Missing authorization controls in Microsoft Edge (Chromium-based) allow a local attacker without any system privileges to bypass authorization and perform tampering actions against the browser. The flaw (CWE-862) results in high confidentiality impact per the CVSS vector, though the description characterizes the effect as tampering - a discrepancy addressed in confidence notes below. No public exploit code has been identified and Microsoft has released an official patch through the MSRC advisory portal.
Local information disclosure in the Telephony component across 42 MediaTek chipsets enables any unprivileged application on the device to extract sensitive telephony data without elevated permissions. The root cause is a missing Android permission check (CWE-926: Improper Export of Android Application Components), allowing improperly exported Telephony interfaces to be queried by any installed app. No active exploitation is confirmed - EPSS sits at 0.15% (5th percentile) and the vulnerability is absent from CISA KEV - but the breadth of affected chipsets spanning budget through flagship tiers gives this issue significant deployment reach. Patch ALPS11086431 is available per MediaTek's August 2026 security bulletin.
Privilege escalation to NT AUTHORITY\SYSTEM is achievable by any local, unprivileged user via Wellbia XIGNCODE3's kernel driver xhunter2.sys version 2026.6.1.192, due to missing access control on the IRP_MJ_WRITE command interface. Beyond SYSTEM-level execution, the flaw enables extraction of credentials from PPL-protected lsass.exe and termination of PPL-protected security processes such as EDR/AV agents, effectively disabling host defenses. No active exploitation is confirmed by CISA KEV, though the primary reference is a researcher blog post (blacksnufkin's 'Hunting the Hunter II') that strongly suggests PoC-grade research material exists.
Code injection (CWE-94) in Microsoft Edge (Chromium-based) enables network-based spoofing attacks against users who interact with attacker-controlled content. An unauthorized remote attacker can exploit improper code generation controls to inject and execute code within the browser's execution context, crossing security scope boundaries (S:C) to spoof content or interfaces presented to the victim. No public exploit has been identified at time of analysis (E:U temporal metric), and Microsoft has released an official fix via the MSRC update guide.
Server-Side Request Forgery (SSRF) in Microsoft Edge (Chromium-based) enables a remote, unauthenticated attacker to perform network-level spoofing by manipulating the browser into issuing crafted requests to unintended destinations. All versions of the Chromium-based Edge are affected per the CPE wildcard match, and the CVSS scope change (S:C) confirms the impact extends beyond the browser itself to backend or internal systems reachable from the victim host. No public exploit exists (E:U) and an official vendor patch has been released (RL:O), keeping real-world exploitation probability low at this time.
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Stored XSS in osTicket 1.18.3 allows an unauthenticated external attacker to inject arbitrary JavaScript through the ticket thread entry title field, with the payload executing in the staff portal whenever a support agent views the affected thread. Source code references confirm that at least four PHP templates echo `$entry->title` without calling the existing `Format::htmlchars()` sanitization helper, a straightforward omission patched in commit 1e39bf1. A public researcher disclosure (fr3akhacks/cve-disclosures) confirms proof-of-concept details are available, though SSVC rates exploitation status as none and no CISA KEV listing has been issued, indicating no confirmed active exploitation at time of analysis.
Secure boot heap buffer overflow in MediaTek chipsets MT2737, MT6880, MT6890, and MT6990 enables local privilege escalation by an attacker with physical device access. The vulnerability exists at the pre-OS firmware layer, where a write beyond allocated heap boundaries can corrupt boot verification logic and permit execution of unsigned or attacker-controlled code. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, and the EPSS score of 0.16% (6th percentile) is consistent with the hard physical access prerequisite sharply limiting opportunistic exploitation.
Plaintext AWS credential extraction in the DuckDB AWS Extension allows any SQL-privileged database user to bypass the database-wide allow_unredacted_secrets=false security policy by invoking load_aws_credentials(redact_secret=false), returning the full AWS credential chain - access_key_id, secret_access_key, session_token, and region - in cleartext. The bypass is particularly impactful in managed cloud environments where pg_duckdb is preloaded and an ambient AWS credential chain (IMDSv2, IRSA, ECS task role, EC2 instance profile) is automatically reachable from the database host, effectively converting low-privilege SQL access into valid cloud API credentials. No public exploit code or CISA KEV listing has been identified; an upstream fix is confirmed via GitHub commit 7d04119 (PR #156), though a tagged patched release version is not confirmed in available data.
