CVE-2026-72741

HighCVSS 8.1/10Last modified Oct 24, 2026

Description

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
goodrain	rainbond	<= 6.9.7

References

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-727428.6DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence ov CVE-2026-727435.4SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that CVE-2026-727446.2Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's CVE-2026-727477.2AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that pe CVE-2026-727489.1AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attacke CVE-2026-727496.5n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output CVE-2026-727508.8n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interp CVE-2026-727515.1CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and CVE-2026-727526.5Routinator runs out of memory when the JSON output is requested many times concurrently. This condition can be triggered maliciously by an a CVE-2026-727538.2When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed, potentially leading to CVE-2026-727547.5When Routinator encounters a CRL with many entries, it may hang or run out of memory. If Routinator encounters a CRL file with the wrong enc CVE-2026-727553.8Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificat