Authentication Bypass
Monthly
Broken object-level authorization in Sulu CMS's media move endpoint (prior to 2.6.25 and 3.0.8) allows authenticated backend users to bypass collection-level access controls and exfiltrate restricted media assets. The move API validates permissions against the attacker-supplied collection ID in the request body rather than the media item's actual stored source collection, enabling an authenticated user with edit rights on any collection to relocate content out of a restricted collection they cannot legitimately access. No public exploit has been identified at time of analysis and no KEV listing exists; exploitation is bounded by the requirement for a valid backend account.
Sulu CMS versions prior to 2.6.25 and 3.0.8 allow authenticated admin users to generate or revoke public preview links for any page, article, or snippet - including content in webspaces they are explicitly forbidden from viewing - because PreviewLinkManager::generate() and PreviewLinkManager::revoke() omit the VIEW permission check before executing. The resulting preview URLs are publicly accessible via an opaque token with no authentication required, meaning the attacker or any recipient of the link can read otherwise-restricted CMS content. No public exploit has been identified at time of analysis, but the attack path is straightforward and directly reproducible from the published commit diff and GitHub security advisory.
Missing authentication on the edit endpoint in cu silicon up to version 0.1.5 allows unauthenticated remote attackers to interact with the `create_app` function in `views.py` without any credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no special conditions against a network-accessible deployment, and a publicly available proof-of-concept exploit (E:P) reduces the barrier to abuse. No vendor patch exists; the vendor did not respond to coordinated disclosure, leaving users without an official fix.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Incorrect authorization in Wallos prior to version 4.9.1 allows any authenticated user to consume another user's third-party currency API credentials. The endpoint endpoints/currency/update_exchange.php selects the first Fixer or API Layer provider key stored globally rather than scoping it to the requesting user, meaning a user without their own API key can trigger exchange-rate refreshes that exhaust a different user's API quota. No public exploit has been identified at time of analysis, and the vendor-released patch (v4.9.1) resolves the cross-user data isolation flaw.
Missing authentication on the DownloadPublic endpoint in sdcb chats through version 1.12.0 exposes signed file downloads to unauthenticated remote access, representing a CWE-306 failure in the .NET FileController. The flaw is network-exploitable but carries a CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact. A proof-of-concept exploit has been publicly released, and the vendor has not responded to disclosure, leaving no official patch available.
Tenant isolation is broken in dibo-software diboot 3.8.0, where the `/api/iam/tenant/resource` endpoint fails to enforce access controls on the user-supplied `tenantId` argument. A low-privileged authenticated user can substitute an arbitrary tenant identifier to access or modify resource assignments belonging to other tenants - a classic authorization bypass in a multi-tenant IAM context. A public proof-of-concept exploit has been disclosed; the vendor did not respond to responsible disclosure, leaving no official patch available.
Authorization bypass in dibo-software diboot 3.8.0 exposes the AI Session Endpoint (/api/ai-session/) to insecure direct object reference (IDOR) exploitation, allowing low-privilege authenticated users to access or manipulate AI session resources belonging to other users. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to verify that the requesting user is authorized to act on the referenced session identifier. A public exploit has been disclosed, and the vendor did not respond to early notification - no patch is available at time of analysis.
IP-based access control bypass in MegaEase EaseProbe up to 2.3.0 allows unauthenticated remote attackers to spoof their source IP by manipulating HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP), circumventing middleware-enforced restrictions in the web monitoring interface. The vulnerable logic resides in the `realIP` function within `web/server.go`, which trusts attacker-controlled headers without validating that the request originated from a legitimate trusted proxy. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure.
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.
Broken access control in JoomShaper's Helix Ultimate Joomla template extension (versions prior to 2.2.10) allows authenticated backend users to overwrite layout parameters for arbitrary menu items by calling the save-megamenu-settings AJAX endpoint without holding core.edit or core.admin permissions on the targeted com_menus item. The endpoint fails to enforce Joomla's native per-item and component-level ACL checks server-side, meaning any user with backend access can tamper with menu configurations they do not own. No public exploit code and no CISA KEV listing exist at time of analysis.
Arbitrary file deletion within Joomla's `/images/` directory is achievable in Helix Ultimate versions before 2.2.10 by authenticated Author-level users. The `Blog::remove_image()` method validates that the requesting user holds edit rights over the supplied article ID but performs no ownership check on the accompanying image path parameter (`src`), allowing an author to target files belonging to other articles or other content under `/images/`. On Joomla 3 builds where physical file deletion is triggered, this broken object-level authorization flaw enables destructive content tampering without administrative privileges. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated syslog configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows adjacent-network attackers to alter logging behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The setSyslogCfg function performs no access control checks before applying submitted configuration changes (CWE-284), enabling log suppression or redirection that could obscure evidence of concurrent or subsequent malicious activity. No public exploit code has been identified and the EPSS score of 0.16% reflects minimal current exploitation interest; this vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the internal Wi-Fi client MAC-to-IP mapping table to any attacker with adjacent network access. The getWiFiIpMacTable function in the router's CGI handler fails to enforce authentication, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return a full enumeration of connected wireless clients. No public exploit has been identified at time of analysis; EPSS at 0.16% (6th percentile) reflects minimal observed exploitation interest.
Incorrect access control in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes the setWizardCfg CGI endpoint to unauthenticated reconfiguration by any attacker with adjacent network access. An actor on the same local network segment can issue a crafted POST request to /cgi-bin/cstecgi.cgi to silently overwrite WAN settings, Wi-Fi parameters, or device initialization state without supplying any credentials. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low observed exploitation interest.
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
Four discrete access control defects in DataEase's sharing link module (versions before 2.10.26) allow any authenticated platform user to cross-access password-protected shares, enumerate other users' share mappings, and disrupt share availability by manipulating tickets they do not own. The flaws span ticket validation (cross-share reuse via ShareTicketManage.validateTicket), password-verification bypass of the mandatory-ticket policy (POST /de2api/share/validate), unauthorized ticket mutation/deletion, and insecure user-ID handling in the share enumeration endpoint. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Authorization bypass in ToolJet before v3.16.208 permits any authenticated user to enumerate, create, rename, and delete TooljetDB tables belonging to arbitrary workspaces by supplying a foreign organizationId in the URL path of affected API endpoints. The TooljetDB controller accepts organizationId from the request path without validating it against the requesting user's actual workspace context, completely breaking tenant isolation in multi-workspace deployments. No public exploit code and no CISA KEV listing exist at time of analysis, but the flaw is trivially exploitable by any authenticated user with network access to the instance.
Cross-workspace authorization bypass in ToolJet through 3.0.0-ee-beta.2 exposes TooljetDB table schemas and restricted app definitions to authenticated low-privilege users via the POST /api/v2/resources/export endpoint. Authenticated users can supply an arbitrary organization_id in the request body to extract database schemas belonging to workspaces they are not members of, and can additionally sidestep per-app granular export permissions within their own workspace to retrieve restricted app definitions. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires valid credentials.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
Insecure Direct Object Reference in GROWI's bookmark folder APIs allows authenticated users to retrieve, modify, and delete other users' private bookmark data without authorization. Affected across all tracked versions per CPE data (cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:*), exploitation requires only a valid session - no elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the attack pattern (predictable or enumerable object IDs in API endpoints) is trivially reproducible by any authenticated user.
Incorrect authorization in GROWI exposes other users' bookmark data to unauthenticated remote attackers without any privileges or user interaction. The flaw (CWE-863) indicates that bookmark retrieval endpoints fail to enforce proper access control checks, allowing any network-accessible attacker to enumerate or read bookmark data belonging to arbitrary users. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
FilterForm in ash_phoenix (versions 0.6.0-rc.1 through 2.3.24) exposes private relationship data to authenticated users by resolving attacker-controlled filter path parameters through private Ash relationship traversal rather than the public-only gate. By supplying crafted path or field form values targeting non-public relationships, an authenticated attacker converts query result row counts into a boolean oracle over data the resource author explicitly marked private. The CVSS 4.0 score is 2.3 (Low); no active exploitation is identified and no public proof-of-concept exists at time of analysis.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
Unauthenticated remote attackers can bypass authorization controls in SeaCMS 13.6 via the `/ass.php` endpoint, disclosing premium or paywalled content URLs without valid subscription credentials. The vulnerability exploits CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where a user-supplied parameter determines access rights without server-side validation. A publicly available proof-of-concept is referenced in a GitHub security advisory; no active exploitation has been confirmed by CISA KEV, and impact is confined to information disclosure with no integrity or availability consequences.
Unauthenticated access to the CloudSrvVersionCheck function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to trigger cloud-based firmware update checks by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The root cause is CWE-284 (Improper Access Control) - the function processes requests without verifying caller identity, a systemic pattern observed across multiple CGI handlers in this firmware batch. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.18% (7th percentile) indicates low probability of automated exploitation.
Unauthenticated log erasure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes network defenders to forensic blind spots. The clearTracerouteLog CGI endpoint imposes no access control, allowing any network-reachable attacker to wipe traceroute history via a crafted POST to /cgi-bin/cstecgi.cgi. While integrity impact is rated low (log data only), this capability is routinely used as a cover-tracks primitive following initial compromise of the router or downstream network activity. No active exploitation confirmed; EPSS is 0.18% (7th percentile), consistent with a niche SOHO device.
Unauthenticated LAN configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker on the adjacent network to modify the router's LAN settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setLanCfg handler, which lacks access control enforcement. The attack requires only adjacent network positioning - no credentials, no user interaction - and can alter LAN network parameters such as IP addressing, subnet masks, or gateway settings. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.18%, reflecting low observed interest.
Project restriction bypass in a network address set management component allows an authenticated user within one project to access or manipulate network address sets belonging to another project, violating multi-tenant isolation boundaries. The vulnerability is reported by Ubuntu vendor under GHSA-6v6x-387m-rj4w. No CVSS score, CWE classification, or confirmed patch version is available in the provided intelligence; the following analysis is substantially inferred from the advisory title and source.
NoSQL injection in FastGPT Community Edition 4.10.0-4.14.0 allows unauthenticated remote attackers to bypass authorization on the POST /api/core/chat/getHistories endpoint by embedding MongoDB operators in crafted JSON payloads, exposing chat history titles for all users across the platform. A public proof-of-concept repository (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) exists, materially lowering the exploitation bar. EPSS at 0.33% (26th percentile) indicates no widespread exploitation observed yet, but the zero-authentication-required, low-complexity attack surface makes this a realistic opportunistic threat against internet-exposed deployments.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to delete Wi-Fi schedule entries without credentials by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delWiFiScheduleCfg CGI handler fails to enforce authentication before processing deletion requests, enabling unauthorized modification of time-based Wi-Fi access control policies. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.18% (7th percentile), indicating minimal observed exploitation pressure.
Unauthenticated remote manipulation of wireless roaming configuration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setRoamingCfg function through /cgi-bin/cstecgi.cgi with no access control enforcement, allowing any network-reachable attacker to overwrite roaming behavior via a crafted POST request. The device performs no authentication check before processing configuration changes through this handler, consistent with a broader pattern of access control failures across multiple TOTOLINK T6 CGI endpoints documented in coordinated disclosure repositories. No public exploit code has been identified and EPSS is 0.16%, suggesting limited active exploitation interest at this time.
Incorrect access control in the SystemSettings function of TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes administrative import and export endpoint information to unauthenticated remote attackers. By sending a crafted POST request to /cgi-bin/cstecgi.cgi, an attacker can enumerate configuration management endpoints without any credentials. No public exploit code or CISA KEV listing exists; EPSS at 0.16% (6th percentile) reflects negligible observed exploitation activity, though the disclosed endpoint data could facilitate chained attacks against the device's management API.
Unauthenticated access control bypass in TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows any attacker on the adjacent network to arbitrarily modify Wi-Fi scheduling via the setWiFiScheduleCfg handler. By sending a crafted POST to /cgi-bin/cstecgi.cgi without credentials, an attacker can suppress or extend wireless availability windows, causing service disruption for wireless clients. EPSS at 0.18% (7th percentile) and absence from CISA KEV reflect no known active exploitation at time of analysis.
Unauthenticated write access to the setApWiFiSchCfg function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to arbitrarily overwrite the device's AP wireless availability schedule by posting a crafted request to /cgi-bin/cstecgi.cgi. The CVSS PR:N metric confirms no credentials are required; the attack surface is the standard CGI management endpoint. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.16% (6th percentile), but the unauthenticated network vector makes this trivially reproducible against any device exposing its management interface to untrusted networks.
Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits unauthenticated adjacent-network attackers to overwrite QoS traffic-shaping configuration via a crafted POST to /cgi-bin/cstecgi.cgi, intentionally degrading traffic handling for legitimate network users. The attack requires no credentials and no user interaction, but is bounded to Layer 2 adjacency (LAN or Wi-Fi segment), preventing internet-based exploitation. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) reflects low observed exploitation activity.
Unauthenticated firewall policy manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setIpPortFilterRules function to any attacker on the adjacent network segment. A crafted POST request to /cgi-bin/cstecgi.cgi bypasses all access control (CWE-284) and allows modification of the device's IP/port filtering rules without credentials. No active exploitation is confirmed in CISA KEV, and EPSS at 0.18% (7th percentile) reflects limited opportunistic risk, consistent with the adjacent-only attack vector.
Unauthenticated mesh configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with adjacent network access to overwrite WiFi mesh settings by sending a crafted POST request directly to the /cgi-bin/cstecgi.cgi handler without supplying credentials. The setWiFiMeshConfig function applies no access control check before processing the request, a CWE-284 (Improper Access Control) condition consistent with a pattern of missing authentication enforcement observed across multiple CGI handlers in this firmware. No public exploit is confirmed and EPSS sits at 0.18% (7th percentile), marking this as low exploitation probability, though the adjacent-network-only constraint is the primary practical barrier rather than any authentication requirement.
GraphQL subscription payloads carrying unauthorized record data leak to authenticated subscribers in ash_graphql 1.4.0-1.10.x due to a missing authorization filter in the batch-processing codepath of AshGraphql.Subscription.Batcher. When two or more subscription notifications arrive within the default one-second batching window, only the first is passed through the should_send?/1 authorization gate; all subsequent notifications in the same batch bypass that check entirely and are published to the subscriber's WebSocket connection. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 1.11.0.
Improper authorization in sambitraj Student Management System allows authenticated low-privileged users (students) to access or tamper with other students' records by manipulating the `roll_no` parameter in `student_dashboard.php`. Confirmed by CPE `cpe:2.3:a:sambitraj:student_management_system:*:*:*:*:*:*:*:*`, all commits up to `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5` are affected. A public proof-of-concept is available via a GitHub issue; the project has not responded to disclosure, leaving the flaw unpatched with no KEV listing.
Authentication bypass in Magma 1.9.0's AMF Registration Complete Message Handler allows remote, unauthenticated attackers to manipulate registration state in the 5G core network's Access and Mobility Management Function. The vulnerable code path resides in tasks/amf/amf_fsm.cpp, where the finite state machine processing Registration Complete messages fails to properly verify actor identity per CWE-287. A public proof-of-concept exploit exists (GitHub issue #16020), and no confirmed patch version has been identified at time of analysis.
Broken access control in Admidio's profile_function.php allows any authenticated low-privilege user to enumerate another user's future role memberships by directly invoking the reload_future_memberships endpoint with a known victim UUID. Affected are all Admidio installations running versions prior to 5.0.12. An attacker with a valid account can bypass profile-level authorization to harvest sensitive organizational membership planning data without elevated privileges; no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference in Dolibarr's Users::getGroups REST API endpoint allows any authenticated user to read group memberships of arbitrary users across tenant boundaries without authorization. Versions 10.0.0 through 23.x omit the per-object access check in GET /users/{id}/groups, exposing group names, entity associations, and private notes to any API credential holder. Fixed in 24.0.0; no public exploit or CISA KEV listing identified at time of analysis.
Aggregate authorization bypass in ash_sql 0.1.0 through 0.7.0 allows a caller to receive aggregate data - counts, sums, or lists - computed over rows that a stricter actor- or tenant-scoped filter should have excluded. The root cause is a single-character logical operator error in AshSql.Aggregate.different_queries?/2 (AND instead of OR), causing same-named aggregates carrying different authorization filters to be treated as already-computed identical queries, returning the first-registered broader value. No public exploit has been identified at time of analysis, and the vendor-confirmed fix is available in ash_sql 0.7.1.
Authorization policy bypass in ash_sql (versions 0.4.1 through 0.7.0) silently drops the caller-supplied `exists/2` predicate when a relationship combines a limit or `from_many?` declaration with a `parent(...)`-referencing filter or sort. Policy expressions such as `authorize_if expr(exists(memberships, user_id == ^actor(:id)))` degenerate to matching any actor that has any related row regardless of the actor-ID condition, enabling unauthorized access to data the policy was designed to protect. No public exploit code is known at time of analysis and no CISA KEV listing exists; a vendor-released patch is available in version 0.7.1.
Cross-tenant aggregate data leakage in ash_sql affects Elixir applications using schema-based multitenancy with strategy(:context), covering versions 0.1.0 through 0.7.0. The AshSql.AggregateQuery.add_single_aggs/5 function discards the tenant schema prefix when rebuilding outer queries for distinct aggregates, causing aggregate computations to silently read the repository default schema instead of the tenant's isolated schema. An authenticated tenant user can thereby receive aggregate values - counts, sums, or other statistics - derived from another tenant's rows, breaching the core data isolation guarantee of the multitenant deployment. No public exploit has been identified and the issue is not listed in CISA KEV.
AshOban versions 0.2.5 through 0.8.13 expose an authorization bypass and tenant isolation break in the build_trigger/3 function, allowing any user whose input reaches the :args option to retarget update or destroy background jobs at arbitrary records - including records belonging to other tenants. The root cause is an Elixir atom-vs-string key collision: trusted job fields are stored as atom keys, user-supplied :args arrive as string keys after JSON round-tripping, Map.merge sees no collision and both survive, and JSON serialization then keeps the last (string) key when the job is persisted, causing the worker to read attacker-controlled values. No public exploit has been identified at time of analysis, though the mechanism is straightforward and fully documented by the vendor advisory GHSA-gj9p-x393-rf9h.
Improper access control in SiteServer SSCMS 7.4.0's Agent Installation Workflow allows remote attackers to bypass security restrictions by manipulating the SecurityKey argument, potentially gaining unauthorized access to protected functionality. The CVSS 4.0 score of 2.3 reflects genuine exploitation difficulty - high attack complexity and required passive user interaction significantly limit opportunistic abuse - though the authentication bypass characterization indicates a security boundary violation is achievable under the right conditions. No patch is available; the project has not responded to responsible disclosure submitted via GitHub issue #3898, and no public exploit has been identified at this time.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to bypass the refresh token requirement entirely. By sending a non-POST HTTP request to the jwt_refresh route, the library still issues a new valid JWT access token without validating a refresh token, enabling perpetual session extension. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the patch is available in version 2.47.0.
