HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-72741 — Rainbond through 6.9.7 contains a broken access control vulnerability in the Che...

·Source: NIST NVD

Updated:

Executive Summary

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, a

Analysis

Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates. CVSS Score: 8.1. Published: 2026-08-13T18:18:16.670.

Indicators of Compromise (1)

CVE (1)
CVE-2026-72741
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 13, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Investigation of banking hack leads to arrests in Germany, Brazil

Germany’s federal police agency, the BKA, said three suspects were picked up in Europe and charged with fraud, and Brazil’s federal police said four others were arrested on similar charges.

The Record
CRITICALVulnerability

NVD CRITICAL: CVE-2026-17186 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute ...

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

CVE-2026-17186
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-17184 — IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute ...

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

CVE-2026-17184
NIST NVD