CVE-2026-92764

MediumCVSS 4.3

Published: 16/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

28th percentile - higher than 28% of all known CVEs

Summary

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolation boundaries.

Risk Assessment

A breach of data isolation between organizations can lead to unauthorized access to information about organizations and their members.

Recommendation

Update OpenCVE to version 3.1.0 or later. Review and restrict API token scopes.

Other vulnerabilities in OpenCVE

CVE-2026-62282Medium
A vulnerability in OpenCVE before 3.0.0 allows an authenticated user with permission to configure notification channels to trigger requests to arbitrary hosts, including internal network resources, localhost, link-local addresses, and cloud metadata services. The notification testing for Webhook and Slack does not sufficiently validate destination URLs, potentially leaking information.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS