CVE-2026-56723

Zammad: Missing authorization on ticket attachment download

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachment download endpoint, bypassing article-level authorization. This results in an inconsistency: The article listing hides internal articles from customers. The attachment download only checks the parent ticket, not the article, so the same customer can download the attachment directly. This issue is fixed in version 7.0.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Zammad

Products

Zammad

CVE-2026-56733

Zammad: Incorrect Authorization and Improper Privilege Management

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2 and 7.1.0, this issue concerns a lack of discursive validation within the authorization cascade. It has been determined that the system-level enforcement of access restrictions during the initialization of new identity objects exhibits a discrepancy: Under specific conditions, the granular restrictions of the access key being used are overridden by the latent authorization authority of the parent account. Consequently, this means that the intended separation of functional areas is nullified, resulting in an uncontrolled expansion of administrative discretion. Due to this potential integrity breach of the entire trust environment, an immediate evaluation of the authorization hierarchies is imperative. Impact An attacker can create new administrator accounts despite token restrictions. This grants full access to all system data (tickets, customers, configuration) and allows the attacker to take complete control of the Zammad instance. Abuse Scenario The vulnerability stems from a lack of synergy between the token-based authorization logic and the target system's functional authorization hierarchy, which allows for iterative escalation of the privileged access context. This issue is fixed in versions 7.0.2 and 7.1.0.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Zammad

Products

Zammad

CVE-2026-84464

Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group, or organization before including its details in a request to that external system. An authenticated user, including one with only basic customer access, could exploit this by referencing another record's ID, and thereby view details of tickets, customer accounts, teams, or organizations that did not belong to them. This issue is fixed in version 7.1.2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Zammad

Products

Zammad

CVE-2026-88848

MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-75745

Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 10 Critical EPSS 1.2% KEV · Not listed

Vendors

Adobe

Products

Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

CVE-2026-71543

OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Openbao

Products

Openbao

CVE-2026-52743

GoCD before 26.1.0 is vulnerable to authorization bypass via job status API

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gocd

Products

Gocd

CVE-2026-68791

Azure Machine Learning Information Disclosure Vulnerability

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Machine Learning

CVE-2026-57590

Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Dolphinscheduler

CVE-2026-87720

Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review

Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or an unauthenticated user if the repository was previously public) to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes (such as project.git.git) across REST APIs, Gitiles, or SSH Git commands. Because Gerrit strips only a single terminal .git suffix when constructing the logical ProjectCache key while JGit (FileKey.lenient) resolves the suffixed alias to the same canonical bare repository on disk, revoking read access or removing owner rules on the canonical project name fails to evict the cached alias ProjectState during the cache validity window, enabling reads of newly created private commits or writes to refs/meta/config. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Gerrit

Products

Gerrit

CVE-2026-48412

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to restricted resources. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-48411

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-48415

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-48416

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Adobe Commerce Adobe Commerce B2b Commerce and 3 more

CVE-2026-18712

Improper Authorization in MongoDB Queryable Encryption Maintenance Operations Allows Unauthorized Modification of Other Collections

An issue in MongoDB Server's Queryable Encryption maintenance operations could allow an authenticated user with privileges on one encrypted collection to cause unauthorized modification or destruction of data belonging to a different collection. This is due to insufficient validation of certain internal metadata references before they are used to perform operations on other namespaces.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Mongodb Server

CVE-2026-88907

SAML ePPN Attribute Validation Bypass in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Tübi̇tak Ulakbi̇m

Products

Ulakpdf

CVE-2026-88916

Admin Access Bypass via Header Fallback in TÜBİTAK ULAKBİM's UlakPDF

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Tübi̇tak Ulakbi̇m

Products

Ulakpdf

CVE-2026-97818

phpIPAM User API Authorization Bypass for Admins and All Users IDs

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Phpipam

Products

Phpipam

CVE-2026-84399

Botslab G980H Dashcams Incorrect Authorization

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated context. An unauthenticated attacker with adjacent network access could potentially use valid session state associated with another client to access privileged functionality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Botslab

Products

G980h

CVE-2026-85724

Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Moquette Moquette-io

Products

Moquette Moquette