PT-2026-55021
CVE-2026-57680
·
تاريخ النشر
2026-06-30
·
تاريخ التحديث
2026-07-02
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions
Kirki versions prior to 6.0.12
Description
An Insecure Direct Object Reference (IDOR) exists due to missing authentication and ownership verification when processing a user-supplied
comment id in the comment edit path of the REST API endpoint. This allows unauthenticated attackers to edit arbitrary comments by providing a targeted comment ID, regardless of who owns the comment.Recommendations
Update to a version newer than 6.0.11.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