medium · CVSS v3 6.5 · CVSS v4 5.3 · EPSS 0.00351

CVE-2026-112065

The routes that provide consent history and statistics data did not check whether the backend user had access to the mod…

Description

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

Scores

Severity
medium
CVSS v2
4
CVSS v3
6.5
CVSS v4
5.3
EPSS
0.00351

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-86940

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory.

View analysis

medium

CVE-2026-86953

An out‑of‑bounds write flaw in Apple’s operating systems was patched in version 27. The vulnerability could allow a nearby attacker to trigger a denial‑of‑service by corrupting memory. It affects all current iOS, iPadOS, macOS, tvOS, visionOS, and watchOS releases.

View analysis

medium

CVE-2026-86955

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.

View analysis