Monthly
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.
Namespace collision between user identifiers in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information and enables unauthorized message injection by unauthenticated remote attackers. The flaw, rooted in CWE-639 (authorization bypass via user-controlled key), allows an attacker to resolve or collide with another user's namespace without requiring authentication, as confirmed by the CVSS vector (PR:N). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack surface warrants prompt remediation.
Cross-tenant kanban bucket injection in Vikunja API (≤ 2.3.0) allows any authenticated user to relocate their own bucket into any other tenant's project view by supplying an arbitrary `project_view_id` in the JSON request body of the bucket update endpoint. The `Bucket.Update()` function in `pkg/models/kanban.go` mass-assigns `project_view_id` directly to the database row via xorm, while the `CanUpdate` authorization check only validates the URL path parameters - never the body field. A detailed curl-based proof-of-concept is publicly available in the GitHub security advisory GHSA-569v-q83c-3j3g, though no active exploitation has been confirmed (not in CISA KEV).
Cross-tenant IDOR in Vikunja's kanban task-placement endpoint (POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks) allows any authenticated user to read the complete contents of any task on the instance and partially mutate its state, defeating Vikunja's project-isolation model. The authorization check in TaskBucket.CanUpdate validates only the URL-scoped project and bucket, never the attacker-controlled task_id supplied in the JSON body; because task IDs are a global sequential integer space, brute-force enumeration of all instance tasks is trivial. This is the fifth documented instance of the same missing-authorization-on-task-child class in Vikunja (siblings: CVE-2026-33676, CVE-2026-33678, CVE-2026-33313, CVE-2026-35598); the vendor-confirmed fix ships in v2.4.0 and no public exploit beyond the detailed advisory proof-of-concept has been identified at time of analysis.
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other users' feedback records by supplying arbitrary feedback identifiers to the PUT and DELETE API endpoints. The server performs no ownership verification before processing these operations (CWE-639), enabling silent corruption of human-rating datasets used in LLM evaluation and RLHF pipelines. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Missing ownership validation across three Quivr chat API endpoints through version 0.0.322 enables any authenticated user to read, delete, or inject fabricated messages into other users' private conversations and associated knowledge base content. The vulnerable endpoints (GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, POST /chat/{chat_id}/question/answer) accept user-supplied chat IDs without server-side authorization checks, a classic IDOR (CWE-639) pattern. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the low-complexity, authenticated-only prerequisite makes exploitation trivially accessible to any malicious account holder in a multi-user deployment.
Insecure Direct Object Reference in VoltAgent through 2.1.20 allows any authenticated user to read, modify, or delete conversations belonging to other users by supplying arbitrary conversation identifiers to memory API endpoints. The server accepts caller-controlled identifiers without verifying ownership, enabling horizontal privilege escalation across all users of a shared deployment. No public exploit has been identified at time of analysis, but the IDOR pattern (CWE-639) is trivially exploitable by any account holder with basic API knowledge.
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Prompt endpoint ownership validation failure in Quivr through 0.0.322 enables authenticated users with only read-only brain access to overwrite any system prompt by supplying a harvested prompt identifier to an unprotected write endpoint. The IDOR flaw (CWE-639) means that low-privileged authenticated accounts can silently corrupt AI brain behavior for all users of a shared brain, with no elevated privileges required beyond a valid session. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad scope of impact across all brain users make this a practical integrity threat in multi-tenant Quivr deployments.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.
Namespace collision between user identifiers in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information and enables unauthorized message injection by unauthenticated remote attackers. The flaw, rooted in CWE-639 (authorization bypass via user-controlled key), allows an attacker to resolve or collide with another user's namespace without requiring authentication, as confirmed by the CVSS vector (PR:N). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack surface warrants prompt remediation.
Cross-tenant kanban bucket injection in Vikunja API (≤ 2.3.0) allows any authenticated user to relocate their own bucket into any other tenant's project view by supplying an arbitrary `project_view_id` in the JSON request body of the bucket update endpoint. The `Bucket.Update()` function in `pkg/models/kanban.go` mass-assigns `project_view_id` directly to the database row via xorm, while the `CanUpdate` authorization check only validates the URL path parameters - never the body field. A detailed curl-based proof-of-concept is publicly available in the GitHub security advisory GHSA-569v-q83c-3j3g, though no active exploitation has been confirmed (not in CISA KEV).
Cross-tenant IDOR in Vikunja's kanban task-placement endpoint (POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks) allows any authenticated user to read the complete contents of any task on the instance and partially mutate its state, defeating Vikunja's project-isolation model. The authorization check in TaskBucket.CanUpdate validates only the URL-scoped project and bucket, never the attacker-controlled task_id supplied in the JSON body; because task IDs are a global sequential integer space, brute-force enumeration of all instance tasks is trivial. This is the fifth documented instance of the same missing-authorization-on-task-child class in Vikunja (siblings: CVE-2026-33676, CVE-2026-33678, CVE-2026-33313, CVE-2026-35598); the vendor-confirmed fix ships in v2.4.0 and no public exploit beyond the detailed advisory proof-of-concept has been identified at time of analysis.
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other users' feedback records by supplying arbitrary feedback identifiers to the PUT and DELETE API endpoints. The server performs no ownership verification before processing these operations (CWE-639), enabling silent corruption of human-rating datasets used in LLM evaluation and RLHF pipelines. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Missing ownership validation across three Quivr chat API endpoints through version 0.0.322 enables any authenticated user to read, delete, or inject fabricated messages into other users' private conversations and associated knowledge base content. The vulnerable endpoints (GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, POST /chat/{chat_id}/question/answer) accept user-supplied chat IDs without server-side authorization checks, a classic IDOR (CWE-639) pattern. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the low-complexity, authenticated-only prerequisite makes exploitation trivially accessible to any malicious account holder in a multi-user deployment.
Insecure Direct Object Reference in VoltAgent through 2.1.20 allows any authenticated user to read, modify, or delete conversations belonging to other users by supplying arbitrary conversation identifiers to memory API endpoints. The server accepts caller-controlled identifiers without verifying ownership, enabling horizontal privilege escalation across all users of a shared deployment. No public exploit has been identified at time of analysis, but the IDOR pattern (CWE-639) is trivially exploitable by any account holder with basic API knowledge.
Broken access control in Kotaemon through 0.12.0 lets any user act on conversations they do not own by supplying arbitrary conversation identifiers to the select_conv, delete_conv, rename_conv, and on_set_public_conversation handlers in control.py. Because these functions never verify that the requesting user owns the referenced conversation, an attacker can read other users' chat histories and delete or rename their conversations. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Prompt endpoint ownership validation failure in Quivr through 0.0.322 enables authenticated users with only read-only brain access to overwrite any system prompt by supplying a harvested prompt identifier to an unprotected write endpoint. The IDOR flaw (CWE-639) means that low-privileged authenticated accounts can silently corrupt AI brain behavior for all users of a shared brain, with no elevated privileges required beyond a valid session. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad scope of impact across all brain users make this a practical integrity threat in multi-tenant Quivr deployments.