TarsWeb vulnerabilities

2 known vulnerabilities in TarsWeb from TarsCloud. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  TarsWeb: Authentication Bypass by Spoofing

  CVE-2026-80349Aug 26, 2026TarsCloud

  TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request

• 8.8 High severity

  TarsWeb: Missing Authorization

  CVE-2026-80348Aug 26, 2026TarsCloud

  TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a depl