CVE-2026-87876

Publié : 9 septembre 2026

Modifié : 9 septembre 2026

Score CVSS

LOW

Description détaillée

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Références et Patchs

https://access.redhat.com/security/cve/CVE-2026-87876 https://bugzilla.redhat.com/show_bug.cgi?id=2530991 https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2 https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2

Dernières Vulnérabilités

CVE-2026-79323

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.

VOIR DÉTAILS

CVE-2026-79322

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view.

VOIR DÉTAILS

CVE-2026-61907

An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

VOIR DÉTAILS