CVE-2026-71458

MediumCVSS 5.0/10Last modified Sep 24, 2026

Description

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. Differential "Not found." vs "No <Model> matches..." reveals whether a named resource (org, credential, inventory, host) exists anywhere on the platform. Enables cross-tenant internal hostname enumeration.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-714595.0JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through CVE-2026-71467.3A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by t CVE-2026-714604.3/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sk CVE-2026-714614.3HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers CVE-2026-714624.1StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 resp CVE-2026-714632.7Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) CVE-2026-714643.1LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/Job CVE-2026-714653.1RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(CVE-2026-714677.5A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a reque CVE-2026-714685.3A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bear CVE-2026-714697.5A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each u CVE-2026-71477.3A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file ser