CVE-2026-80348

Name of the Vulnerable Software and Affected Versions TarsWeb (affected versions not specified)

Description Improper authorization occurs because four methods in app/controller/patch/PatchController.js fail to call the AuthService to enforce per-application roles. This allows any authenticated user, regardless of their assigned role or application scope, to perform unauthorized actions. Specifically, the uploadAndPublish endpoint allows users to upload a package and trigger deployment tasks to any registered server. The downloadPackage and deletePatchPackage endpoints use unscoped sequential primary keys, enabling the retrieval or deletion of packages belonging to any application. Additionally, the setPatchPackageDefault endpoint allows users to change the default deployment package for any application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.