CVE-2026-108550

SkillHub before 0.2.22 Account Takeover via Account Merge Flow

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Iflytek

Products

Skillhub

CVE-2022-20572

kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c

In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Android Enterprise Linux

CVE-2026-77438

Trilium unauthenticated share-search discloses password-protected and hidden shared notes

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and then runs a full-text search across the entire published subtree, returning each matching note's title, share identifier, and hierarchical path without re-checking whether that individual note requires a share password or is hidden from the navigation tree. Because the search matches note content, an attacker can enumerate protected notes and use the endpoint as a boolean oracle that confirms arbitrary substrings, recovering the full contents of notes that should be gated behind a password. This issue is fixed in version 0.104.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Triliumnext Triliumnotes

Products

Trilium Trilium

CVE-2026-103028

SFTPGo source-side file-pattern filter bypass during copy operations

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Drakkan

Products

Sftpgo

CVE-2026-106327

chromium-browser: Incorrect authorization in Core

Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-85298

Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-108729

Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment id can request the original or preview route without a token or signature to retrieve files across namespace and record permission boundaries.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Cortezaproject

Products

Corteza

CVE-2026-107822

MariaDB: database privilege escalation via user / role name collision in the acl cache

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mariadb

Products

Mariadb Server

CVE-2026-78341

Incorrect Authorization Allows Privilege Escalation in Dell Secure Connect Gateway Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager

CVE-2026-5954

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2026-6567

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2026-81839

Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2025-10908

Account Lock Bypass via Magic Link or Pass Key Authentication in WSO2 Identity Server Allows Unauthorized Access

Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass Key methods. This bypasses the intended security control that should prevent access to accounts that have been locked. This vulnerability may allow unauthorized access to applications and sensitive data associated with accounts that should have been restricted via the account lock mechanism. It also undermines the effectiveness of the account lock mechanism intended to prevent further login attempts.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Identity Server Wso2 Carbon Magiclink Authenticator Module Wso2 Identity Server

CVE-2026-76264

Improper Authorization through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk Splunk Enterprise

CVE-2026-108695

MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Multivendorx Wordpress-extensions

Products

Multivendorx Multivendorx

CVE-2026-108114

Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions

Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Strapi

Products

Strapi

CVE-2026-107782

System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Winsiderss

Products

System Informer

CVE-2026-107728

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver evaluates the result of has_permission() for truthiness. When a custom permission declares has_permission() as a normal function but returns an awaitable, supports_sync does not classify it as asynchronous, the awaitable is not awaited, and its inherently truthy object value permits the protected resolver to run even when the result would resolve to false. This affects synchronous field resolvers under both execute_sync() and execute(); permissions declared with async def has_permission() and synchronous permissions returning a boolean are not affected. This issue is fixed in version 0.326.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Strawberry

Products

Strawberry

CVE-2026-97147

openstack-mistral: mistral: Cross-project resource tampering via missing ownership check in action definition and environment update paths

In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Openstack

Products

Mistral

CVE-2026-70246

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server