rootpwn

high · CVSS v3 6.5

CVE-2026-77169

A authorization bypass vulnerability exists in the team folders app when used alongside the workspace app. This flaw allows API-only delegat

Overview

A authorization bypass vulnerability exists in the team folders app when used alongside the workspace app. This flaw allows API-only delegated administrators to circumvent folder-level access restrictions. It matters because it undermines multi-tenant isolation and administrative privilege boundaries.

Description

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.

Impact

This issue impacts the confidentiality and integrity of data stored within restricted team folders. API-only delegated administrators can gain unauthorized access to folders outside their assigned advanced permissions scope. The blast radius is limited to organizations utilizing both apps concurrently with delegated REST administration.

Remediation

Apply the latest security updates provided by the vendor for both the team folders and workspace apps. Audit existing delegated administrator accounts and their API access permissions. Review access control lists and restrict REST API capabilities until patches are fully deployed.

Risk context

The vulnerability is rated as high severity with a CVSS v3 score of 6.5. EPSS data is currently not available. Organizations using the combination of team folders and workspace apps via API should prioritize remediation to maintain compliance and data privacy.

Affected products

  • team folders app
  • workspace app

Scores

Severity
high
CVSS v2
7.7
CVSS v3
6.5
CVSS v4
—
EPSS
—

authorization-bypass api-security access-control delegated-admin high-severity

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-93313

An integer overflow vulnerability exists in Freedesktop Poppler version 26.07.0 within the JBIG2Stream::readCodeTableSeg function in poppler/JBIG2Stream.cc. This flaw can be triggered remotely via malicious PDF files containing crafted JBIG2 streams. It matters because successful exploitation could lead to application crashes or potentially arbitrary code execution in environments processing untrusted documents.

View analysis

high

CVE-2026-93314

Poppler 26.07.0 contains a remote integer overflow in FoFiTrueType::mapCodeToGID triggered by a crafted segCnt value, potentially leading to memory corruption or crashes. The flaw can be exploited over the network without local access. It is publicly disclosed and may be used by attackers.

View analysis