medium · CVSS v3 6.5 · CVSS v4 5.3 · EPSS 0.00351

CVE-2026-112068

The backend module does not check whether a backend user has access to the requested site. Users with access to the modu…

Description

The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.5
CVSS v4
5.3
EPSS
0.00351

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-86940

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be able to disclose kernel memory.

View analysis

medium

CVE-2026-86953

An out‑of‑bounds write flaw in Apple’s operating systems was patched in version 27. The vulnerability could allow a nearby attacker to trigger a denial‑of‑service by corrupting memory. It affects all current iOS, iPadOS, macOS, tvOS, visionOS, and watchOS releases.

View analysis

medium

CVE-2026-86955

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.

View analysis