CVE-2026-109195

Quay: repository auto-prune policy uuid idor in quay api

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping when retrieving policy details by repository name and policy identifier. To exploit the vulnerability, the attacker must manage a repository sharing the target's name and know the target policy's unique identifier.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Quay 3 Quay

CVE-2026-109167

TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential theme id with their own formKey, replacing its colours and image URLs and removing the victim's theme.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tduckcloud

Products

Tduck-survey-form

CVE-2026-108705

CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108700

1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108692

1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

1panel-dev Fit2cloud

Products

Cordyscrm Cordys Crm

CVE-2026-108680

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, and template parameters to deliver messages appearing to come from admin or system accounts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108675

JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated users to change announcement pin status. Attackers can send POST or PUT requests with any announcement id to pin or unpin system notices shown at the top for all users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108670

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to run AI prompt experiments. Low-privileged attackers can supply other users' prompt template and dataset ids to trigger large language model evaluation runs, write result rows into airag_ext_data, and change dataset status.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108665

JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates. Low-privileged attackers can send PUT or POST requests to /airag/prompts/edit with a template id to overwrite prompt text and model parameters created by administrators or other users.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108660

JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus. Low-privileged attackers can supply any tenant id to overwrite its applyStatus field, enabling or disabling tenant administrator applications across tenants.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108655

JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to read scheduled job records. Attackers can request GET /sys/quartzJob/queryById with a job id to retrieve job class names, cron expressions, job parameters and status reserved for administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg Boot Jeecgboot

CVE-2026-108650

JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to read other users' permission codes. Low-privileged attackers can supply an arbitrary userId to GET /sys/api/getUserPermissionSet to retrieve the full permission set of any account, including administrators.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108645

JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move system-wide sys_category nodes, altering classification values used across forms.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108640

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg Boot Jeecgboot

CVE-2026-108635

JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and telephone numbers, including contacts marked hidden.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg Boot Jeecgboot

CVE-2026-108630

JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwrite depart_id, permission_id and data_rule_ids to alter which menus and data rules departments may delegate.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108625

JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any sys_sms record id to overwrite its title, content, receiver address and send status without ownership checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg Jeecgboot

Products

Jeecg-boot Jeecg Boot Jeecgboot

CVE-2026-108620

JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint, to remove all sys_position rows and orphan user-position assignments.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108615

JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users' AI evaluator or test-tracking records without owner or tenant checks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot

CVE-2026-108610

JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other users rely on to generate documents.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeecg

Products

Jeecg-boot Jeecg Boot