CVE-2026-12384

HighCVSS 8.8/10Last modified Sep 18, 2026

Description

Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse.

This issue affects TECHIN2B Application: from V1.0.7676.13 through 18092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
TECHIN2BTECHIN2B Application>= V1.0.7676.13, <= 18092026

References

Timeline

Published
Sep 18, 2026
Last modified
Sep 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1238404.7In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsCVE-2026-1238417.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archiveCVE-2026-1238427.1In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archivesCVE-2026-1238433.3In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configurationCVE-2026-1238445.3In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositoriesCVE-2026-1238453.3In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projectsCVE-2026-1238464.3In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validationCVE-2026-1238475.3In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completionCVE-2026-1238487.4In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificatesCVE-2026-1238497.0In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File WatchersCVE-2026-123854.3The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via tCVE-2026-1238503.5In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives
CVE-2026-12384: High severity, CVSS 8.8 | Vulnix