The official CVE record is not published yet
Listed from the vendor advisory. It will be replaced with the CVE.org / NVD record once published.
VU#166125: Bisheng has authentication bypass vulnerabilities
Summary
CVE-2026-96681 (IDOR Workflow Exposure) There are missing authorization controls across multiple version retrieval endpoints. The underlying source code retrieves flow and workflow version records based on user-supplied parameters without performing any data ownership or permission validation. Any a...
Original description The description as published by the source.
CVE-2026-96681 (IDOR Workflow Exposure) There are missing authorization controls across multiple version retrieval endpoints. The underlying source code retrieves flow and workflow version records based on user-supplied parameters without performing any data ownership or permission validation. Any authenticated user can query and read the complete Domain-Specific Language (DSL) configurations belonging to other accounts.
(CERT/CC Vulnerability Notes: VU#166125: Bisheng has authentication bypass vulnerabilities)
Source: CERT/CC Vulnerability Notes NVD
References
- CERTCC-VULNOTES VU#166125: Bisheng has authentication bypass vulnerabilities