CVE-2026-7250

CVE-2026-6552: A remote, authenticated threat actor without any user interaction can exploit this vulnerability in the Group SAML identity management functionality to take over another group member’s account. CVE-2026-10087: A network based, authenticated threat actor with developer-role permissions can exploit this vulnerability in the Analytics Dashboard to execute arbitrary code. The attacker can only achieve that if they manage to make the user interact with a malicious payload, which can then use the user’s browser to run client-side code. CVE-2026-7250: A remote, unauthenticated threat actor without any user interaction can exploit this vulnerability in the Grape API JSON parsing middleware to cause system disruption and eventually system crash and denial-of-service. CVE-2026-8589: A network based, authenticated threat actor with high privileges and with user interaction can exploit this vulnerability in the group setting fields to add modify user accounts without authorization using HMTL injection, for example by adding emails to another user’s account. That can allow the attacker to compromise other accounts and steal sensitive data from them.

EPSS 0.63% · 45.5th percentile