CVE-2026-2697

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Feb 23, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-269726.7OpenClaw is a personal AI assistant. In versions 2026.1.12 through 2026.2.12, OpenClaw browser download helpers accepted an unsanitized outpCVE-2026-269734.3Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object ReCVE-2026-269749.8Slyde is a program that creates animated presentations from XML. In versions 0.0.4 and below, Node.js automatically imports **/*.plugin.{js,CVE-2026-269758.8Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and belowCVE-2026-269775.3Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthoCVE-2026-269788.6FreePBX is an open source IP PBX. In versions below 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore opeCVE-2026-269792.7Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive aCVE-2026-26986.5An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope.CVE-2026-269807.5Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads fromCVE-2026-269816.5OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indusCVE-2026-269828.8Ghostty is a cross-platform terminal emulator. Ghostty allows control characters such as 0x03 (Ctrl+C) in pasted and dropped text. These canCVE-2026-269835.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, the
CVE-2026-2697: High severity, CVSS 8.8 | Vulnix