CVE-2026-102232

HighCVSS 7.0/10Last modified Oct 13, 2026

Description

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MicrosoftVisual Studio Code>= 1.0.0, < 1.141.1

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 13, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1022337.8Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1022347.4Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over CVE-2026-1022358.8Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-1022389.6Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execCVE-2026-102245.3A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function _handle_webCVE-2026-10224010.0A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the CVE-2026-1022412.7A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backuCVE-2026-1022428.6Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 throuCVE-2026-1022437.4A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-sourceCVE-2026-1022444.3A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/rCVE-2026-1022457.3A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backendCVE-2026-1022476.8A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.p