CVE-2026-27768

MediumCVSS 6.6/10Last modified Jul 24, 2026

Description

SQL Injection affecting the Access Manager role.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Jul 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-277692.7Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows CVE-2026-27779.8Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, CVE-2026-277706.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277718.2Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private orCVE-2026-277729.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate CVE-2026-277735.3Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277746.7Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before builCVE-2026-277758.8Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maCVE-2026-277768.8IM-LogicDesigner module of intra-mart Accel Platform contains insecure deserialization issue. This can be exploited only when IM-LogicDesignCVE-2026-277776.5Charging station authentication identifiers are publicly accessible via web-based mapping platforms.CVE-2026-277787.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting mCVE-2026-277797.5Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL
CVE-2026-27768: Medium severity, CVSS 6.6 | Vulnix