CVE-2026-63198

traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.

• CWE-863

• https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3
• https://github.com/traPtitech/traQ/releases/tag/v3.28.3
• https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63184Refitter is a tool for generating a C# REST API client using…7.1
• CVE-2026-63187Logto is the modern, open-source auth infrastructure for Saa…6.3
• CVE-2026-63188Logto is the modern, open-source auth infrastructure for Saa…8.7
• CVE-2026-6319Use after free in Payments in Google Chrome on Android prior…7.5
• CVE-2026-63190FearlessCMS is a flat-file `content` management system cente…9.4
• CVE-2026-63197traQ is a messenger application built for Digital Creators C…7.3
• CVE-2026-63199Perses is an open-source dashboard and visualization project…8.3
• CVE-2026-6320The Salon Booking System – Free Version plugin for WordPress…7.5
• CVE-2026-63201Netopeer2 is a server for implementing network configuration…7.1
• CVE-2026-63203Logto is the modern, open-source auth infrastructure for Saa…7.6
• CVE-2026-63204Zammad is a web based open source helpdesk/customer support …2.3
• CVE-2026-63205Zammad is a web based open source helpdesk/customer support …5.1