Tag
#Missing Authorization
MCP Python SDK Vulnerability: Experimental Task Handlers Allow Unauthorized Access to Tasks
A high-severity vulnerability (CVE-2026-52870) exists in the MCP Python SDK, specifically in the experimental tasks feature. When enabled, default request handlers do not check session ownership, allowing any client to access and cancel other clients' tasks. Affected versions are from 1.23.0 to 1.27.1. The vulnerability has a CVSS v3 score of 7.6 and is classified under CWE-862 (Missing Authorization).
CVE-2026-6509: Missing Authorization in TUBITAK BILGEM Pardus Update Leads to Privilege Escalation
A Missing Authorization vulnerability, CVE-2026-6509, with a CVSS score of 7.8, was discovered in TUBITAK BILGEM Software Technologies Research Institute's Pardus Update. This vulnerability allows for Privilege Escalation and affects versions up to 0.6.3 before 0.6.6. Although not actively exploited, the vulnerability poses a high risk due to its local attack vector and potential for high impact. Immediate patching to version 0.6.6 or later is recommended.
Critical Missing Authorization Vulnerability in TUBITAK BILGEM pardus-software
A critical Missing Authorization vulnerability, CVE-2026-14460, with a CVSS score of 8.8, was discovered in TUBITAK BILGEM's pardus-software. This vulnerability allows for Argument Injection and affects versions <= 1.0.4 before 1.0.5. Although not actively exploited, the vulnerability poses a high risk due to its local attack vector and potential for high impact. Immediate patching to version 1.0.5 is recommended.
CVE-2026-56396: phpMyFAQ Privilege Escalation Vulnerability
A vulnerability in phpMyFAQ before version 4.1.4 allows authenticated administrators to escalate privileges due to missing authorization in the editUser() and updateUserRights() endpoints. Non-SuperAdmin users with edit_user permission can exploit this to gain SuperAdmin access. The vulnerability has a CVSS score of 8.8.