CVE-2026-14934

CriticalCVSS 9.4/10Last modified Jul 13, 2026

Description

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover.

This vulnerability was patched on 10 May 2026, and no customer action is needed.

Metrics

CVSS 4.0 9.4/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Jul 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-149353.7A logic vulnerability was found in GStreamer's webrtcbin component. The _check_sdp_crypto() function contains an inverted boolean condition CVE-2026-149365.3The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured CVE-2026-149384.3The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the CVE-2026-149396.8The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, a CVE-2026-149405.3A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a lega CVE-2026-149415.4The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related CVE-2026-149437.5The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict RES CVE-2026-149467.2A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code CVE-2026-149477.2A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the inten CVE-2026-149488.8A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extractin CVE-2026-149496.5A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.CVE-2026-14956.5The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including