CVE-2026-95811
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in Lemonldap::NG::Handler (Perl) allows bypassing locationRules by using an equivalent spelling of a path. The handler matches regular expressions against the raw REQUEST_URI, while the web server routes on the percent-decoded and normalized path, allowing bypass of deny rules, identity and group conditions, and unprotect and skip rules. Only vhosts whose default rule is more permissive than other rules are affected.
Risk Assessment
An authenticated user can reach any URL that a locationRules regexp was meant to restrict, potentially leading to unauthorized access to protected resources. The risk is limited to the permissions already granted by the vhost's default rule.
Recommendation
Update Lemonldap::NG::Handler to version 2.16.10, 2.21.6, or 2.23.4 (depending on the branch) or later. Review the default rule configuration of vhosts to ensure they are not more permissive than intended.
Related vulnerabilities
- CVE-2026-122051Critical
A flaw was found in Edimax BR-6208AC version 1.32 in an unknown functionality of the /goform/mp file. Input manipulation can lead to command injection. The attack can be launched remotely and the exploit has been published.
- CVE-2026-54384Critical
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /front/login/sns/ endpoint without providing proof of ownership from the identity provider. Attackers can forge a login using an identifier exposed through account enumeration to read and modify the victim's profile and delete the account's authentication record.
- CVE-2026-52848Critical
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This issue is fixed in version 11.0.8.
- CVE-2026-115770Critical
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification binds an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an address they control, change the account to an arbitrary unused address, and redeem the old token so Pocket ID publishes the new address with email_verified set to true.
- CVE-2026-97693Critical
Yuxi from 0.6.0.beta1 until 0.7.1 has insufficient isolation between execution-capable Docker sandboxes and trusted application services. A low-privileged authenticated user can reach other tenants' sandbox APIs, access their files and secrets, execute commands in active sandboxes, and enumerate, create, or delete sandboxes through the unauthenticated provisioner without knowing administrator, database, or MinIO credentials.
- CVE-2026-57566Critical
Readest prior to 0.11.10 contains an unauthenticated /api/opds/proxy route that fetches an attacker-controlled URL server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during redirects. The route also accepts caller-controlled outbound headers and Authorization values and reflects the upstream status and response body.
- CVE-2026-54378Critical
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket and read or overwrite other users' stored files.
- CVE-2026-102895Critical
GPUStack prior to 2.2.0 treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1, allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution.
- CVE-2026-102894Critical
GPUStack from 0.7.1 until 2.2.2 contains an /auth/saml/callback endpoint that decodes SAML XML and uses its NameID and attributes to resolve or provision a user without verifying the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new account, even when SAML was not configured.
- CVE-2026-82418Critical
IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 contain a use-after-free vulnerability that could allow a remote attacker to execute arbitrary code.
Original NVD description (English source)
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS