Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via improper input validation in the Media component, triggered by visiting a crafted HTML page. The sandbox escape aspect is the critical differentiator here - Chrome's multi-process sandbox is its primary defense-in-depth layer, so bypassing it yields native OS-level code execution under the victim's account. No public exploit identified at time of analysis, and SSVC classifies exploitation as none with the attack non-automatable due to required user interaction.
Out-of-bounds read in Google Chrome's ANGLE graphics engine on Windows prior to version 152.0.7977.65 enables remote attackers to potentially execute arbitrary code outside the browser sandbox. Exploitation requires no authentication and only that a victim navigate to a crafted HTML page, yielding a CVSS 8.8 score with high impact across confidentiality, integrity, and availability. A vendor-released patch is available; no public exploit or confirmed active exploitation has been identified at time of analysis.
Remote code execution inside the Chrome sandbox affects Google Chrome prior to version 152.0.7977.65 through a use-after-free vulnerability in the Platform component, triggered when a user visits a specially crafted HTML page. An unauthenticated remote attacker can exploit this to execute arbitrary code within the browser sandbox, with full high-impact ratings on confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Use-after-free in the WebRTC component of Google Chrome before version 152.0.7977.65 enables remote code execution confined within the browser sandbox. Exploitation requires a victim to visit a specially crafted HTML page, placing UI:R as a meaningful friction point. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; SSVC also indicates no current exploitation activity. Despite a CVSS score of 8.8 and tags indicating RCE and memory corruption potential, the EPSS score of 0.33% at the 25th percentile reflects low observed exploitation probability relative to the broader vulnerability population.
Use-after-free in Google Chrome's Script engine allows remote code execution confined to the renderer sandbox on all desktop platforms running versions prior to 152.0.7977.65. Exploitation requires only that a user visit a crafted HTML page - no authentication or special configuration is needed - making the attack surface broad wherever Chrome remains unpatched. No public exploit has been identified at time of analysis and CISA has not added this to KEV, but the CVSS 8.8 rating and SSVC 'total' technical impact designation warrant prompt patching across managed fleets.
Type confusion in V8, Chrome's JavaScript engine, allows remote unauthenticated attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. All Google Chrome desktop versions prior to 152.0.7977.65 are affected across Windows, macOS, and Linux. No public exploit has been identified at time of analysis, and the EPSS score of 0.33% (25th percentile) reflects limited current exploitation probability; the vendor patch is available and should be applied promptly.
Type confusion in Chrome's V8 JavaScript engine (versions prior to 152.0.7977.65) enables remote code execution within the browser sandbox when a victim is socially engineered into visiting a crafted HTML page. The vulnerability arises from a CWE-843 type confusion flaw in V8, allowing an attacker to manipulate object type assumptions at runtime to achieve arbitrary code execution. Importantly, execution is constrained to the Chrome sandbox, which Chromium's own severity rating of 'Low' reflects; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in ANGLE (Chrome's graphics abstraction layer) prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox by serving a crafted HTML page. The vulnerability carries a CVSS score of 8.8 and targets Chrome's Almost Native Graphics Layer Engine, a critical rendering subsystem, making exploitation viable against any unpatched Chrome user who visits a malicious page. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is low at 0.30%, and SSVC assesses exploitation as 'none', suggesting real-world exploitation remains limited despite the high theoretical severity.
Heap buffer overflow in Google Chrome's Media component prior to version 152.0.7977.65 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects low attack complexity and no authentication requirement, but the unchanged scope (S:U) confirms execution is sandboxed - a full system compromise would require a separate sandbox escape not described in this CVE. No public exploit code has been identified and no CISA KEV listing exists; EPSS of 0.28% (20th percentile) indicates low observed exploitation activity, which is consistent with a patch-and-monitor posture rather than emergency response.
Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 152.0.7977.65) enables a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted HTML page to a victim user. The CVSS score of 8.8 reflects broad impact (C:H/I:H/A:H) with no authentication prerequisite, though code execution is initially sandboxed and scope is unchanged (S:U). No public exploit code has been identified at time of analysis; SSVC records exploitation status as none and EPSS probability is low at 0.28% (20th percentile), suggesting this has not yet been leveraged at scale despite the high-severity rating.
Heap-based buffer overflow in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome for Android prior to 152.0.7977.65 enables remote code execution outside the renderer sandbox via a crafted HTML page, meaning a successful attacker escapes Chrome's process isolation boundary with full C/I/A impact. Exploitation requires no authentication and only that a victim navigate to an attacker-controlled page, making drive-by compromise via phishing or malvertising a realistic delivery path. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the sandbox-escape capability significantly elevates real-world priority beyond what the raw CVSS score alone conveys.
Use-after-free in the Bluetooth component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox. Exploitation requires the attacker to socially engineer a victim into installing or triggering a crafted Chrome extension, after which the memory corruption in the Bluetooth subsystem is leveraged to escape Chrome's sandbox and achieve code execution at the OS level. No public exploit identified at time of analysis, and EPSS places this in the 20th percentile, suggesting limited active exploitation despite the high CVSS severity.
Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this at the 19th percentile (0.27%), suggesting limited immediate exploitation pressure despite the high CVSS score.
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the sandboxed renderer process in all Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker can trigger arbitrary code execution by luring a user to a crafted HTML page, with full high-impact across confidentiality, integrity, and availability within the sandbox boundary. No active exploitation is confirmed in CISA KEV, and EPSS sits at a low 0.27% (19th percentile), though vendor and SSVC both rate technical impact as total, warranting prompt patching as part of routine browser update cadence.
SMS authentication bypass in Weidmüller IE-SR-2TX-WL-4G industrial 4G routers allows a remote attacker to permanently disable the SMS password requirement by deliberately submitting five or more invalid passwords, after which the device executes all subsequent SMS management commands without any authentication. The root flaw is in the lockout logic: rather than locking out the attacker, the device disables its own password enforcement mechanism, rewarding brute-force attempts with unrestricted SMS command access. Impacts include limited configuration tampering, limited information leakage, and potentially full loss of device availability; no public exploit code or active exploitation is confirmed at time of analysis.
Remote code execution within the Chrome sandbox is achievable in Google Chrome prior to 152.0.7977.65 through a use-after-free vulnerability in V8, Chrome's JavaScript engine, triggered by a crafted HTML page. Any unauthenticated remote attacker who can induce a user to visit a malicious URL can exploit this flaw; however, execution is confined to the Chrome sandbox, meaning a chained sandbox escape would be required for full host-system compromise. No public exploit code or confirmed active exploitation is documented at time of analysis, and SSVC assessment lists exploitation as none, tempering urgency despite the high CVSS base score.
Use-after-free in the Animation component of Google Chrome prior to 152.0.7977.65 enables arbitrary code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw scores 8.8 CVSS HIGH, though Google's own internal Chromium severity rating is Low - a notable discrepancy that reflects the sandboxed containment of the impact. No public exploit code has been identified, SSVC indicates no active exploitation, and a vendor patch is confirmed available in Chrome 152.0.7977.65.
Use-after-free in V8, Google Chrome's JavaScript engine, prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code within the Chrome sandbox by luring a user to a crafted HTML page. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms low-complexity, unauthenticated network delivery requiring only a single user visit, with high confidentiality, integrity, and availability impact scoped to the renderer process. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with a non-automatable attack path, though technical impact is assessed as total within the sandbox.
Type confusion in Chrome's V8 JavaScript engine exposes memory contents within the browser sandbox to remote attackers who can socially engineer victims into visiting a crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected, confirmed by the Chrome Stable Channel advisory linked in references. Despite the vendor-assigned CVSS 8.8, Chromium's own security team rated this 'Low' severity - reflecting the sandboxed scope of the memory disclosure and the required social engineering step - and EPSS probability stands at only 0.26% (18th percentile) with no CISA KEV listing, consistent with SSVC 'Exploitation: none'.
Remote code execution outside the browser sandbox is potentially achievable in Google Chrome versions prior to 152.0.7977.65 through an integer overflow in the WebGL graphics subsystem triggered by visiting a crafted HTML page. The vulnerability affects all Chrome desktop platforms with a high-impact CVSS score of 8.8, though Chromium's internal severity rating of Medium and a low EPSS score of 0.25% (16th percentile) together suggest real-world exploitation remains uncommon at time of analysis. No public exploit code and no confirmed active exploitation have been identified; a vendor-released patch is available in stable channel update 152.0.7977.65.
Out-of-bounds write in Chrome's ANGLE graphics layer on Windows allows remote attackers to execute arbitrary code inside the browser's renderer sandbox by directing a user to a crafted HTML page. All Google Chrome releases on Windows prior to 152.0.7977.65 are affected. No public exploit code has been identified at time of analysis, and the EPSS probability of 0.25% (16th percentile) indicates limited current exploitation activity despite the high CVSS score of 8.8.
Memory corruption in Chrome's Tint graphics library on macOS allows remote attackers to potentially execute arbitrary code outside the browser sandbox by luring a user to a crafted HTML page. All Google Chrome versions prior to 152.0.7977.65 on Mac are affected. No public exploit identified at time of analysis; despite the high CVSS score of 8.8, EPSS sits at 0.25% (16th percentile), indicating low observed exploitation activity, though the explicit sandbox-escape outcome elevates real-world severity above the raw score suggests.
Use-after-free in Google Chrome's PDF rendering subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to execute arbitrary code confined within the Chrome sandbox by delivering a crafted PDF file. The vulnerability is triggered through normal user interaction - opening a malicious PDF - requiring no privileges or authentication. While CVSS scores this 8.8 (High), Chrome's own severity rating is 'Low', reflecting the critical nuance that code execution is sandboxed and does not directly achieve host-level compromise. No public exploit exists and SSVC confirms no known exploitation at time of analysis.
Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the Chrome sandbox by distributing a crafted extension through social engineering. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact within the process scope, though exploitation is constrained by the mandatory user interaction required to install the malicious extension. No public exploit code exists and SSVC rates active exploitation as none at time of analysis, placing real-world urgency below what the raw score implies.
Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) allows a remote attacker to execute arbitrary code within the browser's renderer sandbox. Exploitation requires the victim to be socially engineered into installing and activating a crafted Chrome extension, making this a user-interaction-dependent attack rather than a passive drive-by. No active exploitation has been confirmed via CISA KEV, and SSVC classifies the exploitation status as none; however, SSVC also rates technical impact as total, meaning successful exploitation fully compromises confidentiality, integrity, and availability within the sandbox boundary.
Privilege escalation via account takeover in InfusedWoo Pro (all versions up to and including 5.1.17) allows any authenticated subscriber-level user to hijack arbitrary WordPress accounts, including site administrators, by exploiting a missing capability check in the `ajax_iwar_preview_email()` AJAX function. The function incorrectly relies on `is_admin()` - a WordPress conditional that tests for admin-area request context rather than the requesting user's role - permitting low-privilege users to generate valid password reset links for any email address on the site. No public exploit has been identified at time of analysis, but the trivial exploitation path (subscriber-level access, no user interaction, no special configuration) makes this a high-priority remediation target for any site running the affected plugin.
Unauthenticated record takeover in the TYPO3 'Club Directory' extension allows any visitor to overwrite or force-publish arbitrary club records by supplying a known record UID in requests to the frontend edit, update, and activate actions. The extension resolves records directly from user-controlled input without performing any ownership or authorization check, making this a textbook CWE-862 (Missing Authorization) / IDOR vulnerability. No public exploit has been identified at time of analysis, but exploitation is trivially simple given the network-accessible attack surface, absence of authentication, and sequential nature of TYPO3 record UIDs.
Broken access control in the TYPO3 Industry Directory extension allows unauthenticated network visitors to overwrite company records they do not own. The frontend edit form is gated by a template-level visibility flag, but the server-side write controller performs no corresponding ownership verification, making the UI restriction trivially bypassable via direct HTTP submission using any publicly visible record identifier. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication requirements and low attack complexity make independent exploitation straightforward against any exposed deployment.
Missing server-side ownership verification in the TYPO3 Forum extension allows any unauthenticated visitor to overwrite the content of any forum topic. Because topic identifiers are enumerable from the public forum listing, an attacker needs no credentials, special access, or non-default configuration to target arbitrary topics. The CVSS 4.0 score of 8.8 reflects high integrity impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Type confusion in Google Chrome's DevTools component prior to version 152.0.7977.65 enables remote code execution within the browser sandbox when a victim is social-engineered into visiting a crafted HTML page. The flaw affects all Chrome platforms where DevTools is accessible and results in high confidentiality, integrity, and availability impact to the sandboxed process. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no observed active exploitation, though the technical impact rating is classified as total.
Use-after-free in Google Chrome's Accessibility component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code outside the browser's renderer sandbox through social engineering. Exploitation requires user interaction with a malicious webpage or crafted UI element, making phishing or malvertising the likely delivery mechanism. A vendor patch is available in stable channel version 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.23% (14th percentile), suggesting opportunistic exploitation is not currently observed.
