Api-Security

A missing authentication vulnerability in madong-admin-saas version 5.1.4 and earlier allows unauthenticated remote attackers to perform full CRUD operations on tenant management and subscription API endpoints.

An unauthenticated Express middleware vulnerability in @eeacms/volto-chatbot allows remote attackers to proxy requests to the Danswer API using the server’s own privileged service credentials.

An authorization bypass in the Kubeflow Pipelines API server allows unauthenticated or unauthorized users to read sensitive logs by manipulating the GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler.

n8n workflow nodes for Microsoft Outlook and SharePoint contain an OData $filter injection vulnerability allowing unauthorized data access and modification.

An authorization bypass vulnerability in yudao-cloud through 2026.09 allows authenticated users to circumvent row-level data scope restrictions by injecting a header, leading to unauthorized access to cross-departmental and cross-user records.

PraisonAI versions 4.5.2 to before 4.6.59 contain an authorization bypass vulnerability in Discord, Slack, and Telegram approval backends, allowing unauthorized users to approve high-risk multi-agent tool calls.

EverShop versions prior to 2.2.1 contain a missing authorization vulnerability in the customer address API, allowing unauthenticated attackers to manipulate other users' shipping addresses if the customer and address UUIDs are known.

Obot versions prior to 0.26.0 contain an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to harvest API keys by manipulating token requests.

Splunk SOAR versions prior to 8.7.0 are vulnerable to an authentication bypass where a user with restricted permissions can use the REST API to infer administrative tokens via crafted query filters.

Authenticated users with the 'Scoped HA Settings Sync' permission can exploit CVE-2026-113779 in pfSense-pkg-RESTAPI versions prior to 2.9.0 to modify API configuration secrets and achieve full administrative privilege escalation.

Cognition versions prior to 0.13.0 are vulnerable to unauthenticated remote code execution due to insecure API authentication defaults and the use of a local execution sandbox.

An authorization bypass vulnerability in Camunda Platform allows authenticated attackers to access, download, or delete task comments and attachments by exploiting missing authorization checks in specific engine-rest sub-resources.

OtterMind Nubase versions through 0.1.4 are vulnerable to an authentication bypass in the storage API, allowing unauthenticated attackers to read and delete private objects.

An IDOR vulnerability in Shaiwz data-platform-open allows authenticated users to access, enumerate, and modify foreign workspace datasources by manipulating numeric IDs in API requests.

APIPark versions through 1.9.7-beta are vulnerable to an authorization bypass allowing authenticated team managers to manipulate team IDs to access, modify, or delete resources belonging to other teams.

A missing Sa-Token interceptor in LangChat allows unauthenticated remote attackers to access sensitive REST controllers, leading to full system compromise and credential exfiltration.

An unauthenticated authentication bypass vulnerability (CVE-2026-111692) in DataBuff ai-apm-web allows attackers to forge administrative session tokens using a hardcoded HMAC secret.

An authorization bypass vulnerability in cool-admin-midway through version 8.0.0 allows department-restricted administrators to perform unauthorized administrative actions on users outside their assigned scope.

Shaark versions 1.2.13 through 1.2.44 contain a missing authorization vulnerability in multiple API controllers, allowing authenticated non-admin users to modify or delete content belonging to other users.

Open WebUI versions 0.7.0 through 0.11.3 contain a cross-origin message handling vulnerability that allows unauthenticated websites to steal a user's session JWT via a crafted postMessage payload.

jshERP versions through 3.6 contain a missing authorization vulnerability in the UserController updateUser handler, allowing authenticated users to escalate privileges or modify other users' roles.

An information disclosure vulnerability in the OpenAgents Workspace backend allows unauthenticated attackers to exfiltrate workspace metadata and API keys via the /v1/workspaces endpoint.

An improper implementation of the set_user_permission API endpoint in pyLoad allows users to retain elevated permissions for up to 31 days after an administrator has explicitly revoked their access.

AstronRPA versions 1.1.6 and earlier contain a cross-site scripting vulnerability in the smart-component chat that allows remote attackers to trigger arbitrary OS command execution by injecting malicious prompt content.

An unauthenticated information disclosure vulnerability in the FileRise Pro portal endpoint allows attackers to retrieve sensitive configuration data, including internal storage paths and client contact information.

A vulnerability in Ghost versions 5.2.0 through 6.61.9 allows unauthenticated remote attackers to manipulate Stripe Checkout flows to modify member records and inject malicious content into newsletters.

Tacomall 1.0.0 is vulnerable to an improper authorization flaw in the OrgStaffServiceImpl.add function, allowing remote attackers to manipulate isAdmin or jobId arguments to achieve unauthorized access.

AzuraCast versions prior to 0.23.8 are vulnerable to a DQL injection flaw in the sortOrder API parameter, allowing attackers to exfiltrate sensitive database contents.

