CVE Watch10 de nov. de 2026

CVE-2026-125750

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets b

CVSS

7.1

Alta

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-862

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1265454.3 MÉD

—

———WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=tags to obtain filenames, titles and stored video_password values of unlisted, group-restricted and password-protected videos, enabling unauthorized viewing.5h CVE-2026-1261236.5 MÉD

—

———BeeS Software Solutions ERP before 04 September 2026 allows any low-privileged user to navigate directly to the administrative dashboard endpoint and gain access to the administrative console, including unrestricted access to institutional, employee, and student data.8h CVE-2026-1252979.8 CRÍ

—

———AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.8h CVE-2026-1208256.5 MÉD

—

———An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only basic database privileges to read the contents of collections in a database for which they have not been granted read access. The privilege evaluation performed while a view definition is validated does not cover a nested portion of the supplied pipeline, so the resulting view returns data the user is otherwise refused. This may result in unintended access to data, including stored authentication material.9h CVE-2026-1208234.3 MÉD

—

———A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in unintended access to configuration and schema information.9h CVE-2026-1253378.3 ALT

—

——0Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.9h