Monthly
Improper authorization in OpenMRS allows any authenticated low-privilege user to invoke the `startHl7ArchiveMigration` DWR service, an administrative method that should be restricted to admin-level accounts. Affected versions are OpenMRS core prior to 1.23.0 (1.x branch) and prior to 2.10.0 (2.x branch), both patched by their respective releases. No public exploit has been identified at time of analysis, though exploitation requires only a valid session, keeping the practical barrier low for any credentialed system user.
Privilege escalation in Shopper Framework v2.8.0-v2.9.1 allows any authenticated staff member holding only the read-only view_users permission to perform three critical administrative actions: self-escalate by granting arbitrary permissions to their own role, create new admin-privileged team members with attacker-chosen credentials, and delete RBAC roles causing cascading privilege loss for all affected users. The flaw is a direct regression of the partially-applied security fix in PR #511 (GHSA-f946-9qp6-vgch) - three Livewire component authorization gates were left checking view_users instead of access_setting, including one gate in a file introduced by the security fix commit itself. No external exploit tooling has been identified at time of analysis, but Shopper's own regression test suite at commit fcd0c59 functions as documented proof-of-concept, with view_users-only actors passing all three attack-path tests.
Unauthenticated administrator account creation affects GetSimple CMS (v3.4.0a and earlier) and its community edition GetSimpleCMS-CE (v3.3.22 and earlier), where a self-exclusion bug in the post-installation cleanup logic leaves admin/setup.php reachable on production sites. Any remote attacker can invoke the still-present setup script to register a new administrator, yielding full control of the CMS. No patched version exists at publication and no public exploit has been identified, though the flaw is trivially reproducible from the advisory description.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Local privilege escalation in Xbox Gaming Services (versions 19.0.0.0 through <37.114.10001.0) allows a low-privileged authenticated local attacker to gain full SYSTEM-level or administrator access via improper authorization checks (CWE-285). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation requiring only an existing user session with no additional complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, and a vendor patch is available from Microsoft.
Improper authorization in the DDM (Distributed Data Management) target dispatcher on IBM i 7.3 through 7.6 allows remote, unauthenticated attackers to manipulate database transactions across the network. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) confirms the path is fully network-exposed with no credential requirement, though high attack complexity suggests specific conditions - such as DDM service availability and potentially specific network positioning - must be met. IBM has released a patch via its support portal; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Improper authorization in Craft CMS 5.x allows any authenticated control panel user to change their own password without supplying the current credential or holding an elevated session, and allows users holding the `Edit users` permission to reset other users' passwords - including administrator accounts - enabling full account takeover. The flaw exists in the `elements/save` action, where the `UserPasswordValidator` mass-assigns the `newPassword` field outside of any scenario restriction, bypassing the dedicated `users/set-password` action that enforces elevated session checks. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in version 5.10.8.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
Improper authorization in OpenMRS allows any authenticated low-privilege user to invoke the `startHl7ArchiveMigration` DWR service, an administrative method that should be restricted to admin-level accounts. Affected versions are OpenMRS core prior to 1.23.0 (1.x branch) and prior to 2.10.0 (2.x branch), both patched by their respective releases. No public exploit has been identified at time of analysis, though exploitation requires only a valid session, keeping the practical barrier low for any credentialed system user.
Privilege escalation in Shopper Framework v2.8.0-v2.9.1 allows any authenticated staff member holding only the read-only view_users permission to perform three critical administrative actions: self-escalate by granting arbitrary permissions to their own role, create new admin-privileged team members with attacker-chosen credentials, and delete RBAC roles causing cascading privilege loss for all affected users. The flaw is a direct regression of the partially-applied security fix in PR #511 (GHSA-f946-9qp6-vgch) - three Livewire component authorization gates were left checking view_users instead of access_setting, including one gate in a file introduced by the security fix commit itself. No external exploit tooling has been identified at time of analysis, but Shopper's own regression test suite at commit fcd0c59 functions as documented proof-of-concept, with view_users-only actors passing all three attack-path tests.
Unauthenticated administrator account creation affects GetSimple CMS (v3.4.0a and earlier) and its community edition GetSimpleCMS-CE (v3.3.22 and earlier), where a self-exclusion bug in the post-installation cleanup logic leaves admin/setup.php reachable on production sites. Any remote attacker can invoke the still-present setup script to register a new administrator, yielding full control of the CMS. No patched version exists at publication and no public exploit has been identified, though the flaw is trivially reproducible from the advisory description.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows remote authenticated low-privilege users to delete arbitrary RabbitMQ queues or exchanges, causing a denial of service across the platform's messaging infrastructure. The CVSS scope-changed metric (S:C) confirms the impact radiates beyond DataStage itself into the underlying RabbitMQ broker relied upon by dependent platform services, elevating the effective blast radius. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Local privilege escalation in Xbox Gaming Services (versions 19.0.0.0 through <37.114.10001.0) allows a low-privileged authenticated local attacker to gain full SYSTEM-level or administrator access via improper authorization checks (CWE-285). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects straightforward exploitation requiring only an existing user session with no additional complexity. No public exploit code and no CISA KEV listing have been identified at time of analysis, and a vendor patch is available from Microsoft.
Improper authorization in the DDM (Distributed Data Management) target dispatcher on IBM i 7.3 through 7.6 allows remote, unauthenticated attackers to manipulate database transactions across the network. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L) confirms the path is fully network-exposed with no credential requirement, though high attack complexity suggests specific conditions - such as DDM service availability and potentially specific network positioning - must be met. IBM has released a patch via its support portal; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Improper authorization in Craft CMS 5.x allows any authenticated control panel user to change their own password without supplying the current credential or holding an elevated session, and allows users holding the `Edit users` permission to reset other users' passwords - including administrator accounts - enabling full account takeover. The flaw exists in the `elements/save` action, where the `UserPasswordValidator` mass-assigns the `newPassword` field outside of any scenario restriction, bypassing the dedicated `users/set-password` action that enforces elevated session checks. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in version 5.10.8.
Cross-project Kanban data destruction in Vikunja allows any authenticated user to permanently wipe `task_buckets` and `task_positions` for any project view in the entire instance, regardless of project membership. Affecting versions 0.24.6 through 2.4.0, the `ProjectView.Delete` method performs two unscoped cascading SQL deletes using only the URL-supplied view ID after an authorization check that verifies admin rights on the attacker's own project - never confirming the target view belongs to that project. A working PoC is publicly available via the GHSA advisory; view IDs are auto-increment integers, making full-instance enumeration trivial with no prior reconnaissance.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.