Every story tagged Authorization Bypass, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
5 stories · open in the command center
A critical authorization bypass vulnerability (CVE-2026-69262) in Flowise allows users with limited permissions to delete unintended resource types, enabling privilege escalation where users with `agentflows:delete` permissions can remove chatflows and vice versa, with a CVSS score of 7.1 indicating high severity. This flaw in the DELETE API endpoint poses significant risks to organizations deploying Flowise by undermining role-based access controls and potentially leading to data loss or service disruption. IT teams must urgently assess their Flowise deployments and implement immediate patching or access controls to prevent unauthorized resource deletion.
CVE-2026-67329 is a critical authorization bypass vulnerability in @better-auth/stripe that allows authenticated users with access to multiple organizations to illegally manage subscriptions and access billing data (payment methods, invoices) for organizations they should not control, with a CVSS score of 7.1. This vulnerability affects versions 1.4.11-1.6.20 and 1.7.0-beta.0-1.7.0-beta.9, posing significant risks to multi-tenant SaaS platforms and organizations using Stripe for subscription management. IT leaders must prioritize patching and conduct an immediate audit of multi-organization access controls within their authentication and billing systems.
CVE-2026-67341 is a critical authorization bypass vulnerability (CVSS 9.8) in ArcadeDB versions before 26.7.2 that allows attackers with database access to execute arbitrary JavaScript code by circumventing administrative scripting restrictions. This represents a severe data integrity and confidentiality risk for any organization running vulnerable ArcadeDB instances, potentially enabling unauthorized code execution and complete system compromise. IT organizations must immediately audit their ArcadeDB deployments and apply the 26.7.2 patch to prevent privilege escalation attacks.
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.
A critical authorization bypass vulnerability (CVSS 9.8) has been identified in ArcadeDB versions prior to 26.7.2, allowing attackers to execute arbitrary SQL functions and potentially gain unauthorized access to sensitive data and system resources. This vulnerability poses significant risk to organizations using ArcadeDB in production environments, as it could be exploited without authentication to compromise database integrity and confidentiality. IT organizations must prioritize immediate patching and conduct security assessments to identify exposed ArcadeDB instances.