CVE-2026-115325

Publié : 22 octobre 2026

Modifié : 22 octobre 2026

Score CVSS

8.3

HIGH

Description détaillée

Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public keys, disable clients, and obtain WireGuard private keys.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Références et Patchs

https://github.com/gravitl/netmaker https://github.com/gravitl/netmaker/blob/v1.7.0/controllers/ext_client.go#L879 https://github.com/gravitl/netmaker/commit/332d8b9bab030ee65e78b9141259e4e0e80ac4b0 https://github.com/gravitl/netmaker/issues/3875 https://github.com/gravitl/netmaker/pull/4153 https://www.vulncheck.com/advisories/netmaker-through-1.7.0-authorization-bypass-via-updateextclient-unscoped-lookup

Dernières Vulnérabilités

CVE-2026-13411

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709

VOIR DÉTAILS

CVE-2026-115334

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

VOIR DÉTAILS

CVE-2026-115333

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

VOIR DÉTAILS