high · CVSS v3 6.5 · CVSS v4 7.1 · EPSS 0.00396

CVE-2026-112064

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and u…

Description

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

Scores

Severity
high
CVSS v2
4
CVSS v3
6.5
CVSS v4
7.1
EPSS
0.00396

← All CVEs

Related CVEs

high

CVE-2026-86949

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.

View analysis

high

CVE-2026-86961

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.

View analysis

high

CVE-2026-86977

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages.

View analysis

high

CVE-2026-102438

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.

View analysis