CVE ID :CVE-2026-56765 Published : July 10, 2026, 3:16 p.m. | 1 hour, 16 minutes ago Description :Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission escalation to admin-level shares....

#Sicherheitslücke #Databreach

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-56765 - Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR

VERWANDTEARTIKEL

CVE-2026-57156 - FreeRDP: Integer overflow leading to heap buffer overflow in Orders Delta Points parsing

CVE-2026-57850 - RustDesk before 1.4.9 Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

CVE-2026-55789 - Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers

CVE-2026-55377 - Logto: Account Center MFA management step-up bypass via WebAuthn registration verification

CVE-2026-61459 - MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

CVE-2026-61460 - Krayin CRM Insecure Direct Object Reference via Controllers