Maybe: Non-admin members can read/modify global self-hosted settings (BAC bypass)

github.com 2026-07-18查看中文 →

Security AdvisoryHighMaybe

Affected:

Maybe <2026-05-24

Fixed in:

Maybe >= 77b5469

Referenced CVEs: CVE-2026-63100 · 6.5

文章内图片已隐藏以节省流量 · Upgrade to Pro to view images & offline archive

This content was auto-fetched from github.com, cleaned by our LLM pipeline, and translated to English. View original.

More from this source

SparkJava External Static Files Symlink Escape Allows Local File Read (PoC Included) 2026-07-26 openlaw-cn SSRF bypass to loopback/private targets via /act interaction 2026-07-26 openclaw-cn Authenticated Local File Disclosure via file:// Scheme Bypass 2026-07-26 datamodel-code-generator customBasePath Code Injection Vulnerability Patch 2026-07-26 NanoClaw add_mcp_server Approval Bypass: Hidden Args and Env Variables Persisted Without Review 2026-07-26

Offline Archive

Offline screenshot & PDF are Pro-exclusive