CVE-2026-49939: Apache James JMAP ACL bypass
JMAP protocol fails to respect negative IMAP ACL rules, letting users administer folders despite denials; upgrade to 3.9.1 required.
Stories per day · 30 days
Relatedapache4access-control1activemq1authorization-bypass1clickjacking1consul1consul-k8s1csrf1hashicorp1imap1james1jmap1kubernetes1oozie1web-applications1workflow1zookeeper1
15 stories, newest first · one card per story
Stories tagged #acl
Apache ActiveMQ retains write access after ACL revocation
Cached authorization flaw allows continued write access after live ACL removal in versions before 6.3.3.
Apache ZooKeeper ACL enforcement bypass allows unauthorized operations
TOCTOU race condition in setACL request handling allows unauthorized operations to commit after an ACL revocation in versions 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7.
Apache Oozie workflow rerun bypasses ACL and reassigns ownership
Authenticated Oozie users can reconfigure other tenant's workflows and change ownership in all versions (CVE-2026-119641).
2009 HP report says ACL checks fail for multi-principal access
HP Labs argued missing cross-message state lets clickjacking and CSRF bypass ACL decisions on many web applications.
consul-k8s ACL flaw can grant elevated Consul privileges (CVE-2026-110720)
An attacker must already create a ServiceAccount in another namespace and reach the Consul API; active exploitation is not confirmed.
CurveCodec 2: Skeleton-agnostic animation compression with a learned entropy model
CurveCodec 2 compresses skeletal animation to 0.22–0.37× ACL's size with a learned residual entropy model.
CVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin
Missing config:install ACL in Apache Karaf before 4.4.12 allows escalation to admin.
[20260903] - Core - Improper ACL checks for access level webservice endpoints
Joomla fixed CVE-2026-90913, an ACL flaw allowing unauthorized mutations on access-level APIs.
[20260913] - Core - Improper ACL checks for varous webservice edit tasks
Joomla webservice edit tasks skip ACL checks, allowing unauthorized edits; patched in 5.4.9 and 6.1.4.
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
CVE-2026-59739: Apache ZooKeeper missing ACL check in SetWatches reconnect replay lets attackers discover ACL-restricted znode paths.
CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
Apache Storm Client 3.0.0 ACL bypass lets every authenticated principal bypass restrictions when nimbus.groups is set without nimbus.users.
[20260805] - Core - Improper ACL checks for category webservice endpoints
Joomla fixes CVE-2026-72532, an improper ACL check letting unauthorized users create categories via webservice endpoints, in CMS 5.4.8/6.1.3.
[20260804] - Core - Improper ACL checks for custom fields webservice endpoints
Joomla patches CVE-2026-72531, an improper ACL check allowing unauthorized custom-field creation via webservice endpoints, in CMS 5.4.8/6.1.3.
[20260803] - Core - Inconsistent ACL checks for mutating webservice endpoints
Joomla fixes CVE-2026-71574, inconsistent ACL checks letting unauthorized users mutate data via webservice APIs, in CMS 5.4.8/6.1.3.