CVE-2026-67615

The record

openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.

Affected packages

Related vulnerabilities

• CVE-2026-119567 vsftpd through 3.0.5 contains an access control bypass vulnerability that allows… CWE-184
• CVE-2026-96196 Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an… CWE-184
• CVE-2026-117530 In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete… CWE-184
• CVE-2026-115845 An incomplete list of disallowed inputs in the Python code validator of the run_script… CWE-184
• CVE-2026-115751 Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request… CWE-184
• CVE-2026-114615 Authlib is a Python library which builds OAuth and OpenID Connect servers. CWE-184
• CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184
• CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content… CWE-184