Monthly
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. The flaw affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def or returning a plain boolean are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the patch is a single small commit (PR #4605) that is easy to reverse-engineer.
Local privilege escalation in System Informer before 4.0.26241.138 allows an attacker who already holds a low-privilege foothold on a machine where the phsvc helper is running to reach privileged APIs over the SiSvcApiPort ALPC endpoint and execute code as SYSTEM. The pre-patch authorization check accepted any Authenticode-signed caller, so an attacker can load or inject code into a Microsoft-signed host such as rundll32.exe and invoke PhSvcApiCreateService without forging a signature; the attack is strictly local (AV:L) and requires System Informer to be installed and its helper service active, meaning this is a post-compromise escalation rather than an internet-facing emergency. The vendor has released a fix in 4.0.26241.138, and no public exploit identified at time of analysis.
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Broken authorization in Apache DolphinScheduler before 3.4.3 allows any authenticated user to retrieve connection details - including stored data source passwords - for data sources they are not authorized to access via the /unauth-datasource and /authed-datasource endpoints. Exploitation is network-reachable (AV:N), low complexity (AC:L), requires no user interaction (UI:N) and only a valid low-privileged account (PR:L), yielding high confidentiality impact (C:H) with no integrity or availability impact per our assessment; NVD/vendor scoring differs slightly by also crediting low integrity impact (I:L). Because the leaked credentials can be reused against the underlying databases, the practical consequence extends beyond information disclosure to potential downstream database compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 3.4.3.
Authenticated users of Apache DolphinScheduler can stop or create savepoints for task instances belonging to projects they are not authorized to access, because the project-scoped task-instance API fails to enforce per-project authorization. The issue affects all releases before 3.4.3 and is reachable over the network via the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (the vendor-published score is 8.1), meaning a valid authenticated account plus knowledge or enumeration of a target task instance ID is required - anonymous exploitation is not possible - and the practical impact is an integrity and limited availability concern in multi-tenant or multi-project deployments where project isolation is a security boundary; no public exploit code has been identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the CVE is not in CISA KEV. This is a genuine but moderate-priority issue rather than a top-tier emergency.
Authorization bypass in Apache DolphinScheduler before 3.4.3 allows an authenticated user to alter task definitions, together with their upstream dependencies, in projects they are not authorized to access. The attacker pairs a projectCode they legitimately belong to with a task-definition code belonging to a different project when calling the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, because the handler never confirms that the task code actually belongs to the supplied project. Impact is confined to integrity and availability of workflow definitions (assessed vector I:H/A:L, C:N), so unauthorized projects may have their pipelines silently rewritten or disrupted; no public exploit code has been identified at time of analysis and EPSS is only 0.18% (7th percentile), making this a genuine but moderate-priority issue rather than an urgent emergency.
Incorrect authorization in Octopus Server causes the platform to evaluate multiple scoped permission assignments incorrectly, so an already-authenticated, highly privileged user can accumulate deployment permissions beyond those actually granted to them. This is an authenticated (PR:L) network-reachable flaw requiring a valid Octopus account that already holds scoped permission assignments; the realistic threat actor is a malicious insider or an attacker using a compromised legitimate account rather than an anonymous internet attacker, and no victim interaction is needed. With C:H/I:H/A:H, successful abuse can alter and deploy code across environments the user was never authorized to touch. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the 8.7 CVSS severity and default multi-scope evaluation behavior make it a priority for organizations relying on Octopus scoping for separation of duties.
Cross-tenant information disclosure in wger allows an authenticated trainer account that holds both the gym.gym_trainer and gym.add_adminusernote permissions but has no gym assignment (userprofile.gym = None) to read private admin notes, uploaded documents, gym contracts, user configuration and permission data belonging to any other unassigned (gym = None) user on the same instance. The root cause is an authorization guard that fails open: the five affected views compare gym objects with the Python operator '!=', and 'None != None' evaluates to False, so HttpResponseForbidden is never reached and the following queryset is filtered only by the attacker-supplied member_id. Rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, authenticated, low privilege), the bug is amplified because gym = None is the default state for newly registered users, so any instance with public registration plus delegated trainer permissions is exposed; a detailed proof-of-concept is documented in the published GitHub advisory and the permission-edit endpoint is also reachable, giving a possible privilege-escalation path, though no confirmed in-the-wild exploitation has been reported.
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logic flaw in its central access control filter: when an API operation verifies multiple @Verify-annotated parameters, access is granted if any one of them is permitted rather than requiring permission on all of them. An authenticated attacker with a low-privilege account who legitimately can reach the first referenced object can therefore pass authorization checks on later parameters and, provided they know the victim resource identifiers, read consumer information or modify entitlements and subscription resources - including objects belonging to other organizations (CVSS 3.1: 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires a valid account and prior knowledge of target consumer UUIDs, entitlement IDs, or subscription resource IDs, and is limited to endpoints that evaluate more than one verified parameter; no public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Strawberry GraphQL versions 0.217.0 through 0.326.0 contain an authorization bypass in which a custom permission class whose has_permission() is declared as a synchronous def but returns an awaitable (for example a coroutine) can grant access to fields that should be denied. Because only async def methods are detected as asynchronous, the returned awaitable is evaluated for truthiness on the synchronous resolve path and is always truthy, so the protected resolver runs even when the awaitable would resolve to False. The flaw affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def or returning a plain boolean are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis, though the patch is a single small commit (PR #4605) that is easy to reverse-engineer.
