CVE-2026-13591

The record

A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument _channelType causes improper authorization. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48. It is suggested to install a patch to address this issue.

Affected packages

Related vulnerabilities

• CVE-2026-54854 Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. CWE-266
• CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. CWE-266
• CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. CWE-266
• CVE-2026-119599 AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows… CWE-266
• CVE-2026-118082 Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. CWE-266
• CVE-2026-118644 n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution… CWE-266
• CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. CWE-266
• CVE-2026-116106 A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. CWE-266