TubeBuddy for YouTube Chrome extension versions up to 5.8.4 by BEN Group exposes users to authentication token overwrite via an insufficiently verified redirect URL handler. The `TBGlobal.GetToken` function in `tubebuddymaster1.js` fails to validate the authenticity of data supplied through the `t`, `c`, and `r` URL parameters (CWE-345), enabling a remote attacker to overwrite the victim's stored authentication token. A public proof-of-concept exploit exists; no KEV listing has been confirmed.
Server-side request forgery in sdcb chats up to version 1.12.0 allows authenticated remote users to cause the application server to issue arbitrary HTTP requests to attacker-controlled targets via the fetch-tools endpoint in McpController. The vulnerable code path is in src/BE/web/Controllers/Users/Mcps/McpController.cs and accepts user-supplied URLs without adequate validation. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch.
Null pointer dereference in FLVMeta up to 1.2.2 causes a process crash when parsing a malformed AMF object from a crafted FLV file, resulting in denial of service. The flaw resides in `amf_object_get` (and the parallel `amf_object_set`) in `src/amf.c`, where a chained double dereference `node->next->next` executes without first confirming `node->next` is non-NULL. A public SEGV proof-of-concept exists, though the project maintainer disputes the security relevance, stating no exploitation path beyond a crash has been demonstrated. No CISA KEV listing; no public exploit identified at time of analysis beyond the crash reproducer.
Tenant isolation is broken in dibo-software diboot 3.8.0, where the `/api/iam/tenant/resource` endpoint fails to enforce access controls on the user-supplied `tenantId` argument. A low-privileged authenticated user can substitute an arbitrary tenant identifier to access or modify resource assignments belonging to other tenants - a classic authorization bypass in a multi-tenant IAM context. A public proof-of-concept exploit has been disclosed; the vendor did not respond to responsible disclosure, leaving no official patch available.
Authorization bypass in dibo-software diboot 3.8.0 exposes the AI Session Endpoint (/api/ai-session/) to insecure direct object reference (IDOR) exploitation, allowing low-privilege authenticated users to access or manipulate AI session resources belonging to other users. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to verify that the requesting user is authorized to act on the referenced session identifier. A public exploit has been disclosed, and the vendor did not respond to early notification - no patch is available at time of analysis.
Origin validation failure in Toggl Track Extension 4.11.16's postMessage handler allows any malicious webpage to inject forged session-state messages into the extension without authentication. The exploit has been publicly disclosed on GitHub, demonstrating that an attacker can manipulate a victim's time-tracking session state simply by luring them to an attacker-controlled page. No vendor patch exists and the vendor did not respond to coordinated disclosure, leaving users with no official remediation path.
Cross-site scripting in Typora's embedded Mermaid rendering engine allows remote attackers to inject and execute arbitrary JavaScript by manipulating the `classDef` or `style` arguments within Mermaid diagram syntax. Affected versions include all Typora releases up to 1.13.8 and 1.14.6; a publicly available proof-of-concept exploit exists on GitHub. Exploitation requires passive user interaction (opening or previewing a crafted file), and no authentication is needed from the attacker, making social-engineering delivery via shared documents or email a realistic threat vector. No active exploitation is confirmed in CISA KEV at time of analysis.
Path traversal in yaojingang GEOFlow's Image Library Cleanup component allows remote authenticated administrators to delete arbitrary server files by supplying crafted directory-traversal sequences in the `file_path` argument to the PHP `unlink()` function within `ImageLibraryController.php`. All versions up to 2.1.0 are affected (CPE: cpe:2.3:a:yaojingang:geoflow:*:*:*:*:*:*:*:*), with a publicly available proof-of-concept on GitHub issue #60. No CISA KEV listing exists, and the admin-only requirement (PR:H per CVSS 4.0) constrains real-world impact, but the public POC makes patching urgent for any exposed instance.
Code injection in yaojingang GEOFlow versions up to 2.1.0 allows a remote superadmin to execute arbitrary PHP on the server by submitting a malicious Blade template payload to the preview function of the Superadmin Theme Editor (SiteThemeEditorController.php). A publicly available proof-of-concept exploit has been disclosed via GitHub issue #60, and the attack requires no user interaction beyond the attacker's own authenticated session. Vendor-released patch version 2.1.1 resolves the issue; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Server-side request forgery in yaojingang GEOFlow up to 2.1.0 allows high-privileged authenticated attackers to make the application server issue arbitrary outbound HTTP requests by supplying a crafted value to the endpoint_url argument of DistributionController.isValidHttpEndpoint in GenericHttpEndpointResolver.php. The vulnerability carries a very low CVSS 4.0 score of 2.0 due to the PR:H requirement, limiting realistic attacker population to those already holding elevated application credentials. A public exploit has been disclosed via GitHub issue #60, though no active exploitation has been confirmed by CISA KEV.
Infinite-loop denial-of-service in ash_ai's ToolLoop component (versions 0.6.0 through <1.0.0) allows an attacker who can influence LLM model output - most practically via prompt injection - to hang the agent loop indefinitely and drive unbounded, repeated model API requests. When the LLM returns tool_call_ids that are either invalid or already present in the session history, the post-filter call list empties, yet the loop recurses with a byte-identical message state, making no forward progress and wasting unbounded API budget. No public exploit code or active exploitation has been identified at time of analysis; however, the prompt-injection attack path is well within reach of applications that ingest untrusted user content.
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.
OS command injection in Edimax BR-6214K firmware 1.40 allows an authenticated administrator to execute arbitrary commands on the router's underlying embedded OS by supplying shell metacharacters in the `pingstr` argument of the `asp_setPing` web endpoint. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to disclosure nor issued a patch. Despite the low CVSS 4.0 score of 2.0 - driven entirely by the PR:H authentication requirement - successful exploitation yields root-level command execution on the device, making the practical impact significantly higher than the score suggests for any attacker who already possesses admin credentials.
OS command injection in Edimax BR-6214K firmware version 1.40 allows a remote authenticated administrator to execute arbitrary operating system commands by supplying a crafted value to the ateFunc parameter of the wlanMP.asp endpoint, which passes it unsanitized to a system() call. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for post-authentication exploitation. No vendor patch exists and the vendor did not respond to disclosure; no CISA KEV listing means active exploitation has not been confirmed by US government sources, though the unpatched status combined with public PoC availability elevates near-term risk.
Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. A proof-of-concept has been publicly disclosed via a GitHub issue, though exploitation requires high-privilege access, keeping real-world risk low despite the sensitive nature of the exposed data.
OS command injection in the Diem CMS Administrative Console (diem-project/diem ≤ 5.1.3) allows authenticated administrators to execute arbitrary operating system commands on the host server via the unsanitized `dm_command` argument of the `executeCommand` function in `dmAdminPlugin/modules/dmConsole/actions/actions.class.php`. Publicly available exploit code exists via GitHub issue #447, and the project maintainers have not responded to the responsible disclosure report. The vulnerability is not in CISA KEV, but the unpatched status combined with available exploit code elevates urgency for any organization still running this abandoned software.
Unauthenticated access to the CloudSrvVersionCheck function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to trigger cloud-based firmware update checks by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The root cause is CWE-284 (Improper Access Control) - the function processes requests without verifying caller identity, a systemic pattern observed across multiple CGI handlers in this firmware batch. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.18% (7th percentile) indicates low probability of automated exploitation.
Unauthenticated write access to the setApWiFiSchCfg function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to arbitrarily overwrite the device's AP wireless availability schedule by posting a crafted request to /cgi-bin/cstecgi.cgi. The CVSS PR:N metric confirms no credentials are required; the attack surface is the standard CGI management endpoint. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.16% (6th percentile), but the unauthenticated network vector makes this trivially reproducible against any device exposing its management interface to untrusted networks.
Unauthenticated remote manipulation of wireless roaming configuration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setRoamingCfg function through /cgi-bin/cstecgi.cgi with no access control enforcement, allowing any network-reachable attacker to overwrite roaming behavior via a crafted POST request. The device performs no authentication check before processing configuration changes through this handler, consistent with a broader pattern of access control failures across multiple TOTOLINK T6 CGI endpoints documented in coordinated disclosure repositories. No public exploit code has been identified and EPSS is 0.16%, suggesting limited active exploitation interest at this time.
Memory corruption in LatencyUtils 2.0.3 and earlier allows a local low-privileged user to cause availability disruption by manipulating input to the `LatencyStats.recordDetectedPause` function in the PauseDetector component. A public proof-of-concept has been disclosed via a GitHub issue, and the project maintainers have not responded to the disclosure, leaving the library without an upstream fix. The CVSS 4.0 score of 1.9 and availability-only impact (VA:L) reflect a tightly scoped, low-severity flaw with no confidentiality or integrity consequences and no confirmed active exploitation.
Information disclosure in extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome exposes stored TOTP secrets via an unvalidated external message listener. The Background Service Worker's `chrome.runtime.onMessageExternal.addListener` handler fails to verify the `sender.id` field, meaning any other locally-installed Chrome extension can send a crafted message and receive TOTP seeds in response. A public proof-of-concept exploit exists; exploitation is constrained to local access with low-privilege conditions per the CVSS 4.0 vector (AV:L/PR:L), and no active exploitation has been confirmed.
Double-free memory corruption in Valkey 9.1.0's Module Timer Subsystem allows a high-privileged remote attacker to crash the server by triggering a self-stopping timer callback pattern. The moduleTimerHandler function in src/module.c frees the timer object both inside the callback (via ValkeyModule_StopTimer) and again after callback return, causing a double-free. A public proof-of-concept has been disclosed via GitHub, though the CVSS 4.0 score of 1.9 reflects that exploitation requires high-privilege module control, severely constraining real-world impact to low-severity availability disruption.
CVE-2026-80489 cannot be meaningfully summarized - the description is absent and no CVSS, CWE, CPE, EPSS, KEV, or patch data was provided. The sole intelligence signal is a Ubuntu vendor report, suggesting the affected package may be distributed via Ubuntu repositories, but the specific product, vulnerability class, and impact are entirely unconfirmed. No exploitation status, severity, or affected scope can be determined from available data.
Git textconv injection in GitList 2.0.0 enables remote code execution on the server by exploiting repository-controlled `.gitattributes` textconv filter definitions. When a user browses a commit diff or blame view, GitList invokes `git show` or `git blame` without the `--no-textconv` guard, causing git to execute attacker-committed shell scripts as the web server process. A public proof-of-concept exists embedded in the patch's own regression test suite; the vulnerability is absent from the CISA KEV catalog at time of analysis.
Server-side request forgery in PowerJob up to version 5.1.2 allows unauthenticated remote attackers to issue arbitrary server-originated requests via the MuConnectionManager.getOrCreateConnection function exposed through the Transport Endpoint in TestController.java. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier and description), and no vendor patch is available - the project was notified via GitHub issue but has not responded. Successful exploitation can be used to probe internal services, access cloud instance metadata endpoints, or exfiltrate credentials from the server's internal network.
Missing authentication on the edit endpoint in cu silicon up to version 0.1.5 allows unauthenticated remote attackers to interact with the `create_app` function in `views.py` without any credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no special conditions against a network-accessible deployment, and a publicly available proof-of-concept exploit (E:P) reduces the barrier to abuse. No vendor patch exists; the vendor did not respond to coordinated disclosure, leaving users without an official fix.
Server-side request forgery in Hyperledger Firefly up to 1.4.0 allows unauthenticated remote attackers to manipulate the webhook subscription URL parameter, causing the Firefly server to issue arbitrary HTTP requests to internal or otherwise inaccessible network resources. The vulnerability resides in the ValidateOptions function within the webhook subsystem (internal/events/webhooks/webhooks.go) and is exploitable without authentication or user interaction per the CVSS 4.0 AV:N/PR:N/UI:N vector. A public proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch or response has been identified at time of analysis.
Uncontrolled recursion in Samsung's rlottie animation library crashes any application embedding it when processing a crafted Lottie animation file containing pathologically nested shape-group structures. The flaw resides in lottieparser.cpp's parseGroupObject() function, which processed nested shape groups recursively without any depth ceiling, enabling stack exhaustion via a malicious .lottie/.json file. No active exploitation is confirmed and no public exploit has been identified at time of analysis; this is a local, user-interaction-dependent denial-of-service vulnerability.
