CVE-2026-69104

HighCVSS 7.6/10Last modified Aug 28, 2026

Description

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Aug 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-691058.1An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integ CVE-2026-691068.8A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted con CVE-2026-691075.9An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.CVE-2026-691086.0A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local CVE-2026-691097.5A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path CVE-2026-69119.8Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative CVE-2026-691109.1OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary CVE-2026-691117.5Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate servic CVE-2026-691127.1Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch CVE-2026-691135.4Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post co CVE-2026-691146.5Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message h CVE-2026-691156.5OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API e