CVE-2026-124496

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

• CWE-863

• https://lists.apache.org/thread/z8r5mxcpfgklq820j8krk8ozqxgqdhtr
• https://www.openwall.com/lists/oss-security/2026/11/11/5

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124490OpenEMR before 8.3.0 contains a path traversal vulnerability…9.1
• CVE-2026-124491SunEditor before 3.4.0 contains a stored cross-site scriptin…6.4
• CVE-2026-124492SunEditor before 3.4.0 contains a stored cross-site scriptin…7.6
• CVE-2026-124493SunEditor before 3.4.0 contains a stored cross-site scriptin…9.3
• CVE-2026-124494SunEditor before 3.4.0 contains a stored cross-site scriptin…9.3
• CVE-2026-124495When workers run as the topology owner, the Logviewer serves…
• CVE-2026-124498A vulnerability was determined in Convene Azeus Convene Boar…3.5
• CVE-2026-124499A vulnerability was identified in Fengoffice Feng Office up …4.7
• CVE-2026-1245A code injection vulnerability in the binary-parser library …6.5
• CVE-2026-12450Inappropriate implementation in Media in Google Chrome prior…6.5
• CVE-2026-124500A security flaw has been discovered in Fengoffice Feng Offic…6.3
• CVE-2026-124501A weakness has been identified in Tidelift moto up to 5.2.4.…7.3