Off-by-one out-of-bounds write in Zephyr RTOS's LwM2M JSON formatter allows a LwM2M server peer to corrupt one byte of memory adjacent to a STRING resource buffer by sending a WRITE payload whose string length exactly equals the buffer size. Affected devices are Zephyr LwM2M clients with the JSON content formatter enabled (cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). The overflow deterministically writes a NUL byte past the buffer boundary, enabling potential crash or silent data corruption depending on memory layout; no public exploit has been identified at time of analysis, but the fix commit and security advisory are publicly visible.
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. No public exploit has been identified and CISA SSVC confirms exploitation status as none, but the phishing potential is realistic given the deceptive UI state.
Unauthenticated access control bypass in TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows any attacker on the adjacent network to arbitrarily modify Wi-Fi scheduling via the setWiFiScheduleCfg handler. By sending a crafted POST to /cgi-bin/cstecgi.cgi without credentials, an attacker can suppress or extend wireless availability windows, causing service disruption for wireless clients. EPSS at 0.18% (7th percentile) and absence from CISA KEV reflect no known active exploitation at time of analysis.
Stored XSS in Sulu CMS prior to versions 2.6.25 and 3.0.8 allows an authenticated attacker with media upload permissions to execute attacker-controlled JavaScript in a victim's browser on the Sulu origin. By uploading an HTML, XHTML, or XML file and crafting a download URL with the inline=1 query parameter, the attacker bypasses the expected Content-Disposition: attachment behavior, causing the browser to render the document instead of downloading it. When an authenticated victim opens the crafted link, the attacker's JavaScript executes with full access to the victim's Sulu-origin session and can read sensitive data or perform privileged actions on the victim's behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Missing Authorization in the WPExperts Post SMTP WordPress plugin (versions 4.0.0 through beta.1) permits low-privilege authenticated users to perform settings changes that should be restricted to administrators. The flaw, rooted in CWE-862, means certain plugin actions lack adequate capability checks before execution, allowing role-inappropriate operations against the plugin's SMTP configuration. Impact is confined to integrity and availability - an attacker can alter mail server settings or disrupt outbound email delivery - with no confidentiality impact identified. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in QD (versions 20220208-20250803) allows a low-privileged authenticated attacker to inject arbitrary JavaScript into the task execution log output, which then executes in a victim user's browser when they trigger the affected task run. The injection path runs through HAR template variables - specifically the `__log__` field populated via the `extract_variables` mechanism and the `api://util/unicode` endpoint - which are rendered unsanitized into HTML via Python `%` string formatting in `TaskRunHandler.post()`. A public POC is available via GitHub Gist; no patch version has been confirmed at time of analysis.
OAuth state validation in @hono/oauth-providers prior to 0.8.6 fails open when the state parameter is absent from both the callback request and the stored session, treating two null values as a matching pair and bypassing CSRF protection entirely. This affects the google, github, facebook, discord, twitch, linkedin, and msentra social login providers in any Hono application using this middleware at version 0.8.5 or earlier. An attacker who tricks a victim into visiting a crafted OAuth callback URL can silently bind the attacker's third-party identity to the victim's session (login CSRF) or permanently link the attacker's account to the victim's account (forced account linking), enabling later sign-in as the victim. No public exploit has been identified at time of analysis.
Server-Side Request Forgery in the MapSVG WordPress plugin (versions <= 8.15.0) exposes the hosting WordPress server as a proxy to internal or adjacent network resources, reachable without authentication. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cause the server to issue requests beyond the WordPress application boundary, potentially exposing internal APIs, cloud metadata endpoints, or intranet services. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored cross-site scripting in Nokia NSP's workflow application allows an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other NSP users who view the compromised content. The vulnerability spans a wide range of NSP releases from version 22.3 through 25.11, affecting operators relying on Nokia's network management and orchestration platform. No public exploit code or active exploitation has been identified; SSVC assessment confirms exploitation status as none with a non-automatable attack path.
