CVE-2026-6356
Critical · 9.6CVSS
9.6
EPSS
0.4%
Published
Apr 22, 2026
CISA due date
—
The record
A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, enabling them to access and modify sensitive information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allows… CWE-1220
- CVE-2026-78230 AshAi exposes Ash read actions to language-model tool calls. CWE-1220
- CVE-2026-78216 AshLua exposes Ash read actions to Lua scripts run through an eval action. CWE-1220
- CVE-2026-15431 A potential security vulnerability has been identified in the HP Support Assistant for… CWE-1220
- CVE-2026-40145 A vulnerability exists in the interaction between a Endpoint Privilege Management… CWE-1220
- CVE-2025-31938 Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6… CWE-1220
- CVE-2026-50502 Insufficient granularity of access control in Windows Event Logging Service allows an… CWE-1220
- CVE-2026-50405 Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an… CWE-1220