Apache EUVD-2026-80330

| CVE-2026-59739 MEDIUM

Missing Authorization (CWE-862)

2026-09-15

GHSA-wrgg-c9rw-j78f

Authentication Bypass Apache Information Disclosure

Share

Lifecycle Timeline

1

Analysis Generated

Sep 15, 2026 - 20:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Path-name disclosure in Apache ZooKeeper 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 lets a connected client learn the names of ACL-restricted znodes by registering exists-watches on paths that do not yet exist and then reconnecting after those paths are created under restrictive ACLs. The reconnect replay handler DataTree.setWatches() delivers the watch notification with a null ACL, bypassing the ACL check that was added to WatchManager.triggerWatch() as the fix for CVE-2024-23944 (ZOOKEEPER-4799), making this an incomplete-fix bypass. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

CVE-2025-6205 CRITICAL POC

CVE-2025-20362 HIGH POC

CVE-2017-9232 CRITICAL POC

CVE-2023-6875 CRITICAL POC

CVE-2024-4898 CRITICAL POC

CVE-2023-32117 CRITICAL POC

CVE-2020-36719 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

EUVD-2026-80330 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy