CVE-2026-80348

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching the supplied application and module name, while its sibling uploadPatchPackage, which only stores the package, does check developer authorization first. The only precondition uploadAndPublish enforces is that the named server is registered, and any registered server in the installation satisfies it. downloadPackage and deletePatchPackage select a package by an unscoped sequential primary key covering every application's uploads, and setPatchPackageDefault changes which package a given application deploys by default. Any authenticated account, including one holding a role scoped to a single unrelated application, can therefore push a package to and trigger its deployment on any server the console manages, retrieve or delete any other application's package, and change which package is deployed by default.

• CWE-862

• https://github.com/TarsCloud/TarsWeb
• https://github.com/TarsCloud/TarsWeb/blob/v3.0.16/app/controller/patch/PatchController.js
• https://github.com/TarsCloud/TarsWeb/issues/213
• https://www.vulncheck.com/advisories/tarsweb-through-3.0.16-missing-authorization-on-patch-deploy-download-and-delete-endpoints

Published

Aug 26, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80341The Payment Plugins for PayPal WooCommerce WordPress plugin …5.9
• CVE-2026-80342The Payment Plugins for PayPal WooCommerce WordPress plugin …6.5
• CVE-2026-80343Improper Handling of Case Sensitivity vulnerability in Apach…8.2
• CVE-2026-80344Server-Side Request Forgery (SSRF) vulnerability in Apache C…8.2
• CVE-2026-80346StarRocks performs no privilege check when a legacy synchron…7.1
• CVE-2026-80347mcp-fetch checks a fetch target against its SSRF guard witho…7.5
• CVE-2026-80349TarsWeb decides whether a request comes from a trusted local…9.8
• CVE-2026-8035Improper input validation in the NI-PAL kernel driver may al…5.5
• CVE-2026-80350OneUptime's webhook target check rejects private and loopbac…7.1
• CVE-2026-80351Improper neutralization of directives in dynamically evaluat…9.8
• CVE-2026-80352Improper Control of Generation of Code ('Code Injection') vu…9.8
• CVE-2026-80353Time-of-check time-of-use (TOCTOU) race condition vulnerabil…8.1