CVE-2020-26177

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibited server-side.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-669

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/Exploit, Third Party Advisory
https://www.tangro.de/Product
https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities/Exploit, Third Party Advisory
https://www.tangro.de/Product

Timeline

Published: Dec 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-261785.3In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authentic CVE-2020-26186.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Suppor CVE-2020-261808.8Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with th CVE-2020-261817.8Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a S CVE-2020-261826.5Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remote user with low privi CVE-2020-261836.5Dell EMC NetWorker versions prior to 19.3.0.2 contain an improper authorization vulnerability. Certain remote users with low privileges may CVE-2020-261847.5Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability.CVE-2020-261857.5Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain a Buffer Over-Read Vulnerability.CVE-2020-261866.8Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to CVE-2020-26196.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Suppor CVE-2020-261917.8Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the P CVE-2020-261927.8Dell EMC PowerScale OneFS versions 8.2.0 - 9.1.0 contain a privilege escalation vulnerability. A non-admin user with either ISI_PRIV_LOGIN_C