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library's pathsec sandbox boundary. The LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors accept caller-supplied corpus root paths without enforcing the intended data-root restriction, enabling CWE-73 (External Control of File Name or Path) exploitation wherever applications forward user-controlled input to these constructors. No public exploit or CISA KEV listing has been identified at time of analysis; real-world severity is highly dependent on whether the affected constructors are reachable from an untrusted network path in the deploying application.
Improper state validation in Google Chrome's HTML parser (all versions prior to 152.0.7977.65) enables remote code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw (CWE-754) requires no authentication and minimal user interaction - simply loading malicious HTML is sufficient - but execution is constrained to the renderer sandbox (scope unchanged, S:U). Despite an 8.8 CVSS score, EPSS sits at 0.21% (12th percentile) and CISA SSVC confirms no current exploitation, with no public exploit or KEV listing identified at time of analysis.
Remote code execution in Google Chrome prior to 152.0.7977.65 stems from improper input validation in the browser's Media component, enabling a remote attacker to potentially execute arbitrary code outside the sandbox when a user visits a crafted HTML page. The vulnerability carries a CVSS base score of 8.8, affects all desktop Chrome builds below 152.0.7977.65 across Windows, macOS, and Linux, and is classified under CWE-20. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none despite a total technical impact rating.
Insufficient control flow management in Google Chrome's DevTools component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the browser sandbox by tricking a user into loading a crafted HTML page via social engineering. The flaw is rooted in CWE-691 and permits attacker-controlled code paths within the DevTools subsystem, with execution constrained to within the Chrome sandbox (S:U). No public exploit code has been identified at time of analysis, and both EPSS (0.21%, 12th percentile) and SSVC (exploitation: none, automatable: no) indicate low current exploitation probability despite the high CVSS 8.8 base score.
Remote code execution outside Chrome's renderer sandbox is possible on macOS in all Chrome builds prior to 152.0.7977.65, triggered by improper input validation in the ANGLE graphics engine. An unauthenticated remote attacker (confirmed by PR:N in the provided CVSS vector) can exploit this by directing a macOS user to a specially crafted HTML page, which causes ANGLE to process malformed graphics input and execute attacker-controlled code outside the sandbox boundary. No CISA KEV listing or public exploit code exists at time of analysis, and an EPSS of 0.21% (12th percentile) indicates low current exploitation probability, though the zero-privilege-required, low-complexity attack path warrants prompt patching.
Improper privilege management in Chrome's Regional Capabilities component allows remote attackers to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. Despite a CVSS base score of 8.8, EPSS exploitation probability is very low at 0.21% (11th percentile), no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Arbitrary root file write in SonicWall NetExtender Linux client (versions 10.3.5 and earlier) is achievable by an unauthenticated remote attacker who delivers a malicious OPSWAT tarball containing path-traversal sequences, exploiting CWE-29 to escape the intended extraction directory and overwrite system files as root. Exploitation requires user interaction (CVSS UI:R) to trigger tarball processing, and no public exploit code or CISA KEV listing has been identified at time of analysis. EPSS stands at 0.20% (9th percentile), consistent with the SSVC assessment of exploitation status 'none' and automatable 'no', though the technical impact is rated total.
Unverified code download in NVIDIA NemoClaw installation scripts for Linux (versions 0.0.0 through 0.0.21) allows a network-positioned attacker to substitute malicious payloads during installation, enabling code execution, privilege escalation, information disclosure, and data tampering on the target host. The root cause is CWE-494: the installation pipeline fetches remote code without cryptographic integrity verification, leaving the download channel open to man-in-the-middle substitution or upstream server compromise. No public exploit has been identified at time of analysis; EPSS sits at 0.20% (9th percentile) and SSVC confirms Exploitation: none, placing this firmly in the theoretical high-severity category rather than an actively exploited threat.
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incomplete allowlist enforcement. The `parseAndValidateClientRedirect` function at `internal/service/auth/auth.go:448` compares only scheme and host of the client-supplied `redirect_uri` against the admin allowlist, ignoring path, query, and fragment in violation of RFC 6749 §3.1.2. An attacker who induces a victim to follow a crafted OAuth login link can redirect the post-authentication browser to any path on an allowlisted host, exposing the one-time exchange code via Referer headers or analytics, then redeem it at `POST /api/auth/exchange` for the victim's access and refresh tokens. No public exploit or CISA KEV listing is confirmed at time of analysis; a detailed public advisory (GHSA-p64j-f4x9-wq66) with source code evidence lowers the bar for independent exploitation. Fixed in 4.7.3.
