CVE-2026-6008

MediumCVSS 6.8/10Last modified Oct 26, 2026

Description

Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co. DijiDemi allows Privilege Abuse.

This issue affects DijiDemi: from v4.5.12.1 before v4.5.13.0.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd. Co.DijiDemi>= v4.5.12.1, < v4.5.13.0

References

Timeline

Published
May 14, 2026
Last modified
Oct 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-600807.3Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. ACVE-2026-600817.5DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocatCVE-2026-600829.1DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but thCVE-2026-600834.9SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to sensitive workspaceCVE-2026-600848.7SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unCVE-2026-600857.5PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in the default Subprocess Sandbox backend where blocked_commandCVE-2026-600865.3PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection defense only blocks threats classified CVE-2026-600876.1PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reuse initial approvals for subsequent callsCVE-2026-600885.5PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the worCVE-2026-600895.5PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when construcCVE-2026-60098.7Java Deserialisation Vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE), potentially allowing code execution oCVE-2026-600909.8PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_coll
CVE-2026-6008: Medium severity, CVSS 6.8 | Vulnix