CVE-2026-23595

An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

• CWE-284

• https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05002en_us&docLocale=en_USPatch, Vendor Advisory

Published

Feb 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23580Rejected reason: Not used
• CVE-2026-23581Rejected reason: Not used
• CVE-2026-23582Rejected reason: Not used
• CVE-2026-2359Multer is a node.js middleware for handling `multipart/form-…7.5
• CVE-2026-23592Insecure file operations in HPE Aruba Networking Fabric Comp…7.2
• CVE-2026-23593A vulnerability in the web-based management interface of HPE…7.5
• CVE-2026-23596A vulnerability in the management API of the affected produc…6.5
• CVE-2026-23597Vulnerabilities in the API error handling of an HPE Aruba Ne…6.5
• CVE-2026-23598Vulnerabilities in the API error handling of an HPE Aruba Ne…6.5
• CVE-2026-23599A local privilege-escalation vulnerability has been discover…7.8
• CVE-2026-2360PostgreSQL Anonymizer contains a vulnerability that allows a…8
• CVE-2026-23600A remote authentication bypass vulnerability  exists in HP…9.8