CVE-2026-119627

The record

The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a limited-visibility owner, without considering the `public-only` restriction of the personal access token used to authenticate. Any user holding a public-only token could send it over HTTP Basic authentication to read the profile and activity feed of limited-visibility users and organizations, which are hidden from anonymous visitors and refused on the equivalent API routes. The disclosure covers existence, profile metadata and public activity; it does not grant write access.

Affected packages

Related vulnerabilities

• CVE-2026-77778 ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to… CWE-1220
• CVE-2026-77777 ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access… CWE-1220
• CVE-2026-57202 Asterisk is an open source private branch exchange and telephony toolkit. CWE-1220
• CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows… CWE-1220
• CVE-2026-85316 Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP… CWE-1220
• CVE-2026-83499 Insufficient granularity of access control in Windows Server Update Service allows an… CWE-1220
• CVE-2026-81969 Insufficient granularity of access control in Windows Server Update Service allows an… CWE-1220
• CVE-2026-70216 Insufficient granularity of access control in Windows Mobile Device Management allows an… CWE-1220