2 CVEs
CRITICAL
CVSS 9.8
SimStudio Authorization Bypass Vulnerabilities
2026-03-02
CVE-2026-3431
CRITICAL
SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary MongoDB operations.
9.8
CVSS
0.1%
EPSS
CVE-2026-3432
CRITICAL
SimStudio has a second authorization flaw in the OAuth token endpoint that allows privilege escalation through crafted token requests.
9.1
CVSS
0.1%
EPSS