CVE-2026-36453

Summary

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.

Affected Software

Weaknesses

• CWE-425: CWE-425 Direct Request ('Forced Browsing')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://rhymix.org/community/1932364
• https://github.com/rhymix/rhymix/commit/f131a616eb990e2b070a8381c3106ae979d40989

• ←Previous
• Next→