推荐 3.4
Conf: 50%
CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
排序因子: Primary 数据源 (+3) | LLM 评分加成 (+0.4)
#cwe-1259
共收录 5 条相关安全情报。
← 返回所有主题 推荐 8.4
Conf: 50%
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
排序因子: 有可用补丁/修复方案 (+3) | Primary 数据源 (+3) | 包含 CVE (+2) | LLM 评分加成 (+0.4)
推荐 3.4
Conf: 50%
CVE-2026-54593
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocke
💡 影响/原因: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
排序因子: Primary 数据源 (+3) | LLM 评分加成 (+0.4)
推荐 8.4
Conf: 50%
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocke
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
排序因子: 有可用补丁/修复方案 (+3) | Primary 数据源 (+3) | 包含 CVE (+2) | LLM 评分加成 (+0.4)
推荐 7.4
Conf: 50%
code.gitea.io/gitea
### Summary A personal access token restricted with the public-only scope can still retrieve private organization membership and organization permission details for its own account through organization-listing endpoints. This bypass breaks the intended guarantee that such tokens are limited to public resources only. ### Details The issue affects the following endpoints: GET /api/v1/user/orgs GET
💡 风险点: 原文内容（由于配额限制，未进行深度 LLM 分析）
🎯 建议动作: 建议根据原文自行评估
排序因子: 有可用补丁/修复方案 (+3) | Secondary 数据源 (+2) | 包含 CVE (+2) | LLM 评分加成 (+0.4)