CVE-2026-48396
High · 8.6CVSS
8.6
EPSS
0.3%
Published
Jul 28, 2026
CISA due date
—
The record
Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63414 Shopify App is a Rails engine for building Shopify applications. CWE-863
- CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-863
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-863
- CVE-2026-58412 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP… CWE-863
- CVE-2026-55493 HotCRP is conference review software. CWE-863
- CVE-2026-55098 Arc is an open, SQL-native time-series database for telemetry. CWE-863
- CVE-2026-115830 In Secret Server versions earlier than 12.3.1, a user under certain conditions could… CWE-863
- CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins… CWE-863