Authorization Flaw

Everything NetSec Observer has reported about Authorization Flaw: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Kiro Crew CVE-2026-112380: Critical Missing Authorization in WhatsApp Channel Enables Remote Command Execution

A critical missing authorization flaw in Kiro Crew allows WhatsApp group members to run arbitrary commands on operator machines unless configurations are locked down.

Oct 20, 2026

Vulnerabilities

InvoiceShelf Token Bypass Allows Cross-Document Data Exposure Before v2.4.0

A high-severity flaw in InvoiceShelf lets attackers use expired or mismatched tokens to view private invoices and estimates from other companies.

Oct 16, 2026