Infinite loop denial-of-service in BBEdit's Lasso Language Tokenizer affects all versions up to 15.5.5, allowing a remote attacker to hang the application by delivering a specially crafted Lasso language file that the victim opens. The vulnerability is limited to application-level availability loss with no confidentiality or integrity impact, and requires user interaction to trigger. No active exploitation has been identified; vendor-released fix is available in BBEdit 16.0.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
NoSQL injection in FastGPT Community Edition 4.10.0-4.14.0 allows unauthenticated remote attackers to bypass authorization on the POST /api/core/chat/getHistories endpoint by embedding MongoDB operators in crafted JSON payloads, exposing chat history titles for all users across the platform. A public proof-of-concept repository (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) exists, materially lowering the exploitation bar. EPSS at 0.33% (26th percentile) indicates no widespread exploitation observed yet, but the zero-authentication-required, low-complexity attack surface makes this a realistic opportunistic threat against internet-exposed deployments.
Sulu CMS versions prior to 2.6.25 and 3.0.8 allow authenticated admin users to generate or revoke public preview links for any page, article, or snippet - including content in webspaces they are explicitly forbidden from viewing - because PreviewLinkManager::generate() and PreviewLinkManager::revoke() omit the VIEW permission check before executing. The resulting preview URLs are publicly accessible via an opaque token with no authentication required, meaning the attacker or any recipient of the link can read otherwise-restricted CMS content. No public exploit has been identified at time of analysis, but the attack path is straightforward and directly reproducible from the published commit diff and GitHub security advisory.
Insecure Direct Object Reference in GROWI's bookmark folder APIs allows authenticated users to retrieve, modify, and delete other users' private bookmark data without authorization. Affected across all tracked versions per CPE data (cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:*), exploitation requires only a valid session - no elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the attack pattern (predictable or enumerable object IDs in API endpoints) is trivially reproducible by any authenticated user.
Out-of-bounds read in Systerel S2OPC versions up to 1.7.3 allows an authenticated remote attacker to partially disrupt availability of an OPC UA server through crafted string array range write operations. The vulnerable function set_range_matrix_on_string_array in sopc_builtintypes.c fails to enforce memory boundaries during range matrix processing on string arrays. No vendor patch has been released; the project was notified via issue report but has not responded. No public exploit or CISA KEV listing exists at time of analysis.
Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fragments, policy module names - to authenticated chat users via the LLM conversation stream. AshAi.ToolLoop and AshAi.Tools used Elixir's Exception.message/1 verbatim to encode any raised tool exception into the tool-result payload, which the language model then relayed to the requesting user. Any authenticated user able to steer tool arguments into a code path that raises an exception could extract sensitive internal reconnaissance data; ash_ai 1.0.0 closes the gap by routing all tool exceptions through a safe formatter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Four discrete access control defects in DataEase's sharing link module (versions before 2.10.26) allow any authenticated platform user to cross-access password-protected shares, enumerate other users' share mappings, and disrupt share availability by manipulating tickets they do not own. The flaws span ticket validation (cross-share reuse via ShareTicketManage.validateTicket), password-verification bypass of the mandatory-ticket policy (POST /de2api/share/validate), unauthorized ticket mutation/deletion, and insecure user-ID handling in the share enumeration endpoint. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Missing object-level authorization across three REST API surfaces in DataEase before 2.10.26 enables authenticated platform users to read, modify, and delete resources owned by other users. The affected endpoints cover chart detail retrieval (ChartViewManege), dashboard linkage read and write operations (VisualizationLinkageService), and map geometry management (MapManage) - all of which accepted arbitrary resource identifiers without verifying the requesting user held any permission over the target resource. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low attack complexity makes horizontal privilege escalation straightforward for any authenticated user.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbitrary JavaScript in the browsers of users who render Select schema components. The Select plugin's UI renderer interpolates template-controlled option values directly into an innerHTML assignment without HTML encoding, meaning a value containing `">` breaks out of the attribute context and injects arbitrary HTML and event handlers. A detailed proof-of-concept is publicly documented in GHSA-qq9g-96v4-m3cj; no active exploitation is recorded in CISA KEV at time of analysis.
Cross-workspace authorization bypass in ToolJet through 3.0.0-ee-beta.2 exposes TooljetDB table schemas and restricted app definitions to authenticated low-privilege users via the POST /api/v2/resources/export endpoint. Authenticated users can supply an arbitrary organization_id in the request body to extract database schemas belonging to workspaces they are not members of, and can additionally sidestep per-app granular export permissions within their own workspace to retrieve restricted app definitions. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires valid credentials.