An editor level user with dashboard sharing access could change a sitewide setting through a REST API endpoint that should have been admin only. Here is the full technical breakdown of the flaw and the one line authorization mistake behind it. CVE ID CVE-2026-10753 Affected plugin Site Kit by Google (google-site-kit), 5M+ active installations Affected … Continue reading CVE-2026-10753: A Broken Access Control Flaw CredShields Found in Google’s Site Kit