CVE-2026-82986
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though t
CVSS
4.6
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 27, 2026 · Last modified: Oct 27, 2026 · CWE-284
Not enough EPSS history yet.
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-829844.3 MED—
———When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.
This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.3hCVE-2026-771734.3 MED—
———A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.3hCVE-2026-771713.5 LOW—
———A public shared collective always allowed recipients of the link to create pages.3hCVE-2026-674003.5 LOW—
———A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.3hCVE-2026-1175127.3 HIG—
———A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.3hCVE-2026-923757.8 HIG—
———An improper access control vulnerability in
the IPC communication between TeamViewer Full Client or Host prior to version
15.83 and the Remote Management Monitoring component prior to version 26.10.1
allows a local authenticated attacker with low privileges to execute scripts as
SYSTEM/root.4h