CVE-2026-31016

Publié : 29 juin 2026

Modifié : 29 juin 2026

Score CVSS

6.5

MEDIUM

Description détaillée

Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Références et Patchs

https://github.com/Squidex/squidex https://lgnas.gitbook.io/findings/cve-2026-31016 https://lgnas.gitbook.io/hello/silly-findings/squidex-cms-csrf https://www.youtube.com/watch?v=62ay_jrwUcI https://lgnas.gitbook.io/findings/cve-2026-31016

Dernières Vulnérabilités

CVE-2026-57997

Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, allowing acceptance of HS384 and HS512 tokens alongside HS256. Attackers possessing the jwtSecret can mint tokens with non-standard HMAC variants to bypass algorithm restrictions and weaken authentication controls.

VOIR DÉTAILS

CVE-2026-51221

A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows attackers to cause a Denial of Service (DoS) via supplying a crafted Common Packet Format (CPF) packet.

VOIR DÉTAILS

CVE-2026-34592

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access servers and projects belonging to other teams by specifying their IDs directly. This vulnerability is fixed in 4.0.0-beta.471.

VOIR DÉTAILS