{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/trailbase-0.28.2-before-0.35.10/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:trailbase:trailbase:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-119759"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TrailBase (0.28.2 before 0.35.10)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TrailBase"],"content_html":"\u003cp\u003eTrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operations. Attackers can reference another user's or table's file id in a record they own to read the victim's file bytes, trigger permanent deletion of the victim's file, or use a $like filter on the file column to brute-force recover stripped ids character by character.\u003c/p\u003e\n","date_modified":"2026-11-10T02:01:54Z","date_published":"2026-11-10T02:01:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-trailbase-idor/","summary":"TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference (IDOR) vulnerability in std.FileUpload columns that lacks ownership validation.","title":"TrailBase: Insecure direct object reference in std.FileUpload (CVE-2026-119759)","url":"https://feed.craftedsignal.io/briefs/2026-11-trailbase-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - TrailBase (0.28.2 Before 0.35.10)","version":"https://jsonfeed.org/version/1.1"}