CVE-2025-43724
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privil
CVSS
4.4
Medium
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Published: Oct 8, 2025 · Last modified: Oct 8, 2026 · CWE-639
0.1%EPSS · 30 days0.1%
2026-09-272026-10-25
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized access to NFSv4 or SMB shares.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-972555.3 MED—
———Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.1hCVE-2026-96581——
———Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action.
Under attribute multitenancy, Ash.Actions.Create (lib/ash/actions/create/create.ex) and Ash.Actions.Create.Bulk (lib/ash/actions/create/bulk.ex) upserted on the primary key, or on an all_tenants? identity, without scoping the conflicting record to the request's tenant. A caller of a create action with upsert? true that accepts the primary key, supplying a record id from another tenant, updated that record's upsert fields and received all of its attributes in the result. With the default upsert fields the tenant attribute was written too, moving the record into the caller's tenant. Read and update policies do not run for upserts, and tenant-scoped create policies pass because the tenant is the caller's own.
This issue affects ash: from 1.22.0 before 3.37.2.4hCVE-2026-1161875.0 MED—
———Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, object, and upload ID can inject parts, complete, or abort in-flight uploads and view upload and object metadata across tenants.22hCVE-2026-116186——
———OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.22hCVE-2026-1161855.0 MED—
———OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own realm and a victim gateway ID to disclose internal target hosts, ports, and routing data.22hCVE-2026-116184——
———OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.22h