Hoch 7.5Software
CVE-2026-126081
Action Pack: Possible Strong Parameters Bypass in Parameters#each_key
actionpack, actionpack
### Impact `ActionController::Parameters#each_key` delegates to the internal `ActiveSupport::HashWithIndifferentAccess` that holds the request parameters, so when called with a block it returns that hash instead of the `Parameters` instance. The hash does not respond to `permitted?`, so Active Model mass assignment (`new`, `assign_attributes`, `update`) accepts it without raising `ActiveModel::ForbiddenAttributesError`. An application that passes the return value of…
10. Nov 2026
Original bei NVD öffnen