CVE Watch23 sept 2026

CVE-2026-84713

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_

CVSS

6.5

Medio

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 23 sept 2026 · Última mod.: 23 sept 2026 · CWE-639

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-types endpoint is listable by any authenticated user and the API filter backend traverses object relations without per-hop authorization, a user with no privileges can use a relational filter as a boolean count-oracle to recover, character by character and across organizations, the secret recipient values of other tenants' notifications — including PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook bearer-token URLs. This flaw affects confidentiality.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-967627.3 ALT

—

———A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.6h CVE-2026-847206.5 MED

—

———A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from the API serializer. Because the column is persisted before Ansible's no_log masking is applied, a user with only read access to a workflow — or, via a regular-expression lookup that bypasses the JSON cross-relation filter guard through the world-readable credential-types endpoint, any authenticated user with no roles — can use the result count as a boolean/count oracle to recover, character by character, secret values that a playbook author explicitly marked no_log, including across organizations.7h CVE-2026-956026.5 MED

—

——0Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.11h CVE-2026-955925.3 MED

—

——0Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.10h CVE-2026-936235.3 MED

—

——0Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.11h CVE-2026-935134.3 MED

—

——0Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.10h