CVE-2026-112000
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe
CVSS
7.6
Alta
EPSS
0.3%
p22
KEV
—
Exploit Today
6
0-100
Publicado: 18 de out. de 2026 · Última mod.: 22 de out. de 2026 · CWE-862
0.3%EPSS · 30 dias0.3%
2026-10-192026-11-06
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.
- github.comhttps://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/auth.go#L97-L110
- github.comhttps://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/auth/interceptor.go#L35-L40
- github.comhttps://github.com/vanus-labs/vanus/blob/v0.9.0/internal/gateway/proxy/proxy.go#L256-L300
- github.comhttps://github.com/vanus-labs/vanus/issues/647
- www.vulncheck.comhttps://www.vulncheck.com/advisories/vanus-0.8.0-through-0.9.0-missing-authorization-in-gateway-streaming-rpcs
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1234745.3 MÉD—
———Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.5hCVE-2026-1234674.3 MÉD—
———Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128.5hCVE-2026-1234625.3 MÉD—
———Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.5hCVE-2026-1226635.3 MÉD—
———Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.5hCVE-2026-1226604.3 MÉD—
———Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5.5hCVE-2026-1226595.4 MÉD—
———Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.5h