CVE-2026-125750

HighCVSS 7.1/10Last modified Nov 14, 2026

Description

Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to read administrator-only secrets because the admin API base guard permits all GET actions. Editors can query options.js for TOTP secrets, push credentials, and cloud storage keys, or user.js for other users' app_key/app_secret to publish posts as administrators via admin/post_push.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
firekylin	Firekylin	<= 2.18.1

References

Timeline

Published: Nov 10, 2026
Last modified: Nov 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1257513.1Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById gRPC handler that fails to appl CVE-2026-1257525.0Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateCouponStatus gRPC handler, whos CVE-2026-1257535.9ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalcula CVE-2026-1257547.1Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class CVE-2026-1257556.5Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at folding whitespace or comments be CVE-2026-1257565.9postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the domain at folding whitespace CVE-2026-1257579.1mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute comm CVE-2026-1257587.4Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge sign-in links CVE-2026-1257597.5Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a cr CVE-2026-125767.5DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.CVE-2026-1257616.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith CVE-2026-1257626.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor