CVE-2026-59255

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59255
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59255.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59255
Published
2026-07-15T17:03:38.361Z
Modified
2026-07-17T03:47:33.331334393Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
BloodHound Missing Authorization on Custom Node Management API
Details

BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticated user to modify the global graph schema. Attackers with valid session tokens can create, update, or delete custom node types affecting all users and tenants by invoking unprotected POST, PUT, and DELETE operations on the custom-nodes endpoints.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59255.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/specterops/bloodhound

Affected ranges

Type
GIT
Repo
https://github.com/specterops/bloodhound
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4e0022a83a903327b6db7da36e695b90c44c8294
Fixed
8f790351349fd87bcb04377aba84cba6495825b3
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.4.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v5.*
v5.0.0
v5.0.0-rc1
v5.0.10
v5.0.7
v5.0.9
v5.0.9-rc1
v5.0.9-rc2
v5.0.9-rc3
v5.1.0
v5.1.0-rc1
v5.1.0-rc2
v5.10.0-rc1
v5.12.0-rc1
v5.13.0-rc1
v5.14.0-rc1
v5.15.0-rc1
v5.2.0-rc1
v5.3.0-rc1
v5.5.0-rc1
v5.5.0-rc2
v5.6.0-rc1
v5.6.0-rc6
v5.7.0-rc1
v5.8.0-rc1
v5.8.1-rc1
v6.*
v6.0.0-rc1
v6.1.0-rc1
v6.2.0-rc1
v6.3.0-rc1
v6.4.0-rc1
v7.*
v7.0.0-rc1
v7.2.0-rc1
v7.4.0-rc1
v7.5.0-rc1
v7.6.0-rc1
v8.*
v8.0.0-rc1
v8.1.0-rc1
v8.2.0-rc1
v8.3.0-rc1
v8.4.0-rc1
v8.5.0-rc1
v8.7.0-rc1
v9.*
v9.0.0-rc1
v9.1.0-rc1
v9.1.0-rc2
v9.2.0-rc1
v9.3.0-rc1
v9.4.0-rc1
v9.4.0-rc2
v9.4.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59255.json"