Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `get_model` method in `ModelFilesController` (line 158-160) loads models using `Model.find_param(params[:model_id])` without `policy_scope()`, bypassing Pundit authorization. All other controllers correctly use `policy_scope(Model).find_param()` (e.g., `ModelsController` line 263). Version 0.133.1 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-28225 Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1, the `ge… https://www.cve.org/CVERecord?id=CVE-2026-28225
Post summary
The post merely references CVE‑2026‑28225 and provides a link to its CVE record, offering no additional details.
CVE-2026-28225 Authorization Bypass in Manyfold Web Application Prior to Version 0.133.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28225
Post summary
The content announces CVE-2026-28225, an authorization bypass in Manyfold Web Application before version 0.133.1, with a link to a vulnerability details page but no additional exploit or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | manyfold | manyfold | - | - | - |