SiYuan versions prior to v3.8.4 are vulnerable to a path traversal attack via the exportBrowserHTML endpoint, allowing authenticated administrators to overwrite arbitrary index.html files.

Flowise versions up to 3.1.4 are vulnerable to unauthorized access due to missing route-level RBAC checks, allowing low-privileged API keys to read and delete sensitive chat history.

Froxlor versions through 2.3.10 are vulnerable to arbitrary file deletion where authenticated users can plant symlinks to trigger recursive deletion by a root-privileged cron task, leading to potential data destruction.

An unauthenticated SQL injection vulnerability in ReactPress allows attackers to exfiltrate database contents via malicious HTTP query parameter keys in API requests.

9router versions <= 0.4.80 contain an authentication bypass vulnerability where traffic from a local reverse proxy is incorrectly trusted as local loopback, allowing unauthenticated access to restricted /v1/ APIs.

The mcp-atlassian package contains an authentication bypass vulnerability (CVE-2026-77244) that allows unauthenticated network-adjacent attackers to execute tools using the operator's Jira and Confluence credentials.

The Semantic MediaWiki smwtask API module fails to enforce authorization, enabling unauthenticated remote attackers to perform sensitive information disclosure, queue administrative maintenance jobs, and manipulate stored semantic data.

Convoy versions up to and including 26.6.2 contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to leak plaintext message broker credentials from other tenants.

Umbraco CMS contains an authorization bypass vulnerability (CVE-2026-69197) in the Delivery API where protected content is leaked when referenced by an unprotected node through expansion parameters.

SigNoz versions 0.88.0 through 0.141.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to query sensitive trace analytics via the trace-funnel endpoint.

Flowise versions prior to 3.1.4 contain an authorization flaw in the openai-realtime endpoint, enabling authenticated users to access and execute tools in unauthorized workspaces via cross-workspace ID manipulation.

An authentication bypass vulnerability in lamp-cloud versions 5.10.0 and earlier allows unauthenticated attackers to exfiltrate sensitive JVM system properties via insecurely whitelisted API endpoints.

A command injection vulnerability in HexStrike AI allows remote unauthenticated attackers to execute arbitrary OS commands via the Execute Endpoint.

CAPEv2 versions up to commit 471ee4b contain an IDOR vulnerability allowing authenticated users to access and delete arbitrary analysis tasks.

A publicly disclosed vulnerability in the WARP-Clash-API authorized function allows remote unauthenticated access by manipulating the SECRET_KEY argument.

An authorization vulnerability in the public.sso_providers table of Capgo allows attackers with an ordinary API key to bypass domain verification and enforce arbitrary SSO settings, leading to authentication disruption.

A vulnerability in the Bruno API client allows a remote, unauthenticated attacker to disclose sensitive information, potentially leading to unauthorized data exposure.

An authorization bypass vulnerability in Helicone's VaultManager allows authenticated users to exfiltrate plaintext provider API keys from other organizations due to missing access control checks.

ReadToMyShoe version 0.2.0 is vulnerable to information disclosure (CVE-2023-27587) where sensitive Google Cloud API keys are exposed within error messages during failed Text-to-Speech (TTS) requests.

Authenticated users without file upload permissions can exploit a missing authorization check in Kirby CMS to exhaust server storage via incomplete chunked file uploads, leading to denial-of-service.

Portkey AI Gateway through 1.15.2 is vulnerable to SSRF via the /v1/proxy/* route, allowing unauthenticated attackers to query internal services and exfiltrate API keys.

Gophish versions through 0.12.1 contain a vulnerability in the API authentication middleware that fails to enforce account lockout and password change requirements, allowing attackers with valid API keys to maintain persistent unauthorized access.

Redpanda versions 26.2.2 and earlier insecurely expose the Admin API on port 9644 by default without authentication enabled, allowing remote attackers to perform superuser actions.

An authentication bypass in 9router 0.4.80 and earlier allows remote attackers to spoof the 'Host' header, gaining unauthorized access to API proxy endpoints, enabling quota theft via AI relay and server-side request forgery (SSRF).

The FileMemory component in praisonaiagents versions 1.6.52 and earlier fails to sanitize user-supplied identifiers, enabling path traversal attacks that result in arbitrary JSON file creation or overwriting.

Label Studio contains an insecure direct object reference (IDOR) vulnerability, CVE-2026-76073, allowing authenticated users to read, modify, or delete annotations across organizational boundaries by enumerating sequential identifiers.

An access control vulnerability in docker-socket-proxy (CVE-2026-78122) allows unauthenticated adjacent attackers to bypass restrictions and exfiltrate container filesystems via unauthorized API requests.

SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to retrieve decrypted content from encrypted notebooks.

