Summary
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
References
Related vulnerabilities
All Supply chain →- MEDIUMGHSA-QWXF-2M7M-2M3X
Daytona: Cross-tenant data leak in notification WebSocket gateway via unverified organizationId join
- HIGHGHSA-VRHC-3FR6-PC3C
Open WebUI: Forged chat-file link allows cross-user file read and deletion
- HIGHGHSA-QXVM-PCFM-QC39
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
- MEDIUMGHSA-GWXR-7H77-7777
Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected
- HIGHGHSA-WRR5-99H5-GQ57
Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes
- HIGHGHSA-FHX7-M96W-MV29
Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration