# CWE-178.

Every Advisory and CVE whose sources give the weakness CWE-178, newest first.

## Records, newest first

- [HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service](https://agentprime.io/advisories/CVE-2026-85287.md)
  `CVE-2026-85287` · CVE record: sysadminsmedia homebox · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-178, CWE-1024
- [ModSecurity: Response Body Inspection Bypass](https://agentprime.io/advisories/CVE-2026-73856.md)
  `CVE-2026-73856` · CVE record: owasp-modsecurity ModSecurity · CVSS 8.6 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-178
- [Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules](https://agentprime.io/advisories/CVE-2026-63121.md)
  `CVE-2026-63121` · CVE record: kubewarden policies · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-178
- [Samba: access control bypass via vfs_ceph_rgw case-insensitive open](https://agentprime.io/advisories/CVE-2026-109411.md)
  `CVE-2026-109411` · CVE record: Samba Samba and 4 more · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-178
- [HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them](https://agentprime.io/advisories/CVE-2026-116135.md)
  `CVE-2026-116135` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-178
- [Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.](https://agentprime.io/advisories/CVE-2026-108313.md)
  `CVE-2026-108313` · CVE record: Tanium Tanium Server · CVSS 6.6 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-178
- [Consul vulnerable to an authorization bypass in service mesh registration](https://agentprime.io/advisories/CVE-2026-105608.md)
  `CVE-2026-105608` · CVE record: HashiCorp Consul and 1 more · CVSS 8.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-178
- [MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding](https://agentprime.io/advisories/CVE-2026-116469.md)
  `CVE-2026-116469` · CVE record: MISP misp-guard · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20, CWE-178
- [undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens](https://agentprime.io/advisories/GHSA-f72v-6w45-q472.md)
  `GHSA-f72v-6w45-q472`, `CVE-2026-109841` · npm `undici`: affected `>=7.15.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `7.30.1`, `8.12.2` · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-178
- [Nuxt: Server-side route rules (\`redirect\`, \`headers\`, \`proxy\`, \`ssr\`) are skipped for case-variant paths when routing is case-insensitive](https://agentprime.io/advisories/GHSA-vjh5-4x84-xrqp.md)
  `GHSA-vjh5-4x84-xrqp`, `CVE-2026-114132` · npm `nuxt` and 1 more: affected `>=3.0.0 || >=4.0.0, <4.6.2`, fixed in `4.6.2` · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control, CWE-178
- [fastify is vulnerable to header validation bypass via case-sensitive propertyNames](https://agentprime.io/advisories/GHSA-389g-gv7q-r4x8.md)
  `GHSA-389g-gv7q-r4x8`, `CVE-2026-107832` · npm `fastify`: affected `>=5.12.2, <5.12.6`, fixed in `5.12.6` · CVSS 3.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-178
- [Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing](https://agentprime.io/advisories/CVE-2026-85254.md)
  `CVE-2026-85254` · CVE record: Apache Software Foundation Apache Camel · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-178
- [Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching](https://agentprime.io/advisories/CVE-2026-80343.md)
  `CVE-2026-80343` · CVE record: Apache Software Foundation Apache Camel · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-178
- [Wheels: Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks…](https://agentprime.io/advisories/CVE-2026-111448.md)
  `CVE-2026-111448` · CVE record: Wheels Wheels · CVSS 3.7 Low · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-178
- [Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames](https://agentprime.io/advisories/CVE-2026-18660.md)
  `CVE-2026-18660` · CVE record: Eclipse Foundation · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF), CWE-178
- [Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch](https://agentprime.io/advisories/CVE-2026-74041.md)
  `CVE-2026-74041` · CVE record: Wazuh wazuh-manager · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-178
- [Open Computer Use through 1.0.0 Denylist Bypass via Case-Variant Bundle ID](https://agentprime.io/advisories/CVE-2026-108721.md)
  `CVE-2026-108721` · CVE record: iFurySt open-computer-use · CVSS 5.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: CWE-178
- [svg-sanitizer: Mixed-case xlink:HrEf skips the \`\<use>\` nesting-DoS check in Resolver::processReferences](https://agentprime.io/advisories/GHSA-m9xh-6747-9r6f.md)
  `GHSA-m9xh-6747-9r6f`, `CVE-2026-107381`, `PKSA-6j95-1jtb-x6wc` · Packagist `enshrined/svg-sanitize`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service, CWE-178
- [Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host](https://agentprime.io/advisories/CVE-2026-105570.md)
  `CVE-2026-105570` · CVE record: Docker Docker Sandboxes · CVSS 6.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-178
- [Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions](https://agentprime.io/advisories/CVE-2026-89322.md)
  `CVE-2026-89322` · CVE record: HashiCorp Vault and 1 more · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-178
- [Backstage: Scaffolder action input authorization bypass](https://agentprime.io/advisories/GHSA-hmp2-4m7g-22cv.md)
  `GHSA-hmp2-4m7g-22cv`, `CVE-2026-106503` · npm `@backstage/plugin-scaffolder-backend`: affected `<3.3.1 || >=3.4.0, <3.4.1 || >=4.0.0, <4.0.3 || >=4.0.4, <4.1.0`, fixed in `3.3.1`, `3.4.1`, `4.0.3`, `4.1.0` · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-178
- [Backstage: Inconsistent catalog property permission evaluation](https://agentprime.io/advisories/CVE-2026-106497.md)
  `CVE-2026-106497` · CVE record: backstage backstage and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-178
- [fastify vulnerable to header validation bypass via incomplete schema case normalization](https://agentprime.io/advisories/GHSA-9q9j-q6p8-xq58.md)
  `GHSA-9q9j-q6p8-xq58`, `CVE-2026-84428` · npm `fastify`: affected `<5.12.2`, fixed in `5.12.2` · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-178
- [Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity](https://agentprime.io/advisories/CVE-2026-102131.md)
  `CVE-2026-102131` · CVE record: Kiteworks Email Protection Gateway · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection, CWE-178
- [fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets](https://agentprime.io/advisories/GHSA-hrr3-gc8f-f4qj.md)
  `GHSA-hrr3-gc8f-f4qj`, `CVE-2026-86472` · npm `fast-uri`: affected `<2.4.7 || >=3.0.0, <3.1.8 || >=4.0.0, <4.1.5`, fixed in `2.4.7`, `3.1.8`, `4.1.5` · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-178
- [Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass](https://agentprime.io/advisories/CVE-2026-100693.md)
  `CVE-2026-100693` · CVE record: gohugoio hugo · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-178
- [Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass](https://agentprime.io/advisories/CVE-2026-100669.md)
  `CVE-2026-100669` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-178
- [OpenClaw before 2026.7.1 Remote Code Execution via cron tool](https://agentprime.io/advisories/CVE-2026-100580.md)
  `CVE-2026-100580` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-178
- [OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding](https://agentprime.io/advisories/CVE-2026-100541.md)
  `CVE-2026-100541` · CVE record: openclaw matrix · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-178
- [Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for](https://agentprime.io/advisories/GHSA-328g-jx67-v94g.md)
  `GHSA-328g-jx67-v94g`, `CVE-2026-77560`, `GO-2026-6552` · Go `github.com/tinyauthapp/tinyauth`: affected `<1.0.1-0.20260720133915-80bc87188ec3`, fixed in `1.0.1-0.20260720133915-80bc87188ec3` · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control, CWE-178, CWE-636
- [Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass](https://agentprime.io/advisories/GHSA-j8px-rmrx-76h9.md)
  `GHSA-j8px-rmrx-76h9`, `CVE-2026-77281`, `CVE-2026-92284`, `CVE-2026-92700`, `GO-2026-6512` · Go `github.com/caddyserver/caddy/v2`: affected `<2.11.4`, fixed in `2.11.4` · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection, Denial of service, CWE-178
- [@fastify/static vulnerable to route guard bypass via path case-folding](https://agentprime.io/advisories/CVE-2026-90982.md)
  `CVE-2026-90982` · CVE record: @fastify/static @fastify/static · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control, CWE-178
- [Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter](https://agentprime.io/advisories/CVE-2026-89012.md)
  `CVE-2026-89012` · CVE record: Dolibarr Dolibarr · CVSS 7.1 High · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-178
- [Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)](https://agentprime.io/advisories/CVE-2026-87876.md)
  `CVE-2026-87876` · CVE record: Red Hat Red Hat Hardened Images and 4 more · CVSS 3.0 Low · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-178
- [Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation](https://agentprime.io/advisories/CVE-2026-86770.md)
  `CVE-2026-86770` · CVE record: grokability snipe-it · CVSS 8.6 High · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-178
- [xmldom: HTML raw-text closing-tag case mismatch causes output amplification](https://agentprime.io/advisories/GHSA-6mj3-qw4j-hgrw.md)
  `GHSA-6mj3-qw4j-hgrw`, `CVE-2026-83612` · npm `@xmldom/xmldom`: affected `>=0.9.0-beta.1, <0.9.12`, fixed in `0.9.12` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service, CWE-178
- [gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion](https://agentprime.io/advisories/GHSA-qc2q-p7wx-3px3.md)
  `GHSA-qc2q-p7wx-3px3`, `CVE-2026-84303`, `GO-2026-6441` · Go `google.golang.org/grpc`: affected `<1.83.1`, fixed in `1.83.1` · CVSS 6.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control, CWE-178
- [Improper Case Sensitivity Handling in MongoDB Server Configuration Validation May Cause Authorization to Remain Disabled at Startup](https://agentprime.io/advisories/CVE-2026-82067.md)
  `CVE-2026-82067` · CVE record: MongoDB MongoDB Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-178
- [External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098](https://agentprime.io/advisories/CVE-2026-73476.md)
  `CVE-2026-73476` · CVE record: Drupal External Authentication · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-178
- [httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems](https://agentprime.io/advisories/CVE-2026-73270.md)
  `CVE-2026-73270` · CVE record: Erlang OTP · CVSS 8.2 High · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-178
- [AshPhoenix get_subdomain maps a crafted or differently-cased Host header to an arbitrary tenant](https://agentprime.io/advisories/GHSA-rpf8-q9jh-qxrr.md)
  `GHSA-rpf8-q9jh-qxrr`, `CVE-2026-82726`, `EEF-CVE-2026-82726` · Hex `ash_phoenix`: affected `>=2.1.26, <2.3.25`, fixed in `2.3.25` · CVSS 6.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-178, CWE-625
- [Google Chrome: Improper handling of case sensitivity in FileSystem in Google Chrome prior to…](https://agentprime.io/advisories/CVE-2026-78959.md)
  `CVE-2026-78959` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-178
- [Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise](https://agentprime.io/advisories/CVE-2026-59335.md)
  `CVE-2026-59335` · CVE record: Cloud Foundry UAA and 1 more · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-178
- [Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems](https://agentprime.io/advisories/GHSA-vwg3-w8w3-pc79.md)
  `GHSA-vwg3-w8w3-pc79`, `CVE-2026-62230`, `CVE-2026-62673`, `PKSA-wh99-p4gt-7bkp` · Packagist `getgrav/grav`: affected `<2.0.4`, fixed in `2.0.4` · CVSS 8.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-178
- [FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass](https://agentprime.io/advisories/CVE-2026-72836.md)
  `CVE-2026-72836` · CVE record: filebrowser filebrowser · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-178
- [Discourse: Onebox Domain Blocklist Bypass via Case-Sensitive Comparison](https://agentprime.io/advisories/CVE-2026-72721.md)
  `CVE-2026-72721` · CVE record: discourse discourse · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-178
- [Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth](https://agentprime.io/advisories/GHSA-x677-9fxg-v5c5.md)
  `GHSA-x677-9fxg-v5c5`, `CVE-2026-54763`, `GO-2026-6211` · Go `github.com/traefik/traefik/v2` and 1 more: affected `<2.11.51`, fixed in `2.11.51` · CVSS 7.8 High · Not analysed yet · Published 6 Aug 2026 · Tags: Authentication bypass, CWE-178, CWE-345
- [Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)](https://agentprime.io/advisories/GHSA-hxvh-4h3w-prp9.md)
  `GHSA-hxvh-4h3w-prp9`, `CVE-2026-71315` · npm `nuxt`: affected `>=3.21.7, <3.21.10 || >=4.4.7, <4.5.1`, fixed in `3.21.10`, `4.5.1` · CVSS 8.2 High · Not analysed yet · Published 5 Aug 2026 · Tags: Broken access control, CWE-178
- [Jenkins: Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user…](https://agentprime.io/advisories/CVE-2026-70429.md)
  `CVE-2026-70429` · CVE record: Jenkins Project Jenkins · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178
- [Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher](https://agentprime.io/advisories/CVE-2026-15573.md)
  `CVE-2026-15573` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-178, CWE-551
- [Oidcc.Plug.Authorize user agent session binding inert due to case-sensitive header lookup](https://agentprime.io/advisories/GHSA-w5r8-m75h-98fc.md)
  `GHSA-w5r8-m75h-98fc`, `CVE-2026-66883`, `EEF-CVE-2026-66883` · Hex `oidcc_plug`: affected `>=0.1.0-alpha.3, <0.5.0`, fixed in `0.5.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-178
- [Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities](https://agentprime.io/advisories/GHSA-qcxp-gm7m-4j5v.md)
  `GHSA-qcxp-gm7m-4j5v`, `CVE-2026-50559` · Maven `io.quarkus:quarkus-vertx-http`: affected `<3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0`, fixed in `3.20.6.2`, `3.27.4.1`, `3.33.2.1`, `3.36.3`, `3.37.0` · CVSS 7.5 High · Not analysed yet · Published 29 Jul 2026 · Tags: Authentication bypass, Broken access control, CWE-41, CWE-178
- [Principal/domain lookup without case normalization](https://agentprime.io/advisories/CVE-2026-15617.md)
  `CVE-2026-15617` · CVE record: Logto Logto · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-178
- [JupyterLab: PyPI extension blocklist package-name canonicalization bypass](https://agentprime.io/advisories/GHSA-89vp-jrxv-24w8.md)
  `GHSA-89vp-jrxv-24w8`, `BIT-jupyterlab-2026-73416`, `CVE-2026-73416`, `PYSEC-2026-3670` · PyPI `jupyterlab`: affected `>=4.5.0, <4.5.10 || >=4.6.0, <4.6.2`, fixed in `4.5.10`, `4.6.2` · CVSS 6.1 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-178, CWE-180
- [FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL](https://agentprime.io/advisories/CVE-2026-53595.md)
  `CVE-2026-53595` · CVE record: freescout-help-desk freescout · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Authentication bypass, CWE-178, CWE-640
- [Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)](https://agentprime.io/advisories/GHSA-937x-gpqr-72gg.md)
  `GHSA-937x-gpqr-72gg`, `CVE-2026-54567`, `PYSEC-2026-3466` · PyPI `flask-reuploaded`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: Unrestricted file upload, CWE-178
- [SafeInstall agent guard shell parsing can miss raw package execution](https://agentprime.io/advisories/GHSA-xrmc-c5cg-rv7x.md)
  `GHSA-xrmc-c5cg-rv7x` · npm `safeinstall-cli`: affected `<0.10.2`, fixed in `0.10.2` · CVSS 8.8 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-178, CWE-693
- [NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer.\_filter_and_accumulate case sensitivity](https://agentprime.io/advisories/CVE-2026-14617.md)
  `CVE-2026-14617` · CVE record: NousResearch hermes-agent · CVSS 2.3 Low · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-178, CWE-697
- [Flowise - Custom MCP Environment Variable Denylist Bypass via Case Sensitivity](https://agentprime.io/advisories/CVE-2026-58057.md)
  `CVE-2026-58057` · CVE record: Flowise Flowise · CVSS 2.3 Low · Not analysed yet · Published 28 Jun 2026 · Tags: CWE-178
- [Authelia has an Edge Case Access Control Rule Mismatch](https://agentprime.io/advisories/GHSA-j748-h363-wqj8.md)
  `GHSA-j748-h363-wqj8`, `CVE-2026-48794`, `GO-2026-5819` · Go `github.com/authelia/authelia/v4`: affected `>=4.36.0, <4.39.20`, fixed in `4.39.20` · CVSS 1.3 Low · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control, CWE-178

Older: <https://agentprime.io/advisories/tag/cwe-178.md?cursor=WyIyMDI2LTA2LTI2VDIyOjMyOjIxLjAwMDAwMFoiLCJHSFNBLWo3NDgtaDM2My13cWo4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-178>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-178/>. Everything for agents: <https://agentprime.io/llms.txt>.