CVE-2026-32991

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-329928.2SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and captureCVE-2026-329938.3Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arCVE-2026-329945.3The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allowsCVE-2026-329957.5The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 CVE-2026-329967.3This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.CVE-2026-329978.6A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & RepCVE-2026-329989.4This vulnerability in Veeam Service Provider Console allows for remote code execution.CVE-2026-329999.0Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute CVE-2026-33009.8The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and includinCVE-2026-330009.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-330018.8Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,CVE-2026-330027.5Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t
CVE-2026-32991: High severity, CVSS 7.1 | Vulnix