rootpwn

critical · CVSS v3 7.7 · CVSS v4 9.2

CVE-2026-100607

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifi…

Description

Flowise through 3.1.4 resolves SSO and local-password users solely by email without storing provider or subject identifier bindings, allowing attackers to authenticate as any existing user by claiming their email at any configured SSO provider. Attackers can gain complete account access including chatflows, credentials, and API keys by authenticating through a different SSO provider or local password than the victim's original registration method.

Scores

Severity
critical
CVSS v2
7.3
CVSS v3
7.7
CVSS v4
9.2
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.

View analysis

critical

CVE-2026-100575

OpenClaw Slack versions prior to 2026.8.1 do not enforce sender allowlists in multi-person direct messages, allowing unauthorized participants to trigger Slack agents. This flaw lets attackers access tools and data that should be protected by configured policies. The vulnerability is critical and can lead to significant data exposure.

View analysis

critical

CVE-2026-100580

OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the model-facing cron tool: a mixed-case payload kind can pass the agent-facing shell-execution guard and later normalize into a command job. An actor able to steer a tool-enabled agent can therefore create a persistent cron job that executes attacker-selected commands with the privileges of the OpenClaw process user, resulting in access to host files and credentials and impact to scheduled service availability. The issue is limited to cron jobs created or edited through the model-facing cron tool; direct CLI and authorized Gateway scheduling surfaces are trusted operator controls. Fixed in 2026.7.1.

View analysis

critical

CVE-2026-100585

OpenClaw npm package openclaw before 2026.7.1 fails to enforce owner-only authorization for Claude Code permission prompts via the MCP channel bridge. An authorized non‑owner channel sender can approve or deny pending requests, allowing actions to proceed without owner consent. This flaw could enable unauthorized code execution or data access.

View analysis