Local privilege escalation in System Informer before 4.0.26241.138 allows an attacker who already holds a low-privilege foothold on a machine where the phsvc helper is running to reach privileged APIs over the SiSvcApiPort ALPC endpoint and execute code as SYSTEM. The pre-patch authorization check accepted any Authenticode-signed caller, so an attacker can load or inject code into a Microsoft-signed host such as rundll32.exe and invoke PhSvcApiCreateService without forging a signature; the attack is strictly local (AV:L) and requires System Informer to be installed and its helper service active, meaning this is a post-compromise escalation rather than an internet-facing emergency. The vendor has released a fix in 4.0.26241.138, and no public exploit identified at time of analysis.
Cross-project resource manipulation in OpenStack Mistral through 23.0.0 allows an authenticated project member to rewrite and un-publish another project's public action definitions and environments via the v2 API, while a project administrator can relocate another project's resource by creating a workbook with a colliding embedded action or workflow name. This incorrect authorization vulnerability (CWE-863) has a CVSS 4.0 base score of 7.2 (High) and requires a valid account on a multi-tenant cloud that exposes the Mistral v2 API; no public exploit code was identified at time of analysis, and the impact is primarily integrity (VI:H) with limited confidentiality and availability effects. Deployments without the Mistral API exposed are not affected.
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Broken authorization in Apache DolphinScheduler before 3.4.3 allows any authenticated user to retrieve connection details - including stored data source passwords - for data sources they are not authorized to access via the /unauth-datasource and /authed-datasource endpoints. Exploitation is network-reachable (AV:N), low complexity (AC:L), requires no user interaction (UI:N) and only a valid low-privileged account (PR:L), yielding high confidentiality impact (C:H) with no integrity or availability impact per our assessment; NVD/vendor scoring differs slightly by also crediting low integrity impact (I:L). Because the leaked credentials can be reused against the underlying databases, the practical consequence extends beyond information disclosure to potential downstream database compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 3.4.3.
Authenticated users of Apache DolphinScheduler can stop or create savepoints for task instances belonging to projects they are not authorized to access, because the project-scoped task-instance API fails to enforce per-project authorization. The issue affects all releases before 3.4.3 and is reachable over the network via the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (the vendor-published score is 8.1), meaning a valid authenticated account plus knowledge or enumeration of a target task instance ID is required - anonymous exploitation is not possible - and the practical impact is an integrity and limited availability concern in multi-tenant or multi-project deployments where project isolation is a security boundary; no public exploit code has been identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the CVE is not in CISA KEV. This is a genuine but moderate-priority issue rather than a top-tier emergency.
Authorization bypass in Apache DolphinScheduler before 3.4.3 allows an authenticated user to alter task definitions, together with their upstream dependencies, in projects they are not authorized to access. The attacker pairs a projectCode they legitimately belong to with a task-definition code belonging to a different project when calling the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, because the handler never confirms that the task code actually belongs to the supplied project. Impact is confined to integrity and availability of workflow definitions (assessed vector I:H/A:L, C:N), so unauthorized projects may have their pipelines silently rewritten or disrupted; no public exploit code has been identified at time of analysis and EPSS is only 0.18% (7th percentile), making this a genuine but moderate-priority issue rather than an urgent emergency.
Incorrect authorization in Octopus Server causes the platform to evaluate multiple scoped permission assignments incorrectly, so an already-authenticated, highly privileged user can accumulate deployment permissions beyond those actually granted to them. This is an authenticated (PR:L) network-reachable flaw requiring a valid Octopus account that already holds scoped permission assignments; the realistic threat actor is a malicious insider or an attacker using a compromised legitimate account rather than an anonymous internet attacker, and no victim interaction is needed. With C:H/I:H/A:H, successful abuse can alter and deploy code across environments the user was never authorized to touch. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the 8.7 CVSS severity and default multi-scope evaluation behavior make it a priority for organizations relying on Octopus scoping for separation of duties.
Cross-tenant information disclosure in wger allows an authenticated trainer account that holds both the gym.gym_trainer and gym.add_adminusernote permissions but has no gym assignment (userprofile.gym = None) to read private admin notes, uploaded documents, gym contracts, user configuration and permission data belonging to any other unassigned (gym = None) user on the same instance. The root cause is an authorization guard that fails open: the five affected views compare gym objects with the Python operator '!=', and 'None != None' evaluates to False, so HttpResponseForbidden is never reached and the following queryset is filtered only by the attacker-supplied member_id. Rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, authenticated, low privilege), the bug is amplified because gym = None is the default state for newly registered users, so any instance with public registration plus delegated trainer permissions is exposed; a detailed proof-of-concept is documented in the published GitHub advisory and the permission-edit endpoint is also reachable, giving a possible privilege-escalation path, though no confirmed in-the-wild exploitation has been reported.
Candlepin, the entitlement and subscription management engine behind Red Hat Satellite 6, contains an authorization-logic flaw in its central access control filter: when an API operation verifies multiple @Verify-annotated parameters, access is granted if any one of them is permitted rather than requiring permission on all of them. An authenticated attacker with a low-privilege account who legitimately can reach the first referenced object can therefore pass authorization checks on later parameters and, provided they know the victim resource identifiers, read consumer information or modify entitlements and subscription resources - including objects belonging to other organizations (CVSS 3.1: 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation requires a valid account and prior knowledge of target consumer UUIDs, entitlement IDs, or subscription resource IDs, and is limited to endpoints that evaluate more than one verified parameter; no public exploit code was identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).