CVE Watch13 oct 2026

CVE-2026-108740

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in us

CVSS

8.3

Alto

EPSS

0.3%

p24

KEV

—

Exploit Today

0-100

Publicado: 11 oct 2026 · Última mod.: 13 oct 2026 · CWE-915

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-10-122026-10-14

Descripción técnica

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1089485.4 MED

17.9%

——5A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Profile Update Handler. The manipulation of the argument usertype_id leads to dynamically-determined object attributes. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.2d CVE-2026-92119—

19.9%

——6REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.2d CVE-2026-1091868.8 ALT

27.9%

——8jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.3d CVE-2026-1065507.5 ALT

19.4%

——6Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution protections in config.set(). An attacker controlling the configuration key can write arbitrary properties to constructor.<key>, which walk() resolves to the global Object function. This allows overwriting core JavaScript methods such as Object.assign, leading to persistent process-wide failures and requiring a restart. The issue bypasses existing filters that only block constructor.prototype.* and __proto__.*. Exploitation requires an endpoint that forwards attacker-controlled keys into config.set().8d CVE-2026-1061007.1 ALT

11.1%

——3Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access control does not permit that user to change. The Postgres and SQLite adapters are not affected. This issue is fixed in versions 3.87.0 and 4.0.0-canary.20.15h CVE-2026-1058639.4 CRÍ

31.0%

——9Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.15h