MLflow Tracking Server missing authorization allows privilege escalation
Authenticated remote attackers can escalate privileges; ZDI scores CVE-2026-118625 at CVSS 6.3.
Stories per day · 30 days
2 RSS
Relatedmlflow3tracking-server3ics2privilege-escalation2access-control1apache1apache-answer1apache-kylin1cisa1cve-2026-636191cve-2026-796331dcm4che1denial-of-service1dicom1hard-coded-key1healthcare1information-disclosure1metadata1
11 stories, newest first · one card per story
Stories tagged #missing-authorization
Moxa AIG-302 ThingsPro Edge through 1.4.0 can leak keys
An unauthenticated adjacent attacker can abuse a hard-coded key; a logged-in user can read the secrets API.
CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
Apache Answer through 2.0.2 let authenticated users modify non-public content they should not access.
CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump
Apache Kylin metadata dump API lacks authorization and path confinement through 5.0.4.
J4Care dcm4che
CISA warns J4Care dcm4chee-arc-light 5.35.1 flaws can delete images and expose patient data.
Meari IoT Cloud Platform OpenAPI Service
Meari IoT cloud OpenAPI flaws let authenticated users reconfigure others' devices and read device credentials.
CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
CVE-2026-91048 lets authenticated Apache Karaf users, including viewers, run jdbc commands and achieve code execution.
CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
Apache Roller 6.1.5 lets authenticated users read, modify, or delete other weblogs via XML-RPC.
CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
Apache DolphinScheduler before 3.4.3 has low-severity missing authorization in Task Group APIs, CVE-2026-57590.
ZDI-26-720: Foxit PDF Reader activeDocs Missing Authorization Information Disclosure Vulnerability
Foxit PDF Reader activeDocs flaw can leak information if a user opens a malicious file.
CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.