CVE-2026-119599
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creati
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 30, 2026 · Last modified: Oct 30, 2026 · CWE-266
Not enough EPSS history yet.
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint keys with read_channels and query /admin/graphql to read every channel's configuration, including base URLs and model lists.
- github.comhttps://github.com/looplj/axonhub
- github.comhttps://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key.go#L340
- github.comhttps://github.com/looplj/axonhub/blob/v1.0.0-beta11/internal/server/biz/api_key.go#L448
- github.comhttps://github.com/looplj/axonhub/commit/e5c904efbdabd80d74827dfae478330339c5a514
- github.comhttps://github.com/looplj/axonhub/issues/2724
- github.comhttps://github.com/looplj/axonhub/pull/2741
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation
- www.vulncheck.comhttps://www.vulncheck.com/advisories/axonhub-through-1.0.0-beta11-privilege-escalation-via-service-account-api-key-scopes
- hackmd.iohttps://hackmd.io/@hieuPenguinnn/axonhub-apikey-scope-grant-privilege-escalation
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-548546.3 MED—
———Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.9hCVE-2026-1180868.8 HIG—
———Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.5hCVE-2026-1163869.8 CRI—
———Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.9hCVE-2026-1180828.8 HIG—
——0Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.9hCVE-2026-1186447.7 HIG10.1%
——3n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.2dCVE-2026-1164714.3 MED9.6%
——3A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.4d