CVE-2026-79788
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
In Dradis Community Edition, the admin_required check is never applied because the constant Dradis::Pro is not defined in CE. This allows any authenticated non-admin user to create an AI provider pointing to an arbitrary HTTP/HTTPS address and reassign the built-in Roslin agent to use it, leading to server-side request forgery (SSRF) with the response reflected to the attacker.
Risk Assessment
The risk includes SSRF attacks that could expose sensitive data from internal resources and potentially lead to privilege escalation.
Recommendation
Upgrade Dradis Community Edition to a version that fixes the access control, and restrict the ability to create AI providers to administrators only.
Related vulnerabilities
- CVE-2026-120225Critical
In Oray Pugongying X5 Pro up to version 7.6.1, the config_restore_ex function in /etc/openwrt_release is vulnerable to relative path traversal via manipulation of the filename argument. The attack can be launched remotely and a public exploit is available.
- CVE-2026-120224Critical
In Oray Pugongying X5 Pro up to version 7.6.1, the run_apis_by_json/run_async_task functions in the API Authorization component allow improper authorization. The attack can be launched remotely and a public exploit has been released.
- CVE-2026-120198Critical
A vulnerability was found in WAVLINK WL-WN530BE1-A V251117 in the con_check_read_finish function of /protocol.csp. Manipulation of the group_name/IP-FROM argument leads to command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-120197Critical
A flaw was found in WAVLINK WL-WN530HG4B (version M_V260724) in the port_forward function of /cgi-bin/wapi.cgi. Manipulation of the Name argument leads to OS command injection. The attack can be performed remotely and a public exploit is available.
- CVE-2026-120196Critical
A vulnerability was detected in WAVLINK WN579X3-D (version V250402) in the port_forward function of /cgi-bin/wapi.cgi. Manipulation of the Name argument results in OS command injection. The attack may be performed remotely and the exploit is publicly available.
- CVE-2026-120195Critical
A security vulnerability was detected in WAVLINK WL-WN579A3-A (version 2026-03-10-94f93d4) in the set_wzdgwMesh function of /cgi-bin/adm.cgi, within the Initial Setup Wizard component. Manipulation of the wlan_ssid argument leads to OS command injection. The attack can be carried out remotely and the exploit has been publicly disclosed.
- CVE-2026-120189Critical
A vulnerability was identified in D-Link DIR-505 1.10B02 in the save_upload_file/mp_upload_file function of /usr/bin/tftpd, which handles TFTP upload filenames. Manipulation of input leads to a stack-based buffer overflow. The attack can be carried out remotely, and a public exploit is available and might be used.
- CVE-2026-118636Critical
The JavaNativeMessageDecoder class in the Apache MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes without any class filter. An application that places it in front of an untrusted peer is exposed to gadget-chain remote code execution. The 3.0.0 branch is inactive and no fix will be released for it.
- CVE-2026-120209Critical
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.
- CVE-2026-120201Critical
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.
Original NVD description (English source)
In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169.254.169.254) and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server issues a request to the attacker-supplied URL (server-side request forgery). For non-2xx responses, the target's response body is reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, making the SSRF readable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS