rootpwn

medium · CVSS v3 4.3

CVE-2026-91788

CVE-2026-91788 is a medium severity vulnerability in a web application that allows an attacker to retrieve full document objects via the app

Overview

CVE-2026-91788 is a medium severity vulnerability in a web application that allows an attacker to retrieve full document objects via the app.activeDocs JavaScript API due to missing attribute authorization checks. The flaw can lead to unintended disclosure of sensitive information from open documents. It affects the application’s client-side code that processes JavaScript actions.

Description

Addressed a potential issue where the application could be exposed to an Exposure of Resource to Wrong Sphere vulnerability when handling certain JavaScript actions, which attackers could exploit to disclose information. This occurs as the application fails to perform proper attribute authorization checks when implementing the “app.activeDocs” JavaScript API and allows it to return full Doc objects for every open document within the same process.

Impact

Confidentiality: potential disclosure of document contents. Integrity: not directly affected. Availability: not impacted. Defenders: application developers and security teams must ensure proper authorization checks for JavaScript APIs.

Remediation

Apply the vendor’s patch that adds proper attribute authorization checks to the app.activeDocs API. If a patch is unavailable, restrict or disable the app.activeDocs API for untrusted users, enforce role‑based access control, and validate attributes before returning document objects. Monitor logs for unauthorized API usage.

Risk context

Medium severity CVSS score of 4.3 indicates moderate risk; defenders should prioritize patching or mitigation to prevent potential data disclosure.

Affected products

  • VendorX WebApp

Scores

Severity
medium
CVSS v2
4.3
CVSS v3
4.3
CVSS v4
—
EPSS
—

JavaScript Authorization Information Disclosure WebApp Medium CVE-2026-91788

← All CVEs

Related CVEs

medium

CVE-2026-92928

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

View analysis

medium

CVE-2026-92929

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

View analysis

medium

CVE-2026-92930

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and use it to reset the administrator password. The underlying design has been present since at least firmware 2.2.3.4. Upgrade to version 3.5.4.

View analysis

medium

CVE-2026-95829

A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue.

View analysis