Out-of-bounds write in the MediaTek display driver allows a local attacker who has already obtained System-level privilege to further escalate privileges on affected Android devices. The vulnerability stems from a missing bounds check (CWE-787) in display subsystem code across at least ten MediaTek chipsets, including MT8910, MT8188, MT8799, and MT6991 among others. No public exploit or active exploitation (CISA KEV) is identified at time of analysis; EPSS score of 0.14% (4th percentile) and SSVC exploitation rating of 'none' both confirm this remains an undemonstrated threat as of the August 2026 advisory.
Local privilege escalation in MediaTek's display subsystem affects 17 chipset variants used in Android devices, allowing an attacker who has already obtained System-level privilege to exploit a missing bounds check (CWE-787) and write out of bounds in display memory, achieving high confidentiality and integrity impact. The CVSS vector (PR:H/AV:L) confirms this is not an initial-access vector - it is a post-compromise escalation step requiring pre-existing System privilege. No public exploit has been identified, EPSS stands at 0.14% (4th percentile), and the vulnerability is not listed in CISA KEV, consistent with SSVC's exploitation status of 'none.'
Local privilege escalation in the MediaTek display driver allows an attacker who already holds System-level privileges to further escalate via a use-after-free memory corruption condition, potentially achieving kernel-level access. Seventeen MediaTek SoC models used across Android devices are affected, disclosed in MediaTek's August 2026 security bulletin with Patch ID ALPS11019722. No public exploit code exists and EPSS at 0.14% (4th percentile) confirms negligible current exploitation probability; this vulnerability is not in the CISA KEV catalog.
Privilege escalation in MediaTek's trusted_mem subsystem affects nine specific chipset models (MT8365, MT8186, MT8188, MT8195, MT8370, MT8371, MT8390, MT8391, MT8395) through a write-what-where condition caused by improper input validation. An attacker who has already obtained System-level privilege can leverage this flaw to escalate further, potentially compromising the trusted memory environment. No public exploit code has been identified and EPSS places exploitation probability at 0.14% (4th percentile), indicating this is currently a low-exploitation-pressure issue despite its local privilege escalation potential.
Local privilege escalation in MediaTek's apusys AI Processing Unit subsystem on MT8196 and MT8366 chipsets allows an attacker already holding System-level privileges to further escalate by exploiting a confused deputy flaw - likely realized through an out-of-bounds write (CWE-787) - achieving high confidentiality and integrity impact on the vulnerable system. Disclosed by MediaTek in their August 2026 Product Security Bulletin, a vendor patch is available under Patch ID AUTO00833804. No public exploit has been identified at time of analysis, and an EPSS of 0.14% at the 4th percentile reflects negligible probability of widespread exploitation.
Privilege escalation in MediaTek's AI Processing Unit Subsystem (apusys) driver allows a local attacker already holding System-level privileges on devices equipped with MT8366, MT8196, or MT8195 chipsets to escalate further, achieving high-impact access to confidential data and system integrity. The root cause is a missing bounds check (CWE-749) in an exposed driver function, patched under MediaTek ID AUTO00837766 in the August 2026 security bulletin. No public exploit code has been identified, and the EPSS score of 0.14% (4th percentile) confirms very low current exploitation probability.
Privilege escalation in MediaTek's geniezone component affects ten specific chipset models (MT8792, MT8883, MT8873, MT8893, MT8768, MT8796, MT8799, MT6991, MT8791T, MT8910) due to a missing permission check classified under CWE-1287. An attacker who has already obtained System-level privileges on an affected device can exploit this flaw to escalate further - potentially reaching kernel or TEE-adjacent privilege boundaries - without requiring any user interaction. No public exploit code exists and no active exploitation has been confirmed (EPSS 0.13%, 3rd percentile), positioning this as a chaining vulnerability relevant to targeted attacks rather than opportunistic mass exploitation.
Out-of-bounds write in MediaTek's HFRP component on the MT6993 chipset enables local privilege escalation beyond System-level access, confirmed via MediaTek's August 2026 security bulletin. The flaw stems from a missing bounds check (CWE-787), requiring an attacker who has already achieved System privilege to trigger further escalation - a post-compromise lateral movement primitive rather than an initial access vector. No public exploit code and no KEV listing have been identified; EPSS sits at the 3rd percentile, consistent with SSVC's 'exploitation: none' finding.
Out-of-bounds write in MediaTek's GeniZone Trusted Execution Environment (TEE) component enables local privilege escalation across 14 distinct MediaTek chipsets. An attacker who has already achieved System-level privilege on an affected Android device can exploit a missing bounds check to write outside intended memory boundaries within the secure enclave, gaining confidentiality and integrity access beyond what System privilege normally permits. No public exploit has been identified at time of analysis, and the EPSS score of 0.13% (3rd percentile) reflects low observed exploitation probability; however, the pre-existing System privilege prerequisite substantially narrows the realistic attack surface.
Out-of-bounds write in MediaTek's GenieZone hypervisor component enables local privilege escalation beyond System-level access on a wide range of MediaTek mobile chipsets. Exploitation is constrained to attackers who have already obtained System privileges, making this a secondary step in a multi-stage attack chain rather than an initial foothold technique. No public exploit code exists and EPSS of 0.13% (3rd percentile) confirms negligible real-world exploitation activity; no CISA KEV listing at time of analysis.
Local privilege escalation in the MediaTek display subsystem affects 17 distinct chipsets including MT6991, MT8768, MT8678, and MT8799, among others. An attacker who has already obtained System-level privilege can exploit a race condition (CWE-367) in the display driver to achieve further privilege escalation, resulting in high confidentiality and integrity impact on the device. No public exploit has been identified at time of analysis, and the EPSS score of 0.11% (2nd percentile) reflects minimal observed exploitation probability; MediaTek has released patch ALPS11019183 via its August 2026 Product Security Bulletin.
Missing authorization in Apache NiFi's Parameter Context update REST API allows an authenticated user with write access to a Parameter Context to alter parameter values that affect referencing components the user is not authorized to access. In deployments where parameter values contain executable scripting content, this privilege boundary bypass can trigger code execution during automatic component validation on stopped processors without the attacker needing to start those components. No public exploit has been identified; exploitation is bounded to deployments using component-level authorization policies and is confirmed fixed in Apache NiFi 2.11.0 per NIFI-16148.
OS command injection in Sangfor Fort (Operation and Maintenance Security Management System) up to version 3.0.13 allows remote, unauthenticated attackers to execute arbitrary OS commands via a crafted request to the login endpoint `/fort/portal_login`. The flaw resides in the `DpLoginController` Java class and requires no authentication, making it trivially reachable across any network path to the appliance. A public proof-of-concept exploit exists; the vendor did not respond to coordinated disclosure, and no patch has been released at time of analysis.
Provisioning data interception in TP-Link Omada's cloud-based device adoption workflow allows a low-privileged network attacker to receive configuration secrets intended for a legitimate device. The vulnerability is a classic race condition (CWE-362): an attacker who can interact with the adoption workflow before a legitimate device completes registration can position themselves to receive the provisioning payload. Affected products span the full Omada ecosystem - controllers, access points, switches, and gateways. No public exploit or CISA KEV listing exists at time of analysis, but the confidentiality impact is rated High by the vendor's own CVSS 4.0 assessment.
Credential recovery is possible on TP-Link Omada network devices - including Gateways, Switches, Access Points, and OLTs - because site credentials are hashed with a legacy algorithm that lacks adequate protection against offline cracking (CWE-759). An attacker who has already obtained privileged access to the device or management environment and extracted stored credential hashes can recover plaintext credentials, enabling unauthorized access to affected Omada infrastructure. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though a vendor patch is available.
