Authentication Bypass
Monthly
Insufficient authorization checks in SAP Incentive and Commission Management allow authenticated users to invoke remote-enabled function modules and perform unauthorized table update operations, compromising data integrity. The vulnerability requires valid user credentials and network access but has limited scope - no confidentiality or availability impact. CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact; no active exploitation or public POC identified at analysis time.
Missing authorization checks in SAP S/4HANA Condition Maintenance allow authenticated attackers to view and modify condition table records they should not have access to, compromising data confidentiality and integrity while potentially denying legitimate users access to those same records. The vulnerability requires valid user credentials but affects all versions of the affected module, with CVSS 6.3 reflecting its multi-faceted impact across three security dimensions.
Missing authorization checks in SAP Strategic Enterprise Management's Scorecard Wizard (Business Server Pages application) allow authenticated users to access restricted information and modify risk evaluation settings without proper authorization. An attacker with valid credentials can view confidential data and alter default configuration values, artificially reducing assessed risk levels to deceive risk assessment processes. No patch availability or active exploitation has been confirmed.
mem0 1.0.0 server exposes an unauthenticated memory deletion API endpoint (DELETE /memories) that allows remote attackers to delete arbitrary user memory records by specifying user identifiers in query parameters, resulting in unauthorized data loss and denial of service. No authentication or authorization validation is performed before processing deletion requests, enabling any network-accessible attacker to target any user's data without credentials.
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Broken authorization logic across two sequential sharing API calls in Outline collaborative documentation (prior to 1.7.0) allows any authenticated low-privilege user to publish arbitrary documents as publicly accessible shares, exposing content to unauthenticated users without possessing legitimate share rights over the target document. The flaw exploits a permission gap in shares.create (which skips share-permission validation when published=false) combined with a disjunctive OR policy in shares.update that can be satisfied by unrelated collection-level share permissions. No public exploit code repository has been identified in the provided references, though SSVC classifies exploitation evidence at POC level; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.04% (12th percentile), indicating low current real-world exploitation.
Screen capture via improper camera metadata access affects Apple iOS, iPadOS, and visionOS, allowing a locally installed app to capture the user's screen without explicit permission. Affected platforms include iOS and iPadOS versions prior to 18.7.9 and 26.5, and visionOS prior to 26.5. The vulnerability carries a CVSS score of 3.3 (Low), EPSS of 0.02% (4th percentile), no CISA KEV listing, and SSVC exploitation status of none - indicating this is a low-urgency privacy concern rather than an active threat, though the privacy implications for end users are non-trivial.
Local authenticated apps bypass user consent mechanisms to access sensitive user data across iOS 18.7.8 and earlier, iPadOS 18.7.8 and earlier, macOS Sequoia 15.7.6 and earlier, macOS Sonoma 14.8.6 and earlier, macOS Tahoe 26.4 and earlier, and visionOS 26.4 and earlier. The vulnerability allows malicious or compromised applications running with standard user privileges to exfiltrate protected information without triggering the expected permission prompts. Apple has patched this by implementing an additional consent verification layer, though the low EPSS score (0.02%) suggests real-world exploitation remains limited.
Privacy bypass in Apple operating systems allows local authenticated apps to circumvent user-configured privacy restrictions through permission mishandling. The vulnerability affects iOS, iPadOS, macOS Tahoe, visionOS, and watchOS versions prior to 26.5. An attacker with local app execution privileges can access sensitive data classified as restricted by user privacy settings, though without authentication bypass or integrity compromise. Fixed in coordinated OS updates across Apple's ecosystem.
Missing authorization checks in Apple macOS allow a locally installed app to access sensitive user data by exploiting improper state management during authorization decisions. All macOS versions prior to Tahoe 26.4 are affected per CPE data. Apple has patched the issue in macOS Tahoe 26.4; no public exploit has been identified and EPSS sits at the 5th percentile, indicating negligible opportunistic exploitation probability at time of analysis.
Improper permissions checking in macOS before version 26.4 allows a malicious app with local user privileges to access arbitrary files without user interaction, potentially exposing sensitive data. The vulnerability has a low EPSS score (0.01%) and no confirmed active exploitation, making it a low-priority but real local privilege escalation risk for systems where untrusted applications may execute.
Gatekeeper security checks in macOS Tahoe can be bypassed using maliciously crafted ZIP archives due to a logic flaw in file handling. An attacker can create a weaponized ZIP file that, when extracted or opened by a user, circumvents Gatekeeper validation, potentially allowing execution of untrusted code. The vulnerability requires user interaction (opening or extracting the malicious archive) and is limited to local attack surface. Vendor-released patch: macOS Tahoe 26.5.
Audiobookshelf prior to version 2.32.2 fails to enforce library access controls on the GET /api/collections and GET /api/collections/:id endpoints, allowing authenticated users to enumerate and retrieve collection metadata and book information from libraries they are not authorized to access. An attacker with valid credentials to any library can exploit this privilege escalation to discover sensitive metadata across all libraries in a multi-library installation.
Authenticated users with download permissions in Audiobookshelf prior to 2.32.2 can download files from libraries they do not have access to by directly specifying item IDs in the GET /api/libraries/:id/download endpoint, bypassing library access controls. An attacker with valid credentials and access to any single library can exfiltrate complete file contents from restricted libraries, including those explicitly denied to them.
Authentication bypass in Inkeep Agents 0.58.14 allows remote unauthenticated attackers to circumvent authentication controls via alternate channel manipulation in the runAuth middleware. The vulnerability exists in the createDevContext function of agents-api/src/middleware/runAuth.ts, enabling unauthorized access to protected resources with low impact to confidentiality, integrity, and availability. Publicly available exploit code exists (GitHub issue #3024), and the vendor has not yet responded to the vulnerability report, meaning no patch is currently available.
Authorization bypass in MantisBT's mc_issue_update() SOAP API function allows authenticated UPDATER-role users to modify bugnotes authored by higher-privileged users - including DEVELOPERs, MANAGERs, and ADMINs - circumventing the stricter per-note threshold enforced by the dedicated mc_issue_note_update() function. Affected deployments running MantisBT <= 2.28.1 are exposed to note content tampering, exposure of private internal discussions, and suppression of public notes from reporters. No public exploit has been identified at time of analysis; EPSS of 0.04% (12th percentile) confirms low observed exploitation probability.
Authorization bypass in MantisBT's REST API attachment upload endpoint permits any authenticated project member to attach files to private issues they are not permitted to view. Versions up to and including 2.28.1 are affected via the Composer package mantisbt/mantisbt. No public exploit code exists and CISA SSVC assessment confirms no active exploitation; the real-world threat is limited to insider or compromised-account scenarios where an attacker knows or can enumerate private issue IDs.
Privilege escalation in MantisBT allows authenticated project managers to grant project-level administrator access to any user - including themselves - by submitting a forged access_level value to the ProjectUsersAddCommand handler via manage_proj_user_add.php or the REST API endpoint PUT /project/{id}/users. The frontend form correctly restricts selectable access levels to the actor's own role or below, but the backend command (versions <= 2.28.1) performs no equivalent server-side enforcement, accepting and persisting the elevated value. A proof-of-concept exists per SSVC data; however, real-world impact is bounded to project-scoped privilege elevation and does not confer instance-wide administrative capabilities such as managing users, plugins, or custom fields globally.
Summarize versions through 0.14.1 create daemon configuration files with world-readable permissions, allowing local attackers with user-level access to read bearer tokens and API credentials from ~/.summarize/daemon.json. The vulnerability enables unauthorized daemon access or recovery of sensitive provider API keys through insecure file permissions on Unix-like systems.
MantisBT 2.28.0-2.28.1 allows authenticated users with add_profile_threshold permission to create global profiles by tampering with the user_id parameter, bypassing the manage_global_profile_threshold authorization check. An attacker with low-privileged authentication can escalate their profile creation capabilities to global scope via direct parameter manipulation in the profile creation request.
Bitwarden Server prior to v2026.4.1 allows any authenticated user to write ciphers (encrypted credentials) into arbitrary organizations via the POST /ciphers/import-organization endpoint by submitting an empty collections array, bypassing authorization checks. This missing authorization vulnerability (CWE-862) affects all authenticated users regardless of organization membership, enabling them to inject malicious credentials or pivot across organizations. Publicly available exploit code exists, and the vendor has released patched version 2026.4.1.
OpenClaw before 2026.4.20 allows attackers to bypass the hooks.allowRequestSessionKey opt-in restriction via template-rendered session keys in hook mappings, circumventing webhook routing isolation controls. The vulnerability enables externally influenced session keys to be rendered through templated hook mappings even when the opt-in is disabled, affecting webhook routing isolation but not enabling host execution. Vendor-released patch available (version 2026.4.20); no public exploit code identified at time of analysis.
Prompt-injected AI models can escalate privileges and persist unauthorized configuration changes in OpenClaw gateway before version 2026.4.20 via insufficient authorization guards on agent-facing config.patch and config.apply endpoints. Authenticated attackers (PR:L) with model tool access can disable sandbox policies, enable malicious plugins, modify TLS/authentication settings, alter SSRF protections, reconfigure MCP servers, and weaken filesystem hardening-effectively bypassing operator-enforced security boundaries. Vendor-released patch available in version 2026.4.20. No evidence of active exploitation; EPSS data not available for this recently disclosed vulnerability.
OpenClaw before version 2026.4.20 allows authenticated local agents to bypass tool policy restrictions by appending bundled MCP and LSP tools to the effective tool set after policy filtering has completed. Attackers with local agent access can circumvent profile policies, allow/deny lists, owner-only restrictions, sandbox policies, and subagent policies, potentially gaining unauthorized access to restricted tools. This vulnerability requires a configured bundled tool source and an operator-defined restrictive policy; no active exploitation has been identified.
OpenClaw before 2026.4.22 fails to propagate security envelope constraints when spawning ACP child sessions, allowing authenticated restricted subagents to bypass depth limits, child-count restrictions, control scope, and target-agent constraints. An attacker with subagent privileges can exploit this by spawning child sessions that inherit insufficient security enforcement, potentially escalating privileges or accessing resources beyond their assigned scope.
Authentication bypass in OpenClaw before version 2026.4.22 allows unauthenticated attackers to read sensitive bootstrap and configuration metadata from the Control UI config endpoint when Gateway authentication is enabled. The vulnerability exposes internal bootstrap information and configuration fields intended only for authenticated Control UI sessions via an unprotected HTTP GET request to the `/__openclaw/control-ui-config.json` endpoint, with no user interaction required.
OpenClaw before version 2026.4.20 misclassifies direct messages as group conversations in Feishu card-action callbacks, allowing authenticated attackers to bypass dmPolicy restrictions and trigger card-action flows that should have been blocked. The vulnerability affects direct message handling in the Feishu integration and requires authenticated access (PR:L per CVSS vector) but achieves both confidentiality and integrity impact with moderate CVSS score of 5.4.
Authorization bypass in OpenClaw before 2026.4.21 allows non-owner senders to execute owner-enforced slash commands when channels are configured with wildcard inbound senders (allowFrom: ["*"]) without explicit owner allowFrom settings. Attackers with legitimate channel access can exploit this to bypass owner-only command authorization checks and execute commands such as /send, /config, or /debug. The vulnerability requires authenticated access to affected channels but is limited to command-owner authorization and does not grant tool access or gateway administrator scope.
Authentication bypass in OpenClaw's BlueBubbles webhook handler allows remote attackers to send crafted webhook requests without credentials. The handleBlueBubblesWebhookRequest function in extensions/bluebubbles/src/monitor.ts incorrectly exempts localhost requests from authentication, enabling IP spoofing attacks to bypass security controls. Exploit code is publicly available on GitHub. Patch released in version 2026.2.12 (commit a6653be). CVSS 7.3 reflects network-accessible unauthenticated attack with low complexity affecting confidentiality, integrity, and availability.
pgAdmin 4 before version 9.15 allows unauthenticated attackers to bypass account lockout and perform unbounded password-guessing attacks against INTERNAL authentication accounts by exploiting Flask-Security's default /login endpoint, which does not enforce the locked column that the custom /authenticate/login view relies on for brute-force protection. The vulnerability affects only accounts using pgAdmin's INTERNAL authentication source; LDAP, OAuth2, Kerberos, and Webserver authentication methods are not vulnerable because they do not use local passwords.
Improper authorization in Open WebUI versions up to 0.8.5 allows authenticated users to modify messages in standard channels by exploiting a read-permission check that should require write permission. The vulnerability affects the POST /api/v1/channels/{channel_id}/messages/{message_id}/update endpoint when access_control is set to None, enabling message tampering without ownership verification. Patch available in version 0.8.6.
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentication flow execution, allowing privileged users in one organization to trigger authentication logic on other organizations. An attacker with adaptive authentication configuration privileges can exploit this context validation gap to bypass authorization boundaries, escalate privileges, and gain unauthorized access to user accounts and resources across organizational boundaries.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Module allows accounts that have been administratively or automatically locked to still authenticate through the Magic Link and Passkey (FIDO2) flows, because those paths do not validate account state. An attacker in possession of a valid magic link or passkey for a locked account can reach the application and its sensitive data despite the lock, and the lockout control intended to stop further login attempts is rendered ineffective. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not in CISA KEV.
Net::CIDR::Lite before version 0.24 accepts CIDR mask values with extraneous leading zeros (such as '/00' or '/01'), causing them to parse identically to their unpadded equivalents ('/0' or '/1'). This permits attackers to bypass IP-based access control lists by supplying alternate representations of the same network prefix, potentially granting unauthorized access to restricted resources. The vulnerability affects all Perl installations using vulnerable versions of this library and is rated with CVSS 6.5 (moderate integrity and availability impact). No active exploitation has been confirmed by CISA, but the flaw is automatable and exploitable remotely without authentication.
Net::CIDR::Lite Perl module versions before 0.24 fail to properly validate IP address and CIDR mask inputs, allowing attackers to bypass IP-based access control lists by supplying malformed addresses that are re-encoded differently by the parser. Inputs with trailing newlines or non-ASCII digit characters pass validation but resolve to unintended IP addresses, causing find() and bin_find() functions to incorrectly match or miss addresses. This affects network security controls that rely on CIDR matching for authorization decisions.
OpenCart 3.0.36 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper authentication in Industrial Application Software IAS Canias ERP 8.03 allows unauthenticated remote attackers to bypass login authentication by manipulating the clientVersion argument in the Login RMI Interface component. The vulnerability enables unauthorized access to the ERP system without valid credentials. Publicly available exploit code exists and the vendor has not responded to disclosure attempts.
Improper authorization in Industrial Application Software IAS Canias ERP 8.03 allows unauthenticated remote attackers to obtain sensitive information via the iasGetServerInfoEvent function in the RMI Interface. The vulnerability has a publicly available exploit and CVSS score of 5.3 (medium severity) with confidentiality impact but no integrity or availability impact. The vendor did not respond to early disclosure.
Improper access controls in Dotouch XproUPF 2.0.0 (release 088aa7c4) allow local authenticated attackers to bypass authentication mechanisms and gain unauthorized access to restricted functionality within the UPF component. The vulnerability requires high attack complexity and valid user credentials but affects confidentiality, integrity, and availability of the affected system. No public exploit code or active exploitation has been identified at time of analysis.
Improper authentication in IAS Canias ERP 8.03 allows remote unauthenticated attackers to bypass authentication via the iasServerRemoteInterface.doAction function in the Java RMI Session Management component, granting unauthorized access to ERP functionality without valid credentials. CVSS 6.9 indicates moderate severity with low confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis.
Authentication bypass in IAS Canias ERP 8.03 RMI Interface allows remote attackers to manipulate the sessionId parameter in the doAction function, circumventing authentication controls without requiring credentials or user interaction. Publicly available exploit code exists, and the vendor has not responded to disclosure efforts, leaving affected deployments without an official patch.
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.
Unauthenticated attackers can bypass REST API authentication in the Logtivity plugin (versions up to 3.3.6) via a logic flaw in the verifyAuthorization method, allowing direct access to the /wp-json/logtivity/v1/options endpoint and disclosure of sensitive configuration including the logtivity_site_api_key. This key can be leveraged to impersonate the affected WordPress site in API calls to the Logtivity service. CVSS 5.3 (low confidentiality impact) reflects information disclosure severity; no active exploitation in CISA KEV at time of analysis.
Missing authentication in UGREEN CM933 1.1.59.4319 administrative interface allows unauthenticated local network attackers to manipulate an unknown function, potentially gaining unauthorized access with limited confidentiality, integrity, and availability impact. No public exploit code has been identified, and the vendor has committed to a fix in late April.
Unauthenticated attackers can bypass access controls in HikCentral Professional to obtain administrative permissions, enabling unauthorized management and configuration of security infrastructure. The vulnerability requires network access and non-trivial complexity but grants high-impact confidentiality and scope expansion across affected deployments. No public exploit code has been identified, though Hikvision has released a security advisory confirming the issue.
HCL BigFix WebUI exposes sensitive environmental information to authenticated users who lack proper authorization through direct URL access to restricted pages. An authenticated low-privilege user can bypass access controls by directly navigating to unauthorized endpoints, resulting in unintended disclosure of environmental configuration data. No public exploit or active exploitation has been identified; EPSS sits at 0.03% (9th percentile) and SSVC rates exploitation as none with only partial technical impact.
Improper authorization in HCL BigFix WebUI exposes internal configuration data to authenticated users who lack Master Operator privileges. Authenticated low-privilege users can reach unprotected internal endpoints - which also lack adequate security response headers - to retrieve site names, software versions, and configuration variables that should be restricted to operators. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation pressure at time of analysis.
Improper validation of NumericDate claims (exp, nbf, iat) in hono/utils/jwt allows crafted JWT tokens with malformed time-based claims to silently bypass expiration and validity checks. This affects applications using Hono versions prior to 4.12.18. Exploitation requires the attacker to control token issuance or possess the signing key - unauthenticated remote exploitation is not possible. The vulnerability stems from combined short-circuiting logic that fails to reject non-finite, falsy, or non-numeric claim values as required by RFC 7519.
PgBouncer before version 1.25.2 fails to properly restrict the KILL_CLIENT admin command to authorized users, allowing any user with access to the administration console to terminate client connections. The vulnerability affects all PgBouncer versions before 1.25.2 and requires prior authentication to the admin console, limiting the real-world risk despite the authorization bypass. CVSS 4.3 reflects low availability impact but highlights a privilege escalation within authenticated contexts.
Signature binding bypass in gitsign (versions prior to 0.16.0) allows a crafted malformed git commit to pass `gitsign verify` while git-core resolves it to entirely different, attacker-controlled content. The tool re-encodes commit objects through go-git's `EncodeWithoutSignature` before signature verification rather than verifying raw bytes; for commits with duplicate `tree` headers, go-git silently uses the second tree while git-core uses the first, creating a parsing divergence that an attacker can exploit to replay any existing legitimate signature over a new commit pointing to malicious content - without possessing any signing key. A detailed proof-of-concept is publicly available; no active exploitation is confirmed in CISA KEV, and EPSS sits at 0.02% (5th percentile), reflecting the high attack complexity required.
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
Unauthorized boolean field manipulation in nova-toggle-5 (versions prior to 1.3.0) allows any user authenticated on the shared Laravel web guard to call the Nova toggle endpoint and flip boolean columns on any model - even without Nova admin access. The endpoint's attribute parameter accepted arbitrary column names, bypassing field-level exposure controls and permitting writes to columns never declared as Toggle fields. No public exploit has been identified (EPSS 0.03%, SSVC exploitation: none), but the integrity impact is rated High because critical boolean flags such as is_admin or is_active on any resource are writable.
TLS certificate validation is unconditionally disabled in the OpenTelemetry.Exporter.Instana NuGet package (versions <= 1.0.7) whenever the INSTANA_ENDPOINT_PROXY environment variable is set to any valid proxy URL, exposing all outbound telemetry and the Instana API key to network-level man-in-the-middle interception. The Transport.ConfigureBackendClient() method hard-codes this insecure behavior with no mechanism for callers to re-enable validation without upgrading. No public exploit has been identified and EPSS is negligible (0.01%, 0th percentile), but successful exploitation yields silent, persistent credential and observability data theft.
Unauthorized access to private RAG file and knowledge base content in Open WebUI (versions ≤ 0.8.12) is possible because three of five code paths in the `get_sources_from_items` function pass user-supplied collection names directly to the vector store without any authorization check, making access revocation ineffective at the RAG layer. Authenticated users who previously held access to a file or knowledge base - or who learn the predictable collection name format (`file-<uuid>`) - can continue extracting full document content via the chat completion API long after their access was revoked. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, but attack complexity is low and the impact is complete confidentiality loss of targeted private documents.
Channel membership authorization bypass in Open WebUI (versions prior to 0.9.0) allows authenticated former channel members to retain full read and write access to private group and DM channels via direct API calls after being removed. The flaw exists in `is_user_channel_member` (`backend/open_webui/models/channels.py`, lines 663-673), which checks for the existence of a `ChannelMember` row but omits validation of the `is_active` field - meaning deactivated membership rows still pass the authorization gate used by all 15 message-level endpoints. A proof-of-concept is confirmed by SSVC data; however, EPSS remains low at 0.03% (7th percentile) and the vulnerability is not listed in CISA KEV, reflecting its precondition-heavy exploitation path rather than broad opportunistic risk.
Read-only users in Open WebUI can modify collaborative documents via Socket.IO by emitting crafted `ydoc:document:update` events that bypass write permission checks, allowing them to inject, modify, or delete content visible to all collaborators in real time. While direct database persistence requires write access, tampered content becomes permanent if any write-enabled user saves the document, undermining the read/write permission model for collaborative editing.
Open WebUI Ollama proxy endpoints bypass model access control checks, allowing authenticated users to access restricted models and expose sensitive configuration. Four endpoints (/api/generate, /api/embed, /api/embeddings, /api/show) fail to validate AccessGrants permissions before forwarding requests to the Ollama backend, despite the /api/chat endpoint implementing proper authorization checks. Attackers with any valid user account can consume GPU resources on restricted models and view sensitive details like system prompts by directly calling unprotected endpoints with known model names.
Open WebUI's POST /api/v1/models/import endpoint allows authenticated users with workspace.models_import permission to overwrite any existing model in the database without ownership validation, silently replacing system prompts, base model routing, and access grants. This enables a low-privilege user to hijack organization-wide models and inject malicious behavior affecting all downstream queries. The vulnerability bypasses access grant restrictions enforced on all other model mutation endpoints by never calling filter_allowed_access_grants.
Open WebUI versions up to 0.8.12 allow authenticated users to enumerate members of private standard channels via the GET /api/v1/channels/{id}/members endpoint, which lacks access control checks present on other channel endpoints. An attacker who knows a private channel's UUID can retrieve the full list of members including their names, emails, roles, and profile images, enabling targeted social engineering and organizational structure reconnaissance. The vulnerability is fixed in version 0.9.0.
Open WebUI versions up to 0.8.12 allow authenticated users to bypass channel access control restrictions by directly persisting arbitrary access grants without applying the `filter_allowed_access_grants()` validation used consistently across other resource types. An attacker with channel creation or ownership privileges can grant public read access (via wildcard principal grants) or individual user access, circumventing admin-configured sharing permission policies. This affects installations where administrators restrict public sharing or user-grant capabilities to specific roles.
Mass assignment vulnerability in Open WebUI's folder creation endpoint allows authenticated attackers to create folders in other users' accounts by exploiting Pydantic's extra='allow' configuration. An attacker with a valid account can supply an arbitrary user_id in the POST request body, overwriting the server-assigned value and persisting folders under a victim's account without their knowledge. The attacker can use this to plant phishing content, spam folders, or degrade user experience for targeted victims.
Authentication bypass in Scoold prior to version 1.67.0 allows high-privileged attackers to inject arbitrary administrator email addresses via the /api/config/set/admins endpoint using a forged Bearer token, establishing persistent administrative access after application restart. The vulnerability exploits insufficient token validation in the configuration API, enabling attackers to escalate privileges reliably by injecting their own email into the admin configuration file, which is loaded on startup.
Authentication bypass in gitsign --verify allows attackers to make unsigned or invalid commits appear verified when callers check only exit codes. CertVerifier.Verify() unconditionally dereferences the first certificate from a PKCS7 signature without validating that certificates exist; a crafted signature with an empty certificate set causes an index-out-of-range panic that is silently recovered by internal error handling, returning exit code 0 instead of an error. Exit-code-only verification callers (scripts, CI pipelines) misinterpret this panic as successful verification, while git's own status-fd verification path is partially protected by checking for the GOODSIG status token. The vulnerability affects gitsign versions 0.4.0 through 0.14.x; confirmed actively exploited is not indicated, but a working proof-of-concept exists in the advisory.
