "VDB-398471 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/398471/cti"
},
{
"name": "CVE-2026-85241 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-85241"
},
{
"name": "Submit #894488 | SpecterOps BloodHound 9.4.0 Improper Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/894488"
},
{
"tags": [
"patch"
],
"url": "https://github.com/SpecterOps/BloodHound/commit/39d1276a63e95a7713f954dea632a19651d9cebb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/SpecterOps/BloodHound/releases/tag/v9.6.0-rc1"
},
{
"tags": [
"product"
],
"url": "https://github.com/SpecterOps/BloodHound/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-03T17:52:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-85241",
"datePublished": "2026-09-03T22:30:14.587Z",
"dateReserved": "2026-09-03T15:45:24.645Z",
"dateUpdated": "2026-09-03T22:30:14.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59255 (GCVE-0-2026-59255)
Vulnerability from cvelistv5 – Published: 2026-07-15 17:03 – Updated: 2026-07-28 01:49 X_Open Source
VLAI
EPSS
VEX
Title
BloodHound Missing Authorization on Custom Node Management API
Summary
BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 18:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/SpecterOps/BloodHound/issues/2910 | technical-descriptionexploit |
| https://github.com/SpecterOps/BloodHound/pull/2989 | issue-tracking |
| https://github.com/SpecterOps/BloodHound/commit/8… | patch |
| https://www.vulncheck.com/advisories/bloodhound-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SpecterOps | BloodHound |
Affected:
0 , ≤ 9.4.0
(semver)
Unaffected: 8f790351349fd87bcb04377aba84cba6495825b3 (git) cpe:2.3:a:bloodhound_project:bloodhound:*:*:*:*:*:*:*:* |
Date Public
2026-06-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59255",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T18:03:35.694495Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T18:04:05.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/bloodhound-ce",
"product": "BloodHound",
"repo": "https://github.com/SpecterOps/BloodHound",
"vendor": "SpecterOps",
"versions": [
{
"lessThanOrEqual": "9.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8f790351349fd87bcb04377aba84cba6495825b3",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bloodhound_project:bloodhound:*:*:*:*:*:*:*:*",
"versionEndIncluding": "9.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T01:49:48.861Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Researcher Disclosure",
"tags": [
"technical-description",
"exploit"
],
"url": "https://github.com/SpecterOps/BloodHound/issues/2910"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/SpecterOps/BloodHound/pull/2989"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/SpecterOps/BloodHound/commit/8f790351349fd87bcb04377aba84cba6495825b3"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bloodhound-missing-authorization-on-custom-node-management-api"
}
],
"tags": [
"x_open-source"
],
"title": "BloodHound Missing Authorization on Custom Node Management API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-59255",
"datePublished": "2026-07-15T17:03:38.361Z",
"dateReserved": "2026-07-04T12:17:14.301Z",
"dateUpdated": "2026-07-28T01:49:48.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}