tag
Authorization-Bypass
Apache Polaris — Cross-Tenant Credential Vending Before Location Validation in Iceberg REST Register (CVE-2026-64640)
CVE-2026-64640 is a confused-deputy vulnerability in Apache Polaris: the Iceberg REST register endpoints mint cloud storage credentials for a caller-supplied path and read that path server-side before checking it against the catalog's allowedLocations. A…
gRPC-Go RBAC Authorization Bypass via Missing Leading Slash in `:path` (CVE-2026-33186)
gRPC-Go's authz package implements RBAC using deny/allow rules matched against the HTTP/2 :path pseudo-header (e.g. /Service/Method). The HTTP/2 server transport stores the raw, pre-normalization :path value in context, but the routing layer (handleStream)…
RustDesk Relay Session Downgrade and FileTransfer Authorization Scope Bypass
This entry covers two related but distinct RustDesk findings. First, RustDesk's client can fail open on secure-session setup: when the signed peer key material from the rendezvous/relay path is missing or invalid, the client requests a non-secure relay and…
Nextcloud Federated Share OCM Bearer Token Scope Escalation to Sender WebDAV Access
When a Nextcloud user creates a normal federated file share, the sender instance generates a permanent authentication token that is also stored as the federated share's secret; that token is created without an explicit narrow scope, so it defaults to full…
MyBB 1.8.40 Limited Admin CP User-Manager to Full Administrator Privilege Escalation
A non-super Admin CP account that has only the user-management permission (user-users = 1) can use the standard Admin CP "add user" form to create a brand-new account directly in the Administrator group (gid=4), because the underlying user data handler's…
Discourse Scoped API Key Pre-Route Authorization Bypass
Discourse's overload-protection middleware authenticates API requests before Rails routing has resolved the actual HTTP verb, and its scoped API key matcher (lib/routematcher.rb) calls Rails.application.routes.recognizepath(request.pathinfo) without passing…
Next.js i18n Middleware Bypass (CVE-2026-44573)
CVE-2026-44573 is an authorization bypass in Next.js Pages Router applications that use the i18n configuration. The middleware matcher regex's i18n branch does not correctly cover all locale-prefix permutations of next/data/<buildId>/<page>.json URLs. As a…
Next.js App Router Segment-Prefetch Middleware Bypass (CVE-2026-44575)
CVE-2026-44575 is an authorization bypass in Next.js App Router middleware matching. Vulnerable versions compile middleware matchers for canonical paths and legacy Pages Router data routes, but omit the App Router transport variants used for .rsc and…