CentreStack versions prior to 17.2 are vulnerable to an authentication bypass that allows unauthenticated attackers to manipulate account settings and enumerate system data via exposed API endpoints.

An improper permission check in Zitadel's user API allows authenticated users to retrieve verification codes for arbitrary contact information, facilitating unauthorized verification of email addresses and phone numbers.

The AMMOS Instrument Toolkit (AIT) DSN Interface prior to version 2.2.2 contains a missing authentication vulnerability in the Space Link Extension interface manager, allowing unauthenticated attackers to invoke sensitive API routes.

The `swagger-typescript-api` tool is vulnerable to authorization token exfiltration. When a developer provides an `--authorizationToken` to fetch an OpenAPI specification, the tool attaches this token to all subsequent HTTP requests made while resolving external `$ref` URLs within the spec. Critically, it lacks same-origin checks, allowing a malicious OpenAPI spec containing a `$ref` to an attacker-controlled URL to cause the authorization token (e.g., GitHub PAT, OAuth bearer) to be sent verbatim to the attacker. This credential disclosure provides an attacker with the same scope of access as the stolen token, affecting development environments, CI/CD pipelines, and multi-tenant SaaS platforms.

A critical broken object-level authorization vulnerability in SuperPlane's CanvasService gRPC handlers, tracked as CVE-2026-57510, allows authenticated users with viewer-level access to bypass organization scoping and access resources across tenant boundaries, leading to data collection and system impact.

An improper privilege escalation vulnerability (CVE-2026-63727) exists in Anchore Enterprise versions 5.11.0 to 5.27.1 and 6.0.0, specifically within the user management API, allowing an authenticated attacker to issue a crafted API call to modify user permissions and gain elevated access to resources and operations, such as granting write access to a read-only user, with fixes available in versions 5.27.2 and 6.0.1.

An authentication bypass vulnerability (CVE-2026-59822) exists in LiteLLM's MCP Streamable HTTP endpoint, affecting versions prior to 1.84.0, allowing an unauthenticated attacker to exploit a fallback path that replaces failed key validation with an empty authentication object, leading to the establishment of an authenticated MCP session using arbitrary Bearer tokens, enabling access to configured MCP tools and connected services.

A remote attacker can gain full administrative access to IBM Langflow OSS versions 1.0.0 through 1.10.0 by exploiting an improper authentication vulnerability. The /api/v1/login/auto_login endpoint, when the default AUTO_LOGIN configuration is enabled, issues long-lived superuser bearer tokens without requiring authentication. This allows an unauthenticated network attacker to obtain these tokens and achieve superuser privileges. Additionally, permissive Cross-Origin Resource Sharing (CORS) settings could expose these tokens to unintended origins, exacerbating the risk.

An autonomous Red Agent discovered a critical business-logic flaw in a B2B platform's data API, allowing free-tier users to bypass the paywall and access premium, unmasked contact data for over 600 million profiles by adding a boolean flag, `unmaskContactData: true`, to standard API requests, due to the backend accepting client-controlled parameters without verifying user entitlements.

An unauthenticated vulnerability exists in netlicensing-mcp (version 0.1.5 and earlier) when operating in HTTP transport mode, where the ApiKeyMiddleware fails to enforce authentication for requests lacking a client API key, causing the application to fall back to the server's NETLICENSING_API_KEY environment variable for upstream calls, allowing an unauthenticated network attacker to invoke any MCP tool under the server operator's identity and account quota.

An information disclosure vulnerability (CVE-2026-56303) in Capgo versions before 12.128.2 allows unauthenticated attackers to retrieve sensitive API key metadata, including user ID, mode, organization scoping, and expiration details, by exploiting a misconfigured PostgreSQL function via the `/rest/v1/rpc/find_apikey_by_value` endpoint.

A critical missing authentication vulnerability (CVE-2026-13019) in Esri Portal for ArcGIS versions 12.1 and earlier allows a remote, unauthenticated attacker to access unprotected critical APIs, impacting deployments on Windows, Linux, and Kubernetes environments.

Multiple critical unauthenticated API vulnerabilities in 9Router versions up to 0.4.41 allow an attacker to perform full CRUD operations on provider connections, leak plaintext API keys, and access sensitive conversation history, posing risks of data exfiltration and denial of service.

An unauthenticated remote attacker can leverage a missing authorization vulnerability (CWE-862) in the Pipecat development runner's `/ws` WebSocket endpoint to supply a crafted `callSid` in a handshake message, compelling the server to use its configured Twilio, Telnyx, or Plivo credentials to issue authenticated API requests that terminate active calls, resulting in denial of service and credential abuse.

Flowise versions 3.0.13 and earlier expose sensitive information, including credential IDs, plaintext API keys, and passwords, through the `GET /api/v1/public-chatflows/:id` endpoint, leading to account compromise and revealing internal architecture details.