CVE-2026-80348

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching the supplied application and module name, while its sibling uploadPatchPackage, which only stores the package, does check developer authorization first. The only precondition uploadAndPublish enforces is that the named server is registered, and any registered server in the installation satisfies it. downloadPackage and deletePatchPackage select a package by an unscoped sequential primary key covering every application's uploads, and setPatchPackageDefault changes which package a given application deploys by default. Any authenticated account, including one holding a role scoped to a single unrelated application, can therefore push a package to and trigger its deployment on any server the console manages, retrieve or delete any other application's package, and change which package is deployed by default.

• CWE-862

• https://github.com/TarsCloud/TarsWeb
• https://github.com/TarsCloud/TarsWeb/blob/v3.0.16/app/controller/patch/PatchController.js
• https://github.com/TarsCloud/TarsWeb/issues/213
• https://www.vulncheck.com/advisories/tarsweb-through-3.0.16-missing-authorization-on-patch-deploy-download-and-delete-endpoints

Published

Aug 26, 2026

Last Modified

Sep 3, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8033A vulnerability has been found in PicoTronica e-Clinic Healt…5.5
• CVE-2026-80339The Payment Plugins for Stripe WooCommerce WordPress plugin …5.3
• CVE-2026-8034A server-side request forgery (SSRF) vulnerability was ident…9.8
• CVE-2026-80340The Payment Plugins for PayPal WooCommerce WordPress plugin …5.3
• CVE-2026-80341The Payment Plugins for PayPal WooCommerce WordPress plugin …5.9
• CVE-2026-80346StarRocks performs no privilege check when a legacy synchron…7.1
• CVE-2026-8035Improper input validation in the NI-PAL kernel driver may al…5.5
• CVE-2026-80350OneUptime's webhook target check rejects private and loopbac…7.1
• CVE-2026-80351Improper neutralization of directives in dynamically evaluat…9.8
• CVE-2026-80352Improper Control of Generation of Code ('Code Injection') vu…9.8
• CVE-2026-80354Authorization bypass through User-Controlled key vulnerabili…8.1
• CVE-2026-80355Dell OpenManage Server Administrator, versions prior to 11.1…5.4