rootpwn

low · CVSS v3 3.1

CVE-2026-68493

An authorization bypass vulnerability exists in the circle membership retrieval functionality. A malicious authenticated user must guess a c

Overview

An authorization bypass vulnerability exists in the circle membership retrieval functionality. A malicious authenticated user must guess a complex 62^15 unique identifier to successfully access membership lists for unauthorized circles. This flaw matters because it exposes membership data to users who lack the appropriate permissions, violating the principle of least privilege.

Description

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

Impact

The impact is strictly limited to the Confidentiality pillar of the CIA triad, resulting in unauthorized disclosure of circle membership information. The integrity and availability of the system remain unaffected. Only authenticated users with significant cryptographic guessing capability or prior knowledge of the identifier are impacted. Overall business risk is low due to the extreme complexity required to guess the unique identifier.

Remediation

Apply the latest security updates provided by the vendor as soon as they become available. Implement robust server-side access control checks to verify that the requesting user is a legitimate member of the requested circle before returning membership data. Audit authentication and authorization logic around unique identifier lookups to ensure proper enforcement of access policies.

Risk context

This vulnerability carries a low severity rating with a CVSS v3 score of 3.1. EPSS data is not present. Due to the astronomical complexity required to guess the 62^15 unique identifier, the practical exploitability in a real-world scenario is minimal, but defense-in-depth authorization checks should still be applied.

Affected products

  • RootPwn Platform
  • Circle Management Service

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.1
CVSS v4
—
EPSS
—

authorization-bypass access-control low-severity information-disclosure defensive-analysis

← All CVEs

Related CVEs

low

CVE-2026-91017

The Robokassa payment gateway plugin for WooCommerce prior to version 1.8.9 fails to validate incoming payment notifications when the non-default deferred-payment feature is enabled. This flaw allows unauthenticated remote actors to forge payment notifications, altering arbitrary WooCommerce order statuses without completing a valid transaction. It matters because it can lead to financial and fulfillment discrepancies if exploited.

View analysis

low

CVE-2026-20071

A vulnerability in the SSID bring-your-own-device (BYOD) onboarding workflow of Cisco Identity Services Engine (ISE) allows an unauthenticated, adjacent attacker to hijack an active onboarding session. The flaw results from insufficient authentication checks during the device onboarding phase. Exploitation enables the attacker to gain unauthorized access to protected 802.1X enterprise networks.

View analysis

low

CVE-2026-73442

On Arista EOS switches with VRRP enabled, the peer device’s VRRP authentication keys are written to the switch’s trace logs in cleartext. An authenticated user with sufficient privileges can read these logs and obtain the credentials without needing network access to the VRRP segment.

View analysis

low

CVE-2026-86071

Junrar prior to version 7.6.1 contains a path traversal vulnerability in the LocalFolderExtractor component. Crafted archive entries can cause intermediate directory creation outside the intended extraction root. This occurs because intermediate path segments are created using unchecked mkdir calls rather than validated canonical paths.

View analysis