Integer overflow (CWE-190) in Chromium's file-processing code exposes all desktop Google Chrome versions prior to 152.0.7977.65 to in-sandbox memory disclosure when a user opens a specially crafted file, requiring no authentication (PR:N) but requiring user interaction (UI:R). A critical data conflict across sources warrants attention: the NVD CVSS score is 8.8 with C:H/I:H/A:H, yet Google's Chromium team rates this Low severity, and the EPSS is 0.16% (5th percentile) with SSVC Exploitation:none - collectively suggesting the attack impact is bounded to memory readable within the sandboxed renderer, without sandbox escape. No public exploit identified at time of analysis.
Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arbitrary PHP files to server-accessible paths and execute OS commands. The vulnerability exploits an incomplete command denylist: while Adminer restricts the ATTACH statement to limit direct file access, the VACUUM INTO command - which writes the current SQLite database to an arbitrary file path - was not blocked. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploit mechanism is straightforward for any authenticated user with SQLite access.
Content Security Policy enforcement failure in Safari's AudioWorklet contexts allows remote attackers to bypass CSP restrictions when a user processes maliciously crafted web content. Affected platforms include Safari before 26.5, iOS and iPadOS before 18.7.9/26.5, and macOS Tahoe before 26.5. Apple has released patches across all affected platforms; no public exploit or CISA KEV listing is identified at time of analysis.
Stored cross-site scripting in Ekushey Project Manager CRM allows a malicious or compromised administrator to inject arbitrary HTML and script into the application's login page, which then executes silently in the browser of every unauthenticated visitor who loads that page - including users about to submit their credentials. The vulnerability persists until the system name setting is corrected, and the payload runs within the CRM's own origin, co-located with the credential input fields. A public proof-of-concept exists on GitHub (LindHunt/CVE-2026-26211); no CISA KEV listing or vendor patch has been identified at time of analysis.
Unauthenticated denial of service in Faktory prior to 1.10.0 allows any network-reachable attacker to crash the entire job server process by sending a single bare command verb without a payload. Because Go's runtime panics on out-of-bounds slice operations and no recover() wrapper exists in the command-dispatch path, the panic terminates the whole process rather than just the offending connection, instantly dropping all workers, clients, and in-flight jobs. No public exploit code has been identified at time of analysis, but the attack vector is trivially constructable from the description alone and can be repeated indefinitely to sustain the outage.
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC signature is bound only to the user's database ID, not the password hash. An attacker who obtains an intercepted or cached reset link can authenticate as the victim up to 2 additional times within a 1-hour window even after the victim has changed their password, obtaining a fully authenticated session. A publicly documented proof-of-concept is included in the GHSA advisory; no active exploitation via CISA KEV has been confirmed.
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.
Server-Side Template Injection in the Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 permits authenticated remote code execution on the host running PHP. Any account holding only api.access and api.pages.write permissions - typical content-editor roles - can embed a Twig payload in the header.form.process.email.body Email action parameter, publish the page, and trigger arbitrary OS command execution by submitting the associated form. No active exploitation has been confirmed by CISA KEV and no public exploit has been identified at time of analysis, but the low privilege bar and well-understood SSTI attack class make this a high-priority remediation target.
Unauthenticated file disclosure in GROWI (all versions before 8.0.2) exposes private page attachments to any caller who possesses a valid attachment identifier. The route handler retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts conditionally gates the page-viewer permission check on the presence of an authenticated session, meaning HTTP requests without a session entirely bypass authorization and receive the requested file. Both /attachment/:id and /download/:id endpoints are affected, and identifiers are obtainable by former users whose access was revoked or from any prior exposure of the attachment URL. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet and edit_other_timesheet permissions to create timesheet records on behalf of team members without possessing the required create_other_timesheet permission. The missing server-side authorization check (CWE-862) in the QuickEntry submission path enables unauthorized data manipulation across organizational user boundaries within the time-tracking system. No public exploit code or active exploitation has been identified; a vendor-released patch is available in Kimai 2.62.0.