Skip to content

Commit 621d730

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7rgv-gqhr-fxg3 GHSA-hcff-qv74-7hr4 GHSA-q658-hfpg-35qc GHSA-v66j-6wwf-jc57
1 parent bc95975 commit 621d730

File tree

4 files changed

+126
-4
lines changed

4 files changed

+126
-4
lines changed

‎advisories/github-reviewed/2026/03/GHSA-7rgv-gqhr-fxg3/GHSA-7rgv-gqhr-fxg3.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-7rgv-gqhr-fxg3",
4-
"modified": "2026-03-05T18:20:08Z",
4+
"modified": "2026-03-05T20:42:15Z",
55
"published": "2026-03-05T18:20:08Z",
66
"aliases": [
77
"CVE-2026-25048"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25048"
49+
},
4650
{
4751
"type": "PACKAGE",
4852
"url": "https://github.com/mlc-ai/xgrammar"
@@ -59,6 +63,6 @@
5963
"severity": "HIGH",
6064
"github_reviewed": true,
6165
"github_reviewed_at": "2026-03-05T18:20:08Z",
62-
"nvd_published_at": null
66+
"nvd_published_at": "2026-03-05T16:16:15Z"
6367
}
6468
}

‎advisories/github-reviewed/2026/03/GHSA-hcff-qv74-7hr4/GHSA-hcff-qv74-7hr4.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hcff-qv74-7hr4",
4+
"modified": "2026-03-05T20:43:28Z",
5+
"published": "2026-03-05T20:43:28Z",
6+
"aliases": [
7+
"CVE-2026-29084"
8+
],
9+
"summary": "Gokapi has CSRF in Login Endpoint",
10+
"details": "### Summary\nThe login flow accepts credential-bearing requests without CSRF protection mechanisms tied to the browser session context. The handler parses form values directly and creates a session on successful credential validation.\n\n*Issue found by [aisafe.io](aisafe.io)*\n\n### Impact\nAn attacker can force a victim browser into a session associated with an existing user account where the attacker knows the credentials, causing user confusion, activity misattribution, and potential misuse of trusted user actions.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/forceu/gokapi"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-hcff-qv74-7hr4"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/Forceu/Gokapi"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-352"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-05T20:43:28Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/03/GHSA-q658-hfpg-35qc/GHSA-q658-hfpg-35qc.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q658-hfpg-35qc",
4+
"modified": "2026-03-05T20:42:32Z",
5+
"published": "2026-03-05T20:42:32Z",
6+
"aliases": [
7+
"CVE-2026-29061"
8+
],
9+
"summary": "Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion",
10+
"details": "### Summary\nA privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been stripped of all privileges.\n\n### Impact\nAny user who previously held Admin rank and had API keys with ApiPermManageFileRequests or ApiPermManageLogs retains those capabilities after demotion. This allows offboarded or demoted users to:\n - Create, list, and delete upload requests\n - Read application logs and system status",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/forceu/gokapi"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "2.2.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/Forceu/Gokapi/security/advisories/GHSA-q658-hfpg-35qc"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/Forceu/Gokapi"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-284"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-03-05T20:42:32Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/03/GHSA-v66j-6wwf-jc57/GHSA-v66j-6wwf-jc57.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-v66j-6wwf-jc57",
4-
"modified": "2026-03-05T18:18:01Z",
4+
"modified": "2026-03-05T20:42:10Z",
55
"published": "2026-03-05T18:18:01Z",
66
"aliases": [
77
"CVE-2025-64166"
@@ -43,6 +43,10 @@
4343
"type": "WEB",
4444
"url": "https://github.com/mercurius-js/mercurius/security/advisories/GHSA-v66j-6wwf-jc57"
4545
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64166"
49+
},
4650
{
4751
"type": "WEB",
4852
"url": "https://github.com/mercurius-js/mercurius/pull/1187"
@@ -63,6 +67,6 @@
6367
"severity": "MODERATE",
6468
"github_reviewed": true,
6569
"github_reviewed_at": "2026-03-05T18:18:01Z",
66-
"nvd_published_at": null
70+
"nvd_published_at": "2026-03-05T16:16:11Z"
6771
}
6872
}

0 commit comments

Comments
 (0)