CVE-2026-44083

CriticalCVSS 9.8/10Last modified Jul 23, 2026

Description

An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges.

We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-440847.5An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability CVE-2026-440879.1Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an CVE-2026-440888.6SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads CVE-2026-440899.4Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability coul CVE-2026-44096.5The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and us CVE-2026-440909.8Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access b CVE-2026-440919.1An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the sy CVE-2026-440929.1An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fe CVE-2026-440937.8A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary CVE-2026-440948.6An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including defa CVE-2026-440957.8A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary comm CVE-2026-440967.8A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full syst