PT-2026-145255
CVE-2026-82014
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).
Found an issue in the description? Have something to add? Feel free to write us 👾