CVE-2026-86544

HighCVSS 8.1/10Last modified Sep 9, 2026

Description

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-865476.2mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytec CVE-2026-86559.8Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of CVE-2026-865506.5NuBrowser lacks protocol whitelist validation for the S.browser_fallback_url field of intent://, allowing attackers to inject javascript: UR CVE-2026-865513.3The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read CVE-2026-865525.4SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife applic CVE-2026-865538.8SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired Sma CVE-2026-865544.3SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained CVE-2026-865556.2The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. On CVE-2026-865565.3There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability CVE-2026-86566.1Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper CVE-2026-865616.5A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to CVE-2026-865627.8A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlle