CVE-2026-116471

MediumCVSS 4.3/10Last modified Oct 31, 2026

Description

A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-269

Affected software

Vendor	Product	Versions
BKWLD	Decoy	5.11.0; 5.11.1

References

Timeline

Published: Oct 26, 2026
Last modified: Oct 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1164722.7A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of CVE-2026-1164746.5The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoint CVE-2026-1164765.4A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatu CVE-2026-1164774.3A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcPro CVE-2026-1164785.3A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of t CVE-2026-1164794.3A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler CVE-2026-116488.8Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corru CVE-2026-1164807.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of CVE-2026-1164823.5A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is a CVE-2026-1164859.8danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment c CVE-2026-1164864.5Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by expl CVE-2026-1164874.6NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisS