Live › vulnerability › CVE-2026-112821
Go to dashboardKnit Pay, a payment plugin, lacks an authorization check on at least one function, so an attacker may reach functionality meant for privileged users. The sources affirm the flaw exists in versions through 9.6.3.0 but do not state the exact action an attacker can perform.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Knit Pay at version or earlier are in scope according to the NVD entry. The sources do not say which configurations or roles make an install exposed, so unknown.
9.6.3.0No product ranges from the sources yet.
9.6.3.09.6.3.0 once a fixed release is published; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-112821")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.