CVE-2026-88176
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-862
Not enough EPSS history yet.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1253378.3 HIG—
——0Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.3hCVE-2026-1208054.3 MED—
——0In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations.3hCVE-2026-968457.8 HIG—
——0Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.4hCVE-2026-961335.5 MED—
——0Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally.4hCVE-2026-960297.8 HIG—
——0Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.4hCVE-2026-1253319.1 CRI—
——0HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.4h