30
30
35
30
30
30
30
CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access
Apache Doris authorization bypass CVE-2026-68570 lets authenticated users read unauthorized data, disclosing information across versions 2.0.0 through 4.1.3.
CVE-2026-68570 is an incorrect authorization vulnerability in Apache Doris rated important, allowing an authenticated user to bypass privilege checks and read data they are not authorized to access. Affected versions span Apache Doris 2.0.0 through 2.1.*, 3.0.0 through 3.0.*, 4.0.0 before 4.0.8, and 4.1.0 before 4.1.4. The issue results in unauthorized disclosure of information.
28
[0day-rubbish] SmarterMail 100.0.9693 (Build 9693) Antivirus command-line configuration executing as NT AUTHORITY\SYSTEM (7.2)
SmarterMail 100.0.9693 executes its antivirus command-line configuration as NT AUTHORITY\SYSTEM, a CWE-250 flaw rated CVSS 7.2.
0day Rubbish Research Team disclosed that SmarterMail 100.0.9693 (build 9693) runs its antivirus command-line configuration with NT AUTHORITY\SYSTEM privileges, classified as CWE-250 (deployment of executable with unnecessary privileges) and rated CVSS 7.2. Control over that configuration could yield SYSTEM-level code execution on the mail server. The disclosure does not report exploitation in the wild.
36
CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods
Apache NiFi 1.5.0-2.11.0 flow update REST methods lack authorization checks for referenced components, permitting unauthorized Process Group flow replacement (CVE-2026-82561).
Apache NiFi 1.5.0 through 2.11.0 expose REST API methods that replace the entire contents of a Process Group with a client-supplied flow definition, including versioned flow update and rebase operations. Framework authorization for these methods was limited to read and write privileges on the target Process Group, without checking components referenced in the flow (CVE-2026-82561). No severity rating was provided in the disclosure; the affected version range is broad.
38
CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning
Apache Syncope patches missing authorization checks (CVE-2026-75030) in Group members deprovisioning that administrators can abuse.
CVE-2026-75030 is a moderate-severity missing authorization vulnerability in Apache Syncope's Group members deprovisioning logic (syncope-core-idrepo-logic). An administrator with task execution permissions can bypass the incomplete authorization checks. Affected versions include 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
15
30
30
30
30
30
35
30
30
30
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
Apache Storm Nimbus blobstore authorization bypass via rebalance configuration overrides, fixed in 3.1.0.
CVE-2026-82432 (rated moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Nimbus validates topology.blobstore.map against the calling subject only at topology submission time. The rebalance operation accepts configuration overrides and strips a small set of keys but never re-runs that validation, so a caller authorized only to rebalance a topology can introduce an unauthorized blobstore map.
35
30
30
30
30
30
30
30
CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration
Apache Syncope CVE-2026-73236 bypasses delegated administration checks for sibling Realms sharing a name prefix.
Apache Syncope disclosed CVE-2026-73236, an important-rated incorrect authorization vulnerability. Delegated administration checks are enforced via Realm hierarchy prefix matches, so two sibling Realms whose names begin with the same string cannot be correctly distinguished, allowing delegated admins to act outside their assigned Realm. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Users should upgrade to fixed versions.
28
30
30
30
30
30
30
30
35
30
30
CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Apache Storm Client 3.0.0 ACL bypass lets every authenticated principal bypass restrictions when nimbus.groups is set without nimbus.users.
CVE-2026-82431 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0. SimpleACLAuthorizer returned early when nimbus.users was empty, before evaluating nimbus.groups. Operators restricting cluster access by group alone received no restriction, so any authenticated principal could execute user-level commands. Fixed in version 3.1.0.
30