{"action":"Upgrade @mcptoolshop/backpropagate to 1.2.0 or later.","affected":[{"fixed":"1.2.0","introduced":"1.1.0"}],"component":"@mcptoolshop/backpropagate","cve_ids":["CVE-2026-48797"],"ecosystem":"npm","epss":0.00567,"exploited":false,"fixed_versions":["1.2.0"],"ghsa_id":"GHSA-f65r-h4g3-3h9h","id":"tcs_01M5KFEKB891V47PRVDWDAASWG","modified_at":"2026-09-10T03:50:49.335864713Z","published_at":"2026-06-26T20:34:29Z","references":["https://osv.dev/vulnerability/GHSA-f65r-h4g3-3h9h","https://github.com/mcp-tool-shop-org/backpropagate/security/advisories/GHSA-f65r-h4g3-3h9h","https://nvd.nist.gov/vuln/detail/CVE-2026-48797","https://github.com/mcp-tool-shop-org/backpropagate","https://github.com/mcp-tool-shop-org/backpropagate/releases/tag/v1.2.0"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-f65r-h4g3-3h9h#npm/@mcptoolshop/backpropagate","url":"https://osv.dev/vulnerability/GHSA-f65r-h4g3-3h9h"}],"summary":"Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication"}