CVE-2026-109568
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips o
CVSS
7.1
Alto
EPSS
0.2%
p15
KEV
—
Exploit Today
4
0-100
Publicado: 12 oct 2026 · Última mod.: 16 oct 2026 · CWE-639
0.2%EPSS · 30 días0.2%
2026-10-132026-10-23
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.
- github.comhttps://github.com/MarceauKa/shaark
- github.comhttps://github.com/MarceauKa/shaark/blob/1.2.44/app/Http/Controllers/Api/LinkController.php
- github.comhttps://github.com/MarceauKa/shaark/pull/110
- www.vulncheck.comhttps://www.vulncheck.com/advisories/shaark-1.2.13-through-1.2.44-missing-authorization-via-api-update-and-delete-routes
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-936344.3 MED—
———A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization and accepts attacker-selected file metadata, owner identifiers and declared sizes without validating a corresponding document share. An attacker can plant entries attributed to another real local account without that account sharing a document. No victim interaction is required. ZCS 10.1.16 and 10.1.20 are affected.3hCVE-2026-1157254.2 MED—
———Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts.8hCVE-2026-1155468.1 ALT35.3%
——11Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console.3hCVE-2026-1153346.8 MED13.8%
——4Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.1dCVE-2026-1153295.9 MED10.0%
——3Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.5hCVE-2026-1153265.4 MED11.7%
——4QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_order to create refund records, cancel victims' service lines, and corrupt refund quantities.1d