ZCyberNews
中文

#authorization-bypass

7 articles

Across technology, cloud infrastructure, consumer IoT, database management, and mobile network operators, seven authorization-bypass articles published between 2026-05-08 and 2026-09-11 examine flaws that let attackers sidestep access controls. CVE-2026-7813 carries a CVSS score of 9.9, followed by CVE-2026-42880 at 9.6, CVE-2026-44574 and CVE-2026-44575 at 8.1 each, and CVE-2026-33357 at 7.5. The severity mix comprises one medium, three high, and two critical issues. Coverage spans the technology sector alongside cloud infrastructure, consumer IoT, database management, and mobile network operators.

Screenshot-style graphic of the CISA Known Exploited Vulnerabilities catalog entry for CVE-2026-42016 in JFrog Artifactory.
Vulnerabilities

CISA Flags CVE-2026-42016 in JFrog Artifactory as Exploited

CISA added CVE-2026-42016, a JFrog Artifactory token-scope authorization flaw enabling privilege escalation, to its KEV catalog with a Sept 25 patch deadline.

CVE-2026-42016
3 min read
Open5GS AMF Flaw CVE-2026-8743 Enables Remote Authorization BypassMEDIUM
Vulnerabilities

Open5GS AMF Flaw CVE-2026-8743 Enables Remote Authorization Bypass

CVE-2026-8743 (CVSS 6.5) in Open5GS up to 2.7.6 lets remote attackers bypass authorization via the AMF/MME ranuefindbyamfuengap_id function. Exploit public.

CVE-2026-8743
3 min read
Next.js Patches Two Authorization Bypass Flaws in App RouterHIGH
Vulnerabilities

Next.js Patches Two Authorization Bypass Flaws in App Router

CVE-2026-44574 (CVSS 8.1) and CVE-2026-44575 (CVSS 7.5) let attackers bypass middleware-based auth checks in Next.js App Router via crafted .rsc URLs and query parameter...

CVE-2026-44574CVE-2026-44575
3 min read
Meari SDK Flaw CVE-2026-33357 Leaks WAN IP of IoT CamerasHIGH
Vulnerabilities

Meari SDK Flaw CVE-2026-33357 Leaks WAN IP of IoT Cameras

CVE-2026-33357 (CVSS 7.5) in Meari SDK lets attackers retrieve WAN IPs for any device via CloudEdge, Arenti, and white-label apps — no authentication required.

CVE-2026-33357
3 min read
CVE-2026-7813: pgAdmin 4 Server Mode Flaw Lets Users Access PrivateCRITICAL
Vulnerabilities

CVE-2026-7813: pgAdmin 4 Server Mode Flaw Lets Users Access Private

CVE-2026-7813 (CVSS 9.9) in pgAdmin 4 server mode lets authenticated users access private servers, groups, and debugger data from other users by guessing object IDs.

CVE-2026-7813
3 min read
Argo CD Flaw CVE-2026-42880 Leaks Kubernetes Secrets via Dry-RunCRITICAL
Vulnerabilities

Argo CD Flaw CVE-2026-42880 Leaks Kubernetes Secrets via Dry-Run

CVE-2026-42880 (CVSS 9.6) in Argo CD lets read-only attackers extract plaintext Kubernetes Secrets via ServerSideDiff endpoint using Server-Side Apply dry-run.

CVE-2026-42880
3 min read
CVE-2026-7891: DIVD VerySecureApp Leaks All Records to Anonymous UsersHIGH
Vulnerabilities

CVE-2026-7891: DIVD VerySecureApp Leaks All Records to Anonymous Users

CVE-2026-7891 in DIVD's VerySecureApp (Mendix Studio Pro 11.8.0 Beta) exposes all stored records to anonymous users via an authorization misconfiguration — no access rights...

CVE-2026-7891
3 min read

Stay Updated

Get the latest cybersecurity news delivered to your inbox.