Vendor
An insecure direct object reference vulnerability in Cube-studio versions through 2026.09.01 allows authenticated users to perform unauthorized administrative actions on notebooks and services via sequential ID manipulation.