Tools AI Risk Radar ai-incident-0211
Incident record
AI Puffer role settings can expose global indexing controls
- Severity
- Low
- Status
- Research
- Type
- Infra Vuln
- Target
- AI Puffer through 2.4.89
- Actor
- researcher
- CVE
- CVE-2026-104741
What happened
A subscriber granted access to the Sources module can change site-wide indexing and vector-search settings that should require administrator access.
Wordfence’s CNA record was published on 10 October; the original disclosure date is unconfirmed. An administrator must first grant the lower-privileged role access to the Sources module through Role Manager. The CNA gives CVSS 3.1 score 3.1. Patch status remains unconfirmed as of 11 October.
Sources
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-104741
- GitHub advisory, unreviewedgithub.com/advisories/GHSA-rpm3-pvm2-pgm6
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026