CVE-2026-7165

The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'keyJugadorObjectiu' parameters allow the modification of other users’ information without requiring prior authorization validation. This could enable an authenticated attacker to alter any user’s ID and change their information. * The ‘punts’ and ‘numObjectiusEliminats’ fields allow arbitrary data to be added because user input is not properly validated. This makes it possible to obtain authentic prizes, awarded by city councils, by falsifying game scores. * In the ‘tokens’ field, administrative privileges can be self-assigned without server validation or prior authentication. This vulnerability could allow an authenticated attacker to grant themselves administrator permissions and thus escalate privileges. * Numeric fields allow the entry of extremely long values, which can cause the system to crash. Successful exploitation of this vulnerability could allow an authenticated attacker to launch a denial-of-service (DoS) attack, preventing created games from being playable. * The ‘urlImatge’ parameter allows server-side requests to arbitrary URLs, enabling the retrieval of users’ internal IP addresses, access to internal services, reading of local files, and unauthorized interaction with third-party APIs. An authenticated attacker could gain access to sensitive data.

• CWE-20

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-assassin-game-gaudire

Published

Jun 22, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71642An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to c…4
• CVE-2026-71643An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to c…7.5
• CVE-2026-71644An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested…9.8
• CVE-2026-71645An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested…7.5
• CVE-2026-71646An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested…7.5
• CVE-2026-71647An issue in EGO-Planner-v2 All versions up to commit 5c99a95…7.5
• CVE-2026-7166Vulnerability involving the exposure of sensitive data provi…9.2
• CVE-2026-7167The vulnerability arises when the system fails to properly v…6.9
• CVE-2026-71675An issue in Open5GS v.2.7.0 allows a remote attacker to caus…7.5
• CVE-2026-71676Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a re…7.5
• CVE-2026-7168Successfully using libcurl to do a transfer over a specific …5.3
• CVE-2026-7169a vulnerability involving an unchecked search path element i…7.5