CVE-2025-14561Critical· 9.0▾ MidnightIn multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. T…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.
The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-1609High· 8.1A flaw was found in Keycloak
CVE-2026-20736High· 7.5Gitea does not properly verify repository context when deleting attachments
CVE-2026-20750Critical· 9.1Gitea does not properly validate project ownership in organization project operations
CVE-2026-102263Medium· 4.7A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc
CVE-2026-101146Medium· 4.3A security flaw has been discovered in Eleveo Quality Management 9.7.0
CVE-2026-101144Medium· 6.3A vulnerability was determined in Eleveo Call Recording Software 9.7.0