CVE-2026-92801

HighCVSS 8.8/10Last modified Sep 23, 2026

Description

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handler.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-928024.3kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boaCVE-2026-928035.3LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated fiCVE-2026-928047.1Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templaCVE-2026-928059.8UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controCVE-2026-928068.1phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers canCVE-2026-928078.8The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including,CVE-2026-9280810.0A server-side request forgery (SSRF) vulnerability exists in the UnifiedLogin service of Altium Enterprise Server. An unauthenticated networCVE-2026-928094.3PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. AuthenCVE-2026-92816.4The Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits plugin for WordPress is vulnerable to StCVE-2026-928104.3PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated cCVE-2026-928116.5browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticaCVE-2026-928129.8Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix compariso