Local denial of service in MediaTek's ccci (Cross Core Communication Interface) kernel driver affects MT6986, MT6988, and MT6813 chipsets through a missing bounds check that enables an out-of-bounds memory access. A local user-privileged attacker - such as a malicious Android application - can crash the kernel, causing device unavailability without requiring user interaction. No public exploit code exists and EPSS probability is 0.16% (6th percentile); SSVC exploitation status is confirmed 'none,' aligning all risk signals toward low immediate threat.
Heap-based out-of-bounds write in GIMP's PAA (Paint Shop Pro Array) file format plugin allows a remote attacker to potentially execute arbitrary code on a victim's system by tricking the user into opening a specially crafted PAA image. The flaw resides in the decode_lzss() decompression function, which writes data beyond the bounds of the allocated heap buffer, enabling heap metadata corruption. No public exploit or CISA KEV listing exists at time of analysis, but the RCE-tagged impact and buffer-write primitive make this a higher-severity risk than the CVSS 5.5 score suggests; the CVSS impact metrics reflect only availability (A:H) while the description and tags indicate arbitrary code execution potential - a notable discrepancy to investigate.
Heap buffer overflow in the MediaTek Audio HAL enables a local attacker with user-level privileges to crash the audio subsystem, resulting in a denial of service condition on affected devices. Seven MediaTek chipsets across mobile and automotive platforms are affected, with MediaTek releasing two separate patch IDs addressing the flaw in its August 2026 security bulletin. EPSS at 0.15% (5th percentile), no KEV listing, and a CISA SSVC exploitation status of 'none' collectively indicate negligible real-world exploitation risk at time of analysis; no public exploit code has been identified.
Heap buffer overflow in MediaTek's Audio Hardware Abstraction Layer (HAL) across six chipset families enables local denial of service on affected mobile and automotive platforms. A local user-level process can trigger an out-of-bounds write in the Audio HAL, crashing the audio subsystem with no user interaction required. No public exploit exists and EPSS sits at 0.15% (5th percentile), consistent with SSVC's 'none' exploitation status and the strictly local, availability-only impact profile.
Stack-based buffer overflow in GIMP's file-png plugin on Red Hat Enterprise Linux 6 through 9 causes the application to crash when a user opens a crafted Animated PNG (APNG) image containing an oversized tRNS chunk, resulting in a Denial of Service limited to the affected user session. Exploitation requires local file access and active user interaction - a remote attacker would rely on social engineering (phishing, malicious download) to deliver the file. No active exploitation has been confirmed by CISA KEV, no public exploit code is identified at time of analysis, and EPSS data is unavailable in source intelligence.
Out-of-bounds write in the 'med' media processing component of specific MediaTek SoC chipsets (MT6890, MT6988, MT6990, MT2735, MT2737) enables a local attacker with standard user privileges to crash the device, causing a denial of service. The root cause is an incorrect bounds check (CWE-787) that allows a write past allocated buffer boundaries, corrupting memory. No public exploit is identified at time of analysis, and EPSS at 0.15% (4th percentile) combined with SSVC exploitation status of 'none' signals very low real-world exploitation probability.
Out-of-bounds read in SSSD's NSS responder allows a local user with standard privileges to crash the SSSD process by sending a crafted GETHOSTBYADDR request, causing system-wide denial of authentication and name resolution services. The vulnerable function `sss_nss_protocol_parse_addr()` fails to validate the `addrlen` field against the actual remaining packet body size, enabling heap over-read and process termination. No public exploit code or active exploitation has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Out-of-bounds read in the MediaTek Wi-Fi driver component on MT6988, MT6990, and MT6890 chipsets permits local information disclosure against devices where an attacker has already obtained System-level privilege. The missing bounds check in the Wi-Fi stack allows reading memory beyond the intended buffer boundary, exposing potentially sensitive kernel or driver memory contents. No public exploit exists and EPSS at 0.13% (3rd percentile) reflects the significant privilege prerequisite that constrains real-world exploitation; CISA KEV does not list this vulnerability.
Local denial of service in MediaTek's Audio Hardware Abstraction Layer (HAL) allows a user-privileged process on affected devices to trigger a race condition that renders the system unresponsive. Affected chipsets span two patch families - MT6880/MT6890/MT6988/MT6990 and MT2735/MT2737 - covering a broad range of MediaTek-based mobile and automotive platforms. No active exploitation has been confirmed (not in CISA KEV), and EPSS stands at 0.12% (2nd percentile), reflecting very low real-world exploitation probability at time of analysis.
Origin validation error in Microsoft Edge (Chromium-based) enables a remote unauthenticated attacker to perform cross-origin spoofing attacks, achieving high confidentiality impact and limited integrity impact against victims who interact with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) with temporal indicators E:U/RL:O/RC:C indicates an officially patched vulnerability with no publicly proven exploit code and confirmed vendor reporting. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Microsoft Edge (Chromium-based) is affected by a Time-of-Check Time-of-Use (TOCTOU) race condition that allows a remote, unauthenticated attacker to disclose sensitive information over the network, contingent on user interaction. The flaw exploits the timing gap between a security check and subsequent resource use within the Chromium-based browser engine, potentially exposing cross-origin data or internal browser state. No active exploitation has been confirmed by CISA KEV, and the temporal CVSS metrics (E:U) confirm no proven exploit code exists at time of analysis; a vendor patch is available via MSRC.
Origin validation error in Microsoft Edge (Chromium-based) allows network-positioned unauthenticated attackers to perform cross-origin tampering when a victim user interacts with malicious web content. The flaw (CWE-346) undermines the browser's origin enforcement logic, enabling integrity and confidentiality compromise at low severity per CVSS 5.4. Tagged as an Authentication Bypass vector, suggesting edge cases where origin-gated auth flows in Edge may be bypassed. No active exploitation confirmed (not in CISA KEV), no public POC identified, and a vendor patch is available via MSRC.
Spoofing via origin validation failure in Microsoft Edge (Chromium-based) allows a network-adjacent unauthenticated attacker to deceive users or systems about the true origin of web content or requests. All Chromium-based Edge versions are affected per the wildcard CPE, and a vendor-released patch is confirmed via the Microsoft Security Response Center. No public exploit code exists and active exploitation is not confirmed - the CVSS temporal metric E:U (exploit unproven) and absence of CISA KEV listing reinforce a currently theoretical risk level.
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
Authentication bypass in 389 Directory Server (Red Hat Directory Server 11-13) allows a network-connected user holding valid credentials for an administratively locked account to retain an authenticated LDAP session, defeating account-lock as an access-revocation control. The SASL PLAIN bind handler installs connection-level authenticated state before executing the account-lock check; when the lock check fails, only the error is returned to the client while the internal authenticated state on that connection persists unrevertd. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the real-world impact is highest in incident-response and employee-offboarding scenarios that rely on directory lock as the primary revocation mechanism.
Broken access control in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.15) permits authenticated low-privileged users to invoke restricted plugin functions without proper authorization. The flaw, rooted in CWE-862 (Missing Authorization), allows a subscriber- or contributor-level WordPress account to perform actions that should be restricted to higher-privileged roles, resulting in low-impact integrity and availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
ReDoS in Hono's built-in CORS middleware allows unauthenticated remote attackers to stall the JavaScript event loop via crafted OPTIONS preflight requests, degrading or denying service to all concurrent users. The affected npm package `hono` versions below 4.12.34 using the default `cors()` configuration are vulnerable - no authentication, special origin, or user interaction is required. No CISA KEV listing and no dedicated public exploit tool have been identified at time of analysis, but the attack is trivially reproducible given the fully public advisory and commit diff.
CPU and memory exhaustion in Bouncy Castle Java's BCFKS keystore loader exposes applications to pre-integrity-verification denial of service when processing a crafted keystore file. Any of the three affected library variants - bc-java (before 1.85), bc-lts-java (before 2.73.12), and BC-FJA (before 1.0.2.7, 2.0.2, or 2.1.3 depending on series) - will blindly honour attacker-supplied PBKDF2 iteration counts or scrypt cost parameters read from an untrusted file before the keystore MAC is verified, allowing an adversary to trigger arbitrary CPU or memory consumption at load time. No public exploit code has been identified and the vulnerability is absent from CISA KEV; urgency is rated Amber by the upstream reporter.
Heap-based buffer overflow in the GL.iNet APPS-NAS module's nas-web.get_file_list function allows authenticated remote attackers to crash the NAS service on eleven router models running firmware up to 20260707, resulting in a denial of service. The vendor confirmed the vulnerability following responsible disclosure, and the GitHub advisory explicitly identifies the impact as authenticated denial of service with no confidentiality or integrity compromise. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Unbounded PKCS#12 KDF iteration counts in Bouncy Castle for Java allow remote, unauthenticated attackers to cause denial of service by supplying a crafted PKCS#12 file with an arbitrarily large iteration count in MAC or bag-decryption KDF parameters. Any Java application that processes PKCS#12 keystores using bc-java before 1.85, bc-lts-java before 2.73.12, or bc-fja (FIPS) before 1.0.2.7/2.0.2/2.1.3 is affected. No public exploit is identified at time of analysis, but the attack surface is broad given how widely PKCS#12 files are accepted across Java enterprise stacks.
Denial-of-service via unbounded KDF cost in Bouncy Castle for Java's PKCS#8 / PBES2 decryptors allows remote attackers to exhaust CPU or memory by supplying crafted encrypted key material with extreme KDF parameters. The vulnerability affects bc-java before 1.85, bc-lts-java before 2.73.12, and BC-FJA (bcpkix-fips) across all supported 1.0.X, 2.0.X, and 2.1.X series. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Draft post creation in Camaleon CMS through 2.9.2 allows any authenticated low-privileged user to create and overwrite draft posts by bypassing role and permission checks on the admin drafts endpoint. The DraftsController's overridden create and update actions omitted the authorize! calls enforced by the parent PostsController, and used global unscoped post lookups that ignore post type and user ownership, enabling cross-post-type draft manipulation and ownership attribution changes on existing drafts. No CISA KEV listing or public exploit code has been identified; the CVSS 4.0 score of 5.3 (PR:L, VI:L) reflects limited integrity impact with no confidentiality or availability consequence.
Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary HTTP GET requests to internal network targets, including cloud metadata endpoints such as 169.254.169.254, by submitting crafted URLs during short URL creation when title auto-resolution is enabled. The server follows HTTP redirects from attacker-controlled public hosts to otherwise-inaccessible internal addresses, then returns fetched content via the HTML title element in the API response, enabling exfiltration of internal service data. No active exploitation is confirmed in CISA KEV, but a public proof-of-concept advisory repository exists, and the attack requires only a valid API key with title auto-resolution active.
Improper authorization in GL.iNet's eSIM LPA API allows adjacent-network unauthenticated attackers to bypass nginx proxy controls on six cellular router models, gaining unauthorized access to eSIM management functions. Affected devices include the E5800, E750, X2000, X3000, XE3000, and XE300 running firmware up to 20260707. The GitHub advisory title explicitly frames this as 'Unauthenticated access to eSIM LPA API via nginx proxy bypass,' indicating the authorization enforcement failure lies in how nginx proxies requests to the /sdk/v1 endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing granular access control in HCL iControl v3.2.0 exposes administrator-level functionality to unauthorized users over the network. Regular-privilege users can bypass authorization checks to view or access admin-scoped features, resulting in a limited confidentiality impact. No public exploit code exists and no CISA KEV listing is present; however, the 'Authentication Bypass' tag and the network-accessible vector mean the exposure is reachable without physical proximity, though the high attack complexity (AC:H) constrains opportunistic exploitation.
Insecure Direct Object Reference in Admidio before 5.0.11 allows authenticated low-privilege users to hijack list configurations managed by administrators or other users by manipulating the list_uuid parameter in the save_temporary mode of mylist_function.php. Any user with a valid session can enumerate global list UUIDs and submit crafted requests to overwrite admin-curated global lists or private lists belonging to other users, effectively transferring ownership and demoting shared resources to personal configurations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 5.0.11.