Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment

Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root.

Dell PowerStore contains an authorization bypass vulnerability. An authenticated administrator could exploit this vulnerability to bypass multi-approver controls on critical operations.

Action Pack: Possible Strong Parameters bypass in Parameters#each_key

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of each_key to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag. This is an incomplete fix of CVE-2020-8164, which made each, each_pair and each_value return the Parameters instance but left each_key delegated. An application is affected if it passes the return value of ActionController::Parameters#each_key, called with a block, to mass assignment. Rails itself makes no such call. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php

OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter.

Team preferences RBAC bypass through the set-home-dash endpoint

Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).

Insufficient Validation of Custom Claims Allows OIDC Token Impersonation

In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity.

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.

Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to promote every account to administrator.

SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive metadata that hides the same field on reads. The affected flow begins at PATCH /Api/V8/module and uses user_hash, external_auth_only, api-visible: false, and sensitive: true to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can mass-assign internal authentication fields, modify password hashes or external-authentication flags, and persist unauthorized account access. This issue is fixed in versions 7.15.2 and 8.10.2.

Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one. A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. From 10.10.1 until 12.0.2, the @graphql-tools/utils mergeIncrementalResult helper passes incrementalResult.path segments to setObjectKeyPath without runtime primitive-type validation. A non-primitive segment can bypass strict comparisons against __proto__, constructor, and prototype, then be coerced during property access so a malicious or compromised upstream incremental GraphQL response writes attacker-controlled properties to Object.prototype in the consuming Node.js process. The affected implementation is packages/utils/src/mergeIncrementalResult.ts and is reachable when consumers merge untrusted @defer or @stream transport results. This issue is fixed in version 12.0.2.

Privilege Escalation in C-Prot's C-Prot AppDefense

Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729.

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information.

Vikunja before 2.7.1 Mass Assignment via Team external_id Field

Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login.

Privilege Escalation via Email Authentication Flow in JetBrains Hub

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11. ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted. The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.

Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6.

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

Alerting contact point authorization bypass via schema downgrade

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect alert notifications (incorrect authorization).