GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-71403: Go Norman Store Update Immutability Bypass Client Data Passthroughcve-2026-71403-go-norman-store-update-immutability-bypass-client-data-passthrough

Norman user store Update() persists the client-controlled request body ($DATA) straight through to the backing store without stripping any keys from it, so the immutable identity fields of a user resource (client.UserFieldUsername and client.UserFieldPrincipalIDs) are written verbatim: a caller holding only the update verb on users.management.cattle.io can r

GoCVE-2026-71403CWE-284CWE-471CWE-915
by Provallyupdated 2026-10-27Apache-2.0
450 direct45 via packs
87
All matching rules loaded.