CVE-2026-96451

HighCVSS 8.8/10Last modified Oct 6, 2026

Description

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-964548.2Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream templ CVE-2026-964558.8The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daem CVE-2026-964566.3The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not CVE-2026-96466.1A reflected cross-site scripting issue exists in URL handling.CVE-2026-964617.5Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-96489.1The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subjec CVE-2026-96507.5CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when u CVE-2026-96514.4CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and CVE-2026-965127.8A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing CVE-2026-965137.3A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php CVE-2026-965147.3A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the compone CVE-2026-965158.6This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnosti