cube-studio vulnerabilities
CVEs whose affected-version data names the cube-studio package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111671High· 7.1Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to l…
▾ Twilightdata-infra · cube-studiovia CVEORG
CVE-2026-111672Medium· 4.3PoCCube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipel…
▾ Twilightdata-infra · cube-studiovia CVEORG