External Secrets Operator versions 0.1.0 through 2.4.0 allow authenticated users with ExternalSecret creation permissions to escalate privileges by crafting Service Account token templates that cause the operator to generate long-lived tokens for any service account in the namespace. An attacker can impersonate service accounts without requiring direct TokenRequest or Secret creation permissions, effectively bypassing RBAC controls. The attack requires the attacker already has ExternalSecret creation permissions and the cluster must have service account token generation enabled, limiting the practical scope to already-privileged users seeking lateral privilege expansion within a namespace.
MCP Registry's GitHub OIDC token exchange allows cross-registry replay attacks due to use of a shared global audience string instead of registry-specific identifiers. An attacker controlling or observing any registry deployment can capture a legitimately issued OIDC token and replay it to another registry instance sharing the same codebase to obtain publish-capable JWTs for the victim GitHub owner namespace, breaking deployment isolation. The vulnerability affects all versions prior to 1.7.6; vendor-released patch available.
Langfuse versions 3.68.0 through 3.166.x contain an insufficient access control flaw allowing authenticated project members to modify LLM connection endpoints and exfiltrate stored provider API keys in plaintext. An attacker with 'member' role can update an existing LLM connection's baseUrl to an attacker-controlled server, causing Langfuse to reuse the stored provider secret and redirect test requests to that endpoint, exposing credentials like OpenAI API keys. The vulnerability requires prior project membership but no elevated privileges; it was patched in version 3.167.0.
System-hang denial-of-service in the Linux kernel's sched_ext (SCX) extensible scheduler subsystem allows a local low-privileged attacker to indefinitely starve the scx_enable() thread by saturating fair-class workloads, causing the system to hang. Affected are kernel versions containing the SCX subsystem from the introduction commit 8c2090c504e998c8f34ec870bae71dafcc96a6e0 through multiple stable branches including 6.12.x before 6.12.78 and 6.18.x/6.19.x series. EPSS exploitation probability is 0.02% (5th percentile) with no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local users with low privileges can trigger a denial of service in Linux kernel KVM (Kernel-based Virtual Machine) by manipulating nested virtualization state on AMD SVM systems. The vulnerability allows unprivileged users to cause a kernel warning and potential system instability by modifying CPUID after loading CR3 register state in nested SVM configurations. With CVSS 5.5 (AV:L/AC:L/PR:L) and low EPSS (0.02%), this represents a localized availability risk rather than a critical remote threat. Vendor patches are available across multiple kernel versions (5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0).
Apache CloudStack's MinIO integration fails to clean up bucket access policies when buckets are deleted, enabling previous bucket owners to retain unauthorized access via cached credentials. If another user creates a bucket with the same name, the former owner gains read/write access using their old access keys. CISA has not listed this CVE in KEV, indicating no confirmed widespread exploitation. CVSS 8.0 reflects high impact but requires authenticated access and user interaction (PR:L/UI:R), tempering immediate urgency. Patch available in CloudStack 4.20.3.0 and 4.22.0.1.
Improper authorization logic in the CloudStack Backup plugin allows authenticated users to enumerate backups from any account in the environment across versions 4.21.0.0 through 4.22.0.0. An attacker with valid user credentials can exploit this to gain unauthorized visibility into backup metadata and existence across all accounts, though backup contents remain protected. The vulnerability requires the Backup plugin to be enabled and affects multi-tenant CloudStack environments where account isolation is a critical security boundary.
Cross-organization time-entry modification in solidtime 0.12.0 allows authenticated users with time-entries:update:all permission in their own organization to modify and rebind time entries belonging to different organizations by exploiting insufficient route-parameter validation in the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} endpoint. An attacker can supply a known foreign time-entry UUID and reassign it to projects within their own organization, causing unauthorized data manipulation across organizational boundaries. Vendor-released patch: version 0.12.1.
Onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 expose an authorization bypass in the GET /chat/file/{file_id} endpoint that permits authenticated users to download any other user's files by directly accessing file UUIDs. The endpoint enforces authentication but lacks per-file ownership validation, allowing attackers with valid credentials to exfiltrate confidential documents and chat attachments belonging to other users system-wide. No public exploit code or active exploitation has been identified at time of analysis.
Onyx versions before 3.0.9, 3.1.6, and 3.2.6 permit authenticated users to terminate any other user's active chat session via the POST /chat/stop-chat-session/{chat_session_id} endpoint without verifying session ownership. An attacker with valid credentials can interrupt another user's LLM generation mid-stream by supplying a known session UUID, causing denial of service to targeted chat sessions. Vendor-released patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
AsusPTPFilter driver allows local authenticated users to bypass security mechanisms via crafted IOCTL requests, potentially leaking restricted touchpad information or disabling the touchpad entirely. The vulnerability requires local access and low-level privileges but impacts the integrity and availability of the touchpad subsystem. CVSS 2.0 reflects limited scope (low severity across confidentiality, integrity, availability), but the attack vector is local and requires existing user privileges.
Improper access controls in eladmin up to version 2.7 allow authenticated remote attackers to bypass user level checks through the checkLevel function in the Users API Endpoint (/rest/UserController.java), resulting in unauthorized access to resources. Publicly available exploit code exists, and the vendor has not responded to early notification of the vulnerability.
Authenticated code execution in Netgate pfSense CE 2.8.0 is claimed via the XMLRPC API method pfsense.exec_php, which runs attacker-supplied PHP on the firewall. Netgate publicly disputes this as a vulnerability because pfsense.exec_php is restricted to administrators, who are by design permitted to execute PHP, meaning the CVSS 9.9 rating reflects an intended admin capability rather than a privilege boundary being crossed. Publicly available exploit code exists (SSVC PoC), but EPSS is 0.01% and it is not in CISA KEV, indicating no observed active exploitation.
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GitHub Enterprise Server versions prior to 3.21 contain an authentication bypass vulnerability that allows unauthenticated attackers to create local user accounts and establish sessions without validation by the configured external identity provider. The vulnerability affects instances with external authentication enabled, permitting account creation via the signup endpoint with default base permissions. Attack requires only network access and affects all affected versions across the 3.16-3.20 branch.
FreeScout versions prior to 1.8.217 allow authenticated users with PERM_EDIT_USERS permission to read and modify notification subscriptions of any other user, including administrators, via a single POST request. This authorization bypass enables attackers to silently disable admin notifications, suppressing security alerts and conversation assignments without detection. The vulnerability is a sibling of CVE-2025-48472, indicating incomplete patching of a related code path.
Wallos versions 4.8.4 and prior allow authenticated users to bypass webhook URL restrictions and send server-side requests to administrator-allowlisted internal targets by reusing the global allowlist for individual user webhooks. This enables Server-Side Request Forgery (SSRF) to internal automation services that may expose deployment or execution APIs, potentially leading to remote code execution on downstream systems. No public exploit code identified at time of analysis, and no vendor-released patch is available.
Missing authorization controls in bPlugins PDF Poster WordPress plugin versions up to 2.4.1 allow unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control. The vulnerability exposes limited confidential data without requiring authentication or user interaction, affecting all default installations of the affected plugin versions.
Missing authorization controls in the Magepeople Inc. Bus Ticket Booking with Seat Reservation WordPress plugin allow unauthenticated remote attackers to modify data (such as ticket bookings or seat reservations) through incorrectly configured access control security levels. The vulnerability affects versions before 5.6.8 and has a CVSS score of 5.3 (medium severity) with a network attack vector requiring no authentication or user interaction.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.
Insufficient authorization checks in SAP Incentive and Commission Management allow authenticated users to invoke remote-enabled function modules and perform unauthorized table update operations, compromising data integrity. The vulnerability requires valid user credentials and network access but has limited scope - no confidentiality or availability impact. CVSS 4.3 (low) reflects the authentication requirement and integrity-only impact; no active exploitation or public POC identified at analysis time.
Missing authorization checks in SAP S/4HANA Condition Maintenance allow authenticated attackers to view and modify condition table records they should not have access to, compromising data confidentiality and integrity while potentially denying legitimate users access to those same records. The vulnerability requires valid user credentials but affects all versions of the affected module, with CVSS 6.3 reflecting its multi-faceted impact across three security dimensions.
Missing authorization checks in SAP Strategic Enterprise Management's Scorecard Wizard (Business Server Pages application) allow authenticated users to access restricted information and modify risk evaluation settings without proper authorization. An attacker with valid credentials can view confidential data and alter default configuration values, artificially reducing assessed risk levels to deceive risk assessment processes. No patch availability or active exploitation has been confirmed.
mem0 1.0.0 server exposes an unauthenticated memory deletion API endpoint (DELETE /memories) that allows remote attackers to delete arbitrary user memory records by specifying user identifiers in query parameters, resulting in unauthorized data loss and denial of service. No authentication or authorization validation is performed before processing deletion requests, enabling any network-accessible attacker to target any user's data without credentials.
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Broken authorization logic across two sequential sharing API calls in Outline collaborative documentation (prior to 1.7.0) allows any authenticated low-privilege user to publish arbitrary documents as publicly accessible shares, exposing content to unauthenticated users without possessing legitimate share rights over the target document. The flaw exploits a permission gap in shares.create (which skips share-permission validation when published=false) combined with a disjunctive OR policy in shares.update that can be satisfied by unrelated collection-level share permissions. No public exploit code repository has been identified in the provided references, though SSVC classifies exploitation evidence at POC level; the vulnerability is not listed in CISA KEV, and EPSS sits at 0.04% (12th percentile), indicating low current real-world exploitation.
Screen capture via improper camera metadata access affects Apple iOS, iPadOS, and visionOS, allowing a locally installed app to capture the user's screen without explicit permission. Affected platforms include iOS and iPadOS versions prior to 18.7.9 and 26.5, and visionOS prior to 26.5. The vulnerability carries a CVSS score of 3.3 (Low), EPSS of 0.02% (4th percentile), no CISA KEV listing, and SSVC exploitation status of none - indicating this is a low-urgency privacy concern rather than an active threat, though the privacy implications for end users are non-trivial.
Local authenticated apps bypass user consent mechanisms to access sensitive user data across iOS 18.7.8 and earlier, iPadOS 18.7.8 and earlier, macOS Sequoia 15.7.6 and earlier, macOS Sonoma 14.8.6 and earlier, macOS Tahoe 26.4 and earlier, and visionOS 26.4 and earlier. The vulnerability allows malicious or compromised applications running with standard user privileges to exfiltrate protected information without triggering the expected permission prompts. Apple has patched this by implementing an additional consent verification layer, though the low EPSS score (0.02%) suggests real-world exploitation remains limited.
Privacy bypass in Apple operating systems allows local authenticated apps to circumvent user-configured privacy restrictions through permission mishandling. The vulnerability affects iOS, iPadOS, macOS Tahoe, visionOS, and watchOS versions prior to 26.5. An attacker with local app execution privileges can access sensitive data classified as restricted by user privacy settings, though without authentication bypass or integrity compromise. Fixed in coordinated OS updates across Apple's ecosystem.
Missing authorization checks in Apple macOS allow a locally installed app to access sensitive user data by exploiting improper state management during authorization decisions. All macOS versions prior to Tahoe 26.4 are affected per CPE data. Apple has patched the issue in macOS Tahoe 26.4; no public exploit has been identified and EPSS sits at the 5th percentile, indicating negligible opportunistic exploitation probability at time of analysis.
Improper permissions checking in macOS before version 26.4 allows a malicious app with local user privileges to access arbitrary files without user interaction, potentially exposing sensitive data. The vulnerability has a low EPSS score (0.01%) and no confirmed active exploitation, making it a low-priority but real local privilege escalation risk for systems where untrusted applications may execute.
Gatekeeper security checks in macOS Tahoe can be bypassed using maliciously crafted ZIP archives due to a logic flaw in file handling. An attacker can create a weaponized ZIP file that, when extracted or opened by a user, circumvents Gatekeeper validation, potentially allowing execution of untrusted code. The vulnerability requires user interaction (opening or extracting the malicious archive) and is limited to local attack surface. Vendor-released patch: macOS Tahoe 26.5.
Audiobookshelf prior to version 2.32.2 fails to enforce library access controls on the GET /api/collections and GET /api/collections/:id endpoints, allowing authenticated users to enumerate and retrieve collection metadata and book information from libraries they are not authorized to access. An attacker with valid credentials to any library can exploit this privilege escalation to discover sensitive metadata across all libraries in a multi-library installation.
Authenticated users with download permissions in Audiobookshelf prior to 2.32.2 can download files from libraries they do not have access to by directly specifying item IDs in the GET /api/libraries/:id/download endpoint, bypassing library access controls. An attacker with valid credentials and access to any single library can exfiltrate complete file contents from restricted libraries, including those explicitly denied to them.
Authentication bypass in Inkeep Agents 0.58.14 allows remote unauthenticated attackers to circumvent authentication controls via alternate channel manipulation in the runAuth middleware. The vulnerability exists in the createDevContext function of agents-api/src/middleware/runAuth.ts, enabling unauthorized access to protected resources with low impact to confidentiality, integrity, and availability. Publicly available exploit code exists (GitHub issue #3024), and the vendor has not yet responded to the vulnerability report, meaning no patch is currently available.
Authorization bypass in MantisBT's mc_issue_update() SOAP API function allows authenticated UPDATER-role users to modify bugnotes authored by higher-privileged users - including DEVELOPERs, MANAGERs, and ADMINs - circumventing the stricter per-note threshold enforced by the dedicated mc_issue_note_update() function. Affected deployments running MantisBT <= 2.28.1 are exposed to note content tampering, exposure of private internal discussions, and suppression of public notes from reporters. No public exploit has been identified at time of analysis; EPSS of 0.04% (12th percentile) confirms low observed exploitation probability.
Authorization bypass in MantisBT's REST API attachment upload endpoint permits any authenticated project member to attach files to private issues they are not permitted to view. Versions up to and including 2.28.1 are affected via the Composer package mantisbt/mantisbt. No public exploit code exists and CISA SSVC assessment confirms no active exploitation; the real-world threat is limited to insider or compromised-account scenarios where an attacker knows or can enumerate private issue IDs.
Privilege escalation in MantisBT allows authenticated project managers to grant project-level administrator access to any user - including themselves - by submitting a forged access_level value to the ProjectUsersAddCommand handler via manage_proj_user_add.php or the REST API endpoint PUT /project/{id}/users. The frontend form correctly restricts selectable access levels to the actor's own role or below, but the backend command (versions <= 2.28.1) performs no equivalent server-side enforcement, accepting and persisting the elevated value. A proof-of-concept exists per SSVC data; however, real-world impact is bounded to project-scoped privilege elevation and does not confer instance-wide administrative capabilities such as managing users, plugins, or custom fields globally.
Summarize versions through 0.14.1 create daemon configuration files with world-readable permissions, allowing local attackers with user-level access to read bearer tokens and API credentials from ~/.summarize/daemon.json. The vulnerability enables unauthorized daemon access or recovery of sensitive provider API keys through insecure file permissions on Unix-like systems.
MantisBT 2.28.0-2.28.1 allows authenticated users with add_profile_threshold permission to create global profiles by tampering with the user_id parameter, bypassing the manage_global_profile_threshold authorization check. An attacker with low-privileged authentication can escalate their profile creation capabilities to global scope via direct parameter manipulation in the profile creation request.
Bitwarden Server prior to v2026.4.1 allows any authenticated user to write ciphers (encrypted credentials) into arbitrary organizations via the POST /ciphers/import-organization endpoint by submitting an empty collections array, bypassing authorization checks. This missing authorization vulnerability (CWE-862) affects all authenticated users regardless of organization membership, enabling them to inject malicious credentials or pivot across organizations. Publicly available exploit code exists, and the vendor has released patched version 2026.4.1.
OpenClaw before 2026.4.20 allows attackers to bypass the hooks.allowRequestSessionKey opt-in restriction via template-rendered session keys in hook mappings, circumventing webhook routing isolation controls. The vulnerability enables externally influenced session keys to be rendered through templated hook mappings even when the opt-in is disabled, affecting webhook routing isolation but not enabling host execution. Vendor-released patch available (version 2026.4.20); no public exploit code identified at time of analysis.
Prompt-injected AI models can escalate privileges and persist unauthorized configuration changes in OpenClaw gateway before version 2026.4.20 via insufficient authorization guards on agent-facing config.patch and config.apply endpoints. Authenticated attackers (PR:L) with model tool access can disable sandbox policies, enable malicious plugins, modify TLS/authentication settings, alter SSRF protections, reconfigure MCP servers, and weaken filesystem hardening-effectively bypassing operator-enforced security boundaries. Vendor-released patch available in version 2026.4.20. No evidence of active exploitation; EPSS data not available for this recently disclosed vulnerability.
OpenClaw before version 2026.4.20 allows authenticated local agents to bypass tool policy restrictions by appending bundled MCP and LSP tools to the effective tool set after policy filtering has completed. Attackers with local agent access can circumvent profile policies, allow/deny lists, owner-only restrictions, sandbox policies, and subagent policies, potentially gaining unauthorized access to restricted tools. This vulnerability requires a configured bundled tool source and an operator-defined restrictive policy; no active exploitation has been identified.
OpenClaw before 2026.4.22 fails to propagate security envelope constraints when spawning ACP child sessions, allowing authenticated restricted subagents to bypass depth limits, child-count restrictions, control scope, and target-agent constraints. An attacker with subagent privileges can exploit this by spawning child sessions that inherit insufficient security enforcement, potentially escalating privileges or accessing resources beyond their assigned scope.
Authentication bypass in OpenClaw before version 2026.4.22 allows unauthenticated attackers to read sensitive bootstrap and configuration metadata from the Control UI config endpoint when Gateway authentication is enabled. The vulnerability exposes internal bootstrap information and configuration fields intended only for authenticated Control UI sessions via an unprotected HTTP GET request to the `/__openclaw/control-ui-config.json` endpoint, with no user interaction required.
OpenClaw before version 2026.4.20 misclassifies direct messages as group conversations in Feishu card-action callbacks, allowing authenticated attackers to bypass dmPolicy restrictions and trigger card-action flows that should have been blocked. The vulnerability affects direct message handling in the Feishu integration and requires authenticated access (PR:L per CVSS vector) but achieves both confidentiality and integrity impact with moderate CVSS score of 5.4.
Authorization bypass in OpenClaw before 2026.4.21 allows non-owner senders to execute owner-enforced slash commands when channels are configured with wildcard inbound senders (allowFrom: ["*"]) without explicit owner allowFrom settings. Attackers with legitimate channel access can exploit this to bypass owner-only command authorization checks and execute commands such as /send, /config, or /debug. The vulnerability requires authenticated access to affected channels but is limited to command-owner authorization and does not grant tool access or gateway administrator scope.
Authentication bypass in OpenClaw's BlueBubbles webhook handler allows remote attackers to send crafted webhook requests without credentials. The handleBlueBubblesWebhookRequest function in extensions/bluebubbles/src/monitor.ts incorrectly exempts localhost requests from authentication, enabling IP spoofing attacks to bypass security controls. Exploit code is publicly available on GitHub. Patch released in version 2026.2.12 (commit a6653be). CVSS 7.3 reflects network-accessible unauthenticated attack with low complexity affecting confidentiality, integrity, and availability.
pgAdmin 4 before version 9.15 allows unauthenticated attackers to bypass account lockout and perform unbounded password-guessing attacks against INTERNAL authentication accounts by exploiting Flask-Security's default /login endpoint, which does not enforce the locked column that the custom /authenticate/login view relies on for brute-force protection. The vulnerability affects only accounts using pgAdmin's INTERNAL authentication source; LDAP, OAuth2, Kerberos, and Webserver authentication methods are not vulnerable because they do not use local passwords.
Improper authorization in Open WebUI versions up to 0.8.5 allows authenticated users to modify messages in standard channels by exploiting a read-permission check that should require write permission. The vulnerability affects the POST /api/v1/channels/{channel_id}/messages/{message_id}/update endpoint when access_control is set to None, enabling message tampering without ownership verification. Patch available in version 0.8.6.
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentication flow execution, allowing privileged users in one organization to trigger authentication logic on other organizations. An attacker with adaptive authentication configuration privileges can exploit this context validation gap to bypass authorization boundaries, escalate privileges, and gain unauthorized access to user accounts and resources across organizational boundaries.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Module allows accounts that have been administratively or automatically locked to still authenticate through the Magic Link and Passkey (FIDO2) flows, because those paths do not validate account state. An attacker in possession of a valid magic link or passkey for a locked account can reach the application and its sensitive data despite the lock, and the lockout control intended to stop further login attempts is rendered ineffective. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not in CISA KEV.
Net::CIDR::Lite before version 0.24 accepts CIDR mask values with extraneous leading zeros (such as '/00' or '/01'), causing them to parse identically to their unpadded equivalents ('/0' or '/1'). This permits attackers to bypass IP-based access control lists by supplying alternate representations of the same network prefix, potentially granting unauthorized access to restricted resources. The vulnerability affects all Perl installations using vulnerable versions of this library and is rated with CVSS 6.5 (moderate integrity and availability impact). No active exploitation has been confirmed by CISA, but the flaw is automatable and exploitable remotely without authentication.
Net::CIDR::Lite Perl module versions before 0.24 fail to properly validate IP address and CIDR mask inputs, allowing attackers to bypass IP-based access control lists by supplying malformed addresses that are re-encoded differently by the parser. Inputs with trailing newlines or non-ASCII digit characters pass validation but resolve to unintended IP addresses, causing find() and bin_find() functions to incorrectly match or miss addresses. This affects network security controls that rely on CIDR matching for authorization decisions.
OpenCart 3.0.36 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Plugin Download From Files version 1.48 and earlier contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting the AJAX. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCATS 0.9.4 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by uploading malicious PHP files disguised as resume attachments. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress MStore API 2.0.6 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to the REST API endpoint. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting crafted requests to the AJAX. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper authentication in Industrial Application Software IAS Canias ERP 8.03 allows unauthenticated remote attackers to bypass login authentication by manipulating the clientVersion argument in the Login RMI Interface component. The vulnerability enables unauthorized access to the ERP system without valid credentials. Publicly available exploit code exists and the vendor has not responded to disclosure attempts.
Improper authorization in Industrial Application Software IAS Canias ERP 8.03 allows unauthenticated remote attackers to obtain sensitive information via the iasGetServerInfoEvent function in the RMI Interface. The vulnerability has a publicly available exploit and CVSS score of 5.3 (medium severity) with confidentiality impact but no integrity or availability impact. The vendor did not respond to early disclosure.
Improper access controls in Dotouch XproUPF 2.0.0 (release 088aa7c4) allow local authenticated attackers to bypass authentication mechanisms and gain unauthorized access to restricted functionality within the UPF component. The vulnerability requires high attack complexity and valid user credentials but affects confidentiality, integrity, and availability of the affected system. No public exploit code or active exploitation has been identified at time of analysis.
Improper authentication in IAS Canias ERP 8.03 allows remote unauthenticated attackers to bypass authentication via the iasServerRemoteInterface.doAction function in the Java RMI Session Management component, granting unauthorized access to ERP functionality without valid credentials. CVSS 6.9 indicates moderate severity with low confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed at time of analysis.
Authentication bypass in IAS Canias ERP 8.03 RMI Interface allows remote attackers to manipulate the sessionId parameter in the doAction function, circumventing authentication controls without requiring credentials or user interaction. Publicly available exploit code exists, and the vendor has not responded to disclosure efforts, leaving affected deployments without an official patch.
Authentication bypass in JeecgBoot 3.9.1 mLogin endpoint allows remote attackers to circumvent login controls via manipulation of an unspecified function in LoginController.java, resulting in unauthorized access with confidentiality impact. The vulnerability has high attack complexity and difficult exploitability, but publicly available exploit code exists and the vendor has not responded to disclosure.
Unauthenticated attackers can bypass REST API authentication in the Logtivity plugin (versions up to 3.3.6) via a logic flaw in the verifyAuthorization method, allowing direct access to the /wp-json/logtivity/v1/options endpoint and disclosure of sensitive configuration including the logtivity_site_api_key. This key can be leveraged to impersonate the affected WordPress site in API calls to the Logtivity service. CVSS 5.3 (low confidentiality impact) reflects information disclosure severity; no active exploitation in CISA KEV at time of analysis.
Missing authentication in UGREEN CM933 1.1.59.4319 administrative interface allows unauthenticated local network attackers to manipulate an unknown function, potentially gaining unauthorized access with limited confidentiality, integrity, and availability impact. No public exploit code has been identified, and the vendor has committed to a fix in late April.
Unauthenticated attackers can bypass access controls in HikCentral Professional to obtain administrative permissions, enabling unauthorized management and configuration of security infrastructure. The vulnerability requires network access and non-trivial complexity but grants high-impact confidentiality and scope expansion across affected deployments. No public exploit code has been identified, though Hikvision has released a security advisory confirming the issue.
HCL BigFix WebUI exposes sensitive environmental information to authenticated users who lack proper authorization through direct URL access to restricted pages. An authenticated low-privilege user can bypass access controls by directly navigating to unauthorized endpoints, resulting in unintended disclosure of environmental configuration data. No public exploit or active exploitation has been identified; EPSS sits at 0.03% (9th percentile) and SSVC rates exploitation as none with only partial technical impact.
Improper authorization in HCL BigFix WebUI exposes internal configuration data to authenticated users who lack Master Operator privileges. Authenticated low-privilege users can reach unprotected internal endpoints - which also lack adequate security response headers - to retrieve site names, software versions, and configuration variables that should be restricted to operators. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation pressure at time of analysis.
Improper validation of NumericDate claims (exp, nbf, iat) in hono/utils/jwt allows crafted JWT tokens with malformed time-based claims to silently bypass expiration and validity checks. This affects applications using Hono versions prior to 4.12.18. Exploitation requires the attacker to control token issuance or possess the signing key - unauthenticated remote exploitation is not possible. The vulnerability stems from combined short-circuiting logic that fails to reject non-finite, falsy, or non-numeric claim values as required by RFC 7519.
PgBouncer before version 1.25.2 fails to properly restrict the KILL_CLIENT admin command to authorized users, allowing any user with access to the administration console to terminate client connections. The vulnerability affects all PgBouncer versions before 1.25.2 and requires prior authentication to the admin console, limiting the real-world risk despite the authorization bypass. CVSS 4.3 reflects low availability impact but highlights a privilege escalation within authenticated contexts.
Signature binding bypass in gitsign (versions prior to 0.16.0) allows a crafted malformed git commit to pass `gitsign verify` while git-core resolves it to entirely different, attacker-controlled content. The tool re-encodes commit objects through go-git's `EncodeWithoutSignature` before signature verification rather than verifying raw bytes; for commits with duplicate `tree` headers, go-git silently uses the second tree while git-core uses the first, creating a parsing divergence that an attacker can exploit to replay any existing legitimate signature over a new commit pointing to malicious content - without possessing any signing key. A detailed proof-of-concept is publicly available; no active exploitation is confirmed in CISA KEV, and EPSS sits at 0.02% (5th percentile), reflecting the high attack complexity required.
Improper authorization on personal note sharing endpoints in SysReptor versions 2026.4 through 2026.26 allows authenticated low-privileged attackers who obtain a victim's note ID to enumerate and create sharing links for that user's personal notes, yielding full read and write access to the victim's note content. The flaw is an IDOR (CWE-639) affecting both Professional and Community editions, though Community has no practical impact because all Community users already hold superuser permissions. No public exploit code has been identified and EPSS sits at 0.02%, indicating negligible opportunistic exploitation risk despite SSVC rating the technical impact as total. A patched release (2026.27) is available.
Unauthorized boolean field manipulation in nova-toggle-5 (versions prior to 1.3.0) allows any user authenticated on the shared Laravel web guard to call the Nova toggle endpoint and flip boolean columns on any model - even without Nova admin access. The endpoint's attribute parameter accepted arbitrary column names, bypassing field-level exposure controls and permitting writes to columns never declared as Toggle fields. No public exploit has been identified (EPSS 0.03%, SSVC exploitation: none), but the integrity impact is rated High because critical boolean flags such as is_admin or is_active on any resource are writable.
TLS certificate validation is unconditionally disabled in the OpenTelemetry.Exporter.Instana NuGet package (versions <= 1.0.7) whenever the INSTANA_ENDPOINT_PROXY environment variable is set to any valid proxy URL, exposing all outbound telemetry and the Instana API key to network-level man-in-the-middle interception. The Transport.ConfigureBackendClient() method hard-codes this insecure behavior with no mechanism for callers to re-enable validation without upgrading. No public exploit has been identified and EPSS is negligible (0.01%, 0th percentile), but successful exploitation yields silent, persistent credential and observability data theft.
Unauthorized access to private RAG file and knowledge base content in Open WebUI (versions ≤ 0.8.12) is possible because three of five code paths in the `get_sources_from_items` function pass user-supplied collection names directly to the vector store without any authorization check, making access revocation ineffective at the RAG layer. Authenticated users who previously held access to a file or knowledge base - or who learn the predictable collection name format (`file-<uuid>`) - can continue extracting full document content via the chat completion API long after their access was revoked. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, but attack complexity is low and the impact is complete confidentiality loss of targeted private documents.
Channel membership authorization bypass in Open WebUI (versions prior to 0.9.0) allows authenticated former channel members to retain full read and write access to private group and DM channels via direct API calls after being removed. The flaw exists in `is_user_channel_member` (`backend/open_webui/models/channels.py`, lines 663-673), which checks for the existence of a `ChannelMember` row but omits validation of the `is_active` field - meaning deactivated membership rows still pass the authorization gate used by all 15 message-level endpoints. A proof-of-concept is confirmed by SSVC data; however, EPSS remains low at 0.03% (7th percentile) and the vulnerability is not listed in CISA KEV, reflecting its precondition-heavy exploitation path rather than broad opportunistic risk.
Read-only users in Open WebUI can modify collaborative documents via Socket.IO by emitting crafted `ydoc:document:update` events that bypass write permission checks, allowing them to inject, modify, or delete content visible to all collaborators in real time. While direct database persistence requires write access, tampered content becomes permanent if any write-enabled user saves the document, undermining the read/write permission model for collaborative editing.
Open WebUI Ollama proxy endpoints bypass model access control checks, allowing authenticated users to access restricted models and expose sensitive configuration. Four endpoints (/api/generate, /api/embed, /api/embeddings, /api/show) fail to validate AccessGrants permissions before forwarding requests to the Ollama backend, despite the /api/chat endpoint implementing proper authorization checks. Attackers with any valid user account can consume GPU resources on restricted models and view sensitive details like system prompts by directly calling unprotected endpoints with known model names.
Open WebUI's POST /api/v1/models/import endpoint allows authenticated users with workspace.models_import permission to overwrite any existing model in the database without ownership validation, silently replacing system prompts, base model routing, and access grants. This enables a low-privilege user to hijack organization-wide models and inject malicious behavior affecting all downstream queries. The vulnerability bypasses access grant restrictions enforced on all other model mutation endpoints by never calling filter_allowed_access_grants.
Open WebUI versions up to 0.8.12 allow authenticated users to enumerate members of private standard channels via the GET /api/v1/channels/{id}/members endpoint, which lacks access control checks present on other channel endpoints. An attacker who knows a private channel's UUID can retrieve the full list of members including their names, emails, roles, and profile images, enabling targeted social engineering and organizational structure reconnaissance. The vulnerability is fixed in version 0.9.0.
Open WebUI versions up to 0.8.12 allow authenticated users to bypass channel access control restrictions by directly persisting arbitrary access grants without applying the `filter_allowed_access_grants()` validation used consistently across other resource types. An attacker with channel creation or ownership privileges can grant public read access (via wildcard principal grants) or individual user access, circumventing admin-configured sharing permission policies. This affects installations where administrators restrict public sharing or user-grant capabilities to specific roles.
Mass assignment vulnerability in Open WebUI's folder creation endpoint allows authenticated attackers to create folders in other users' accounts by exploiting Pydantic's extra='allow' configuration. An attacker with a valid account can supply an arbitrary user_id in the POST request body, overwriting the server-assigned value and persisting folders under a victim's account without their knowledge. The attacker can use this to plant phishing content, spam folders, or degrade user experience for targeted victims.
Authentication bypass in Scoold prior to version 1.67.0 allows high-privileged attackers to inject arbitrary administrator email addresses via the /api/config/set/admins endpoint using a forged Bearer token, establishing persistent administrative access after application restart. The vulnerability exploits insufficient token validation in the configuration API, enabling attackers to escalate privileges reliably by injecting their own email into the admin configuration file, which is loaded on startup.
Authentication bypass in gitsign --verify allows attackers to make unsigned or invalid commits appear verified when callers check only exit codes. CertVerifier.Verify() unconditionally dereferences the first certificate from a PKCS7 signature without validating that certificates exist; a crafted signature with an empty certificate set causes an index-out-of-range panic that is silently recovered by internal error handling, returning exit code 0 instead of an error. Exit-code-only verification callers (scripts, CI pipelines) misinterpret this panic as successful verification, while git's own status-fd verification path is partially protected by checking for the GOODSIG status token. The vulnerability affects gitsign versions 0.4.0 through 0.14.x; confirmed actively exploited is not indicated, but a working proof-of-concept exists in the advisory.
External Secrets Operator versions 0.1.0 through 2.4.0 allow authenticated users with ExternalSecret creation permissions to escalate privileges by crafting Service Account token templates that cause the operator to generate long-lived tokens for any service account in the namespace. An attacker can impersonate service accounts without requiring direct TokenRequest or Secret creation permissions, effectively bypassing RBAC controls. The attack requires the attacker already has ExternalSecret creation permissions and the cluster must have service account token generation enabled, limiting the practical scope to already-privileged users seeking lateral privilege expansion within a namespace.
MCP Registry's GitHub OIDC token exchange allows cross-registry replay attacks due to use of a shared global audience string instead of registry-specific identifiers. An attacker controlling or observing any registry deployment can capture a legitimately issued OIDC token and replay it to another registry instance sharing the same codebase to obtain publish-capable JWTs for the victim GitHub owner namespace, breaking deployment isolation. The vulnerability affects all versions prior to 1.7.6; vendor-released patch available.
Langfuse versions 3.68.0 through 3.166.x contain an insufficient access control flaw allowing authenticated project members to modify LLM connection endpoints and exfiltrate stored provider API keys in plaintext. An attacker with 'member' role can update an existing LLM connection's baseUrl to an attacker-controlled server, causing Langfuse to reuse the stored provider secret and redirect test requests to that endpoint, exposing credentials like OpenAI API keys. The vulnerability requires prior project membership but no elevated privileges; it was patched in version 3.167.0.
System-hang denial-of-service in the Linux kernel's sched_ext (SCX) extensible scheduler subsystem allows a local low-privileged attacker to indefinitely starve the scx_enable() thread by saturating fair-class workloads, causing the system to hang. Affected are kernel versions containing the SCX subsystem from the introduction commit 8c2090c504e998c8f34ec870bae71dafcc96a6e0 through multiple stable branches including 6.12.x before 6.12.78 and 6.18.x/6.19.x series. EPSS exploitation probability is 0.02% (5th percentile) with no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local users with low privileges can trigger a denial of service in Linux kernel KVM (Kernel-based Virtual Machine) by manipulating nested virtualization state on AMD SVM systems. The vulnerability allows unprivileged users to cause a kernel warning and potential system instability by modifying CPUID after loading CR3 register state in nested SVM configurations. With CVSS 5.5 (AV:L/AC:L/PR:L) and low EPSS (0.02%), this represents a localized availability risk rather than a critical remote threat. Vendor patches are available across multiple kernel versions (5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0).
Apache CloudStack's MinIO integration fails to clean up bucket access policies when buckets are deleted, enabling previous bucket owners to retain unauthorized access via cached credentials. If another user creates a bucket with the same name, the former owner gains read/write access using their old access keys. CISA has not listed this CVE in KEV, indicating no confirmed widespread exploitation. CVSS 8.0 reflects high impact but requires authenticated access and user interaction (PR:L/UI:R), tempering immediate urgency. Patch available in CloudStack 4.20.3.0 and 4.22.0.1.
Improper authorization logic in the CloudStack Backup plugin allows authenticated users to enumerate backups from any account in the environment across versions 4.21.0.0 through 4.22.0.0. An attacker with valid user credentials can exploit this to gain unauthorized visibility into backup metadata and existence across all accounts, though backup contents remain protected. The vulnerability requires the Backup plugin to be enabled and affects multi-tenant CloudStack environments where account isolation is a critical security boundary.
Cross-organization time-entry modification in solidtime 0.12.0 allows authenticated users with time-entries:update:all permission in their own organization to modify and rebind time entries belonging to different organizations by exploiting insufficient route-parameter validation in the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} endpoint. An attacker can supply a known foreign time-entry UUID and reassign it to projects within their own organization, causing unauthorized data manipulation across organizational boundaries. Vendor-released patch: version 0.12.1.
Onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 expose an authorization bypass in the GET /chat/file/{file_id} endpoint that permits authenticated users to download any other user's files by directly accessing file UUIDs. The endpoint enforces authentication but lacks per-file ownership validation, allowing attackers with valid credentials to exfiltrate confidential documents and chat attachments belonging to other users system-wide. No public exploit code or active exploitation has been identified at time of analysis.
Onyx versions before 3.0.9, 3.1.6, and 3.2.6 permit authenticated users to terminate any other user's active chat session via the POST /chat/stop-chat-session/{chat_session_id} endpoint without verifying session ownership. An attacker with valid credentials can interrupt another user's LLM generation mid-stream by supplying a known session UUID, causing denial of service to targeted chat sessions. Vendor-released patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
AsusPTPFilter driver allows local authenticated users to bypass security mechanisms via crafted IOCTL requests, potentially leaking restricted touchpad information or disabling the touchpad entirely. The vulnerability requires local access and low-level privileges but impacts the integrity and availability of the touchpad subsystem. CVSS 2.0 reflects limited scope (low severity across confidentiality, integrity, availability), but the attack vector is local and requires existing user privileges.
Improper access controls in eladmin up to version 2.7 allow authenticated remote attackers to bypass user level checks through the checkLevel function in the Users API Endpoint (/rest/UserController.java), resulting in unauthorized access to resources. Publicly available exploit code exists, and the vendor has not responded to early notification of the vulnerability.
Authenticated code execution in Netgate pfSense CE 2.8.0 is claimed via the XMLRPC API method pfsense.exec_php, which runs attacker-supplied PHP on the firewall. Netgate publicly disputes this as a vulnerability because pfsense.exec_php is restricted to administrators, who are by design permitted to execute PHP, meaning the CVSS 9.9 rating reflects an intended admin capability rather than a privilege boundary being crossed. Publicly available exploit code exists (SSVC PoC), but EPSS is 0.01% and it is not in CISA KEV, indicating no observed active exploitation.
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
GitHub Enterprise Server versions prior to 3.21 contain an authentication bypass vulnerability that allows unauthenticated attackers to create local user accounts and establish sessions without validation by the configured external identity provider. The vulnerability affects instances with external authentication enabled, permitting account creation via the signup endpoint with default base permissions. Attack requires only network access and affects all affected versions across the 3.16-3.20 branch.
FreeScout versions prior to 1.8.217 allow authenticated users with PERM_EDIT_USERS permission to read and modify notification subscriptions of any other user, including administrators, via a single POST request. This authorization bypass enables attackers to silently disable admin notifications, suppressing security alerts and conversation assignments without detection. The vulnerability is a sibling of CVE-2025-48472, indicating incomplete patching of a related code path.
Wallos versions 4.8.4 and prior allow authenticated users to bypass webhook URL restrictions and send server-side requests to administrator-allowlisted internal targets by reusing the global allowlist for individual user webhooks. This enables Server-Side Request Forgery (SSRF) to internal automation services that may expose deployment or execution APIs, potentially leading to remote code execution on downstream systems. No public exploit code identified at time of analysis, and no vendor-released patch is available.
Missing authorization controls in bPlugins PDF Poster WordPress plugin versions up to 2.4.1 allow unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control. The vulnerability exposes limited confidential data without requiring authentication or user interaction, affecting all default installations of the affected plugin versions.
Missing authorization controls in the Magepeople Inc. Bus Ticket Booking with Seat Reservation WordPress plugin allow unauthenticated remote attackers to modify data (such as ticket bookings or seat reservations) through incorrectly configured access control security levels. The vulnerability affects versions before 5.6.8 and has a CVSS score of 5.3 (medium severity) with a network attack vector requiring no authentication or user interaction.
Authorization bypass in YITH WooCommerce Wishlist through version 4.12.0 allows unauthenticated remote attackers to modify wishlist data via user-controlled object references, exploiting improper access control validation. The vulnerability enables integrity attacks against wishlist functionality without requiring authentication or user interaction, affecting all WordPress installations using the vulnerable plugin.