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.11) due to a missing capability check on an AJAX endpoint accessible to any logged-in user. Any subscriber-level WordPress account holder can send a crafted AJAX request to invoke the unprotected action and permanently remove membership plans without administrative authorization. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.13% (3rd percentile) indicates very limited observed exploitation activity at time of analysis, and the vulnerability is not listed in CISA KEV.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries a negligible EPSS score of 0.13% (3rd percentile), consistent with the practical access barrier imposed by the non-guessable subscription identifier.
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. A publicly available proof-of-concept is documented via WPScan; the vulnerability is not in CISA KEV, and the EPSS score of 0.13% indicates very low observed exploitation activity at time of analysis.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. A publicly available exploit exists via WPScan, though EPSS (0.14%, 3rd percentile) indicates limited automated exploitation activity at time of analysis; no CISA KEV confirmation of active widespread exploitation is present.
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile), indicating no confirmed widespread exploitation at time of analysis.
Catfolders Document Gallery Pro WordPress plugin before version 2.0.7 exposes private, unpublished folder contents to unauthenticated remote attackers through two compounding weaknesses: REST API routes that lack authorization checks, and a content-identifying token scheme that can be forged entirely client-side without prior authenticated access. Any network-accessible attacker can enumerate and download files from folders site administrators intentionally withheld from public publication. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.14% (3rd percentile), indicating limited observed opportunistic activity at time of analysis.
Broken order authorization in MStore API WordPress plugin (before 4.21.1) allows any authenticated user, including low-privilege Subscribers, to mark arbitrary orders as paid without actual payment being taken. The plugin's wallet payment handler neither verifies that the targeted order belongs to the requesting user nor deducts the wallet balance for most payment methods, enabling financial fraud against WooCommerce stores. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), suggesting limited opportunistic exploitation to date.
MStore API WordPress plugin before 4.21.1 allows any authenticated user - including the lowest-privilege Subscriber role - to mark arbitrary WooCommerce orders as completed and paid without making any payment, constituting a business-logic fraud vulnerability. The root cause is a missing ownership authorization check (CWE-862) in a delivery status endpoint that accepts order IDs without verifying they belong to the requesting user. A publicly available exploit exists, though EPSS at 0.13% (3rd percentile) indicates limited automated mass exploitation to date; this vulnerability is not currently listed in the CISA KEV catalog.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.
IBM Concert versions 1.0.0 through 2.3.1 expose deployments to man-in-the-middle attacks due to improper TLS certificate validation (CWE-295), enabling remote attackers to intercept and manipulate communications between Concert components. The integrity impact is rated High by IBM's own CVSS scoring, meaning an adversary successfully positioned in the network path can perform unauthorized actions against affected Concert instances. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7285337.
Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.
Unauthenticated cluster node admission in Arc Enterprise allows a network attacker who can reach the coordinator TCP port to register a rogue node as a trusted cluster member when clustering is enabled without a configured shared secret. Once registered, the cluster router forwards legitimate end-user requests - including full HTTP headers such as Authorization and x-api-key - to attacker-controlled addresses, enabling credential interception. A detailed proof-of-concept is included in the advisory, and a vendor-released patch is available as of v26.06.2; no public exploit confirmed in CISA KEV at time of analysis.
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Spoofing via external file path control in Microsoft Edge (Chromium-based) enables a network-based, unauthenticated attacker to deceive users about the origin or content of resources rendered by the browser. The CVSS score of 6.5 (Medium) reflects a network-reachable attack requiring user interaction but no attacker privileges, with high confidentiality impact and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a vendor patch is available through Microsoft MSRC.
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Incorrect authorization in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to disclose limited information and cause minor integrity impact by luring a user to attacker-controlled web content. The flaw stems from CWE-863, where Edge's authorization logic fails to correctly enforce access boundaries, permitting content-triggered data exposure within the browser's security context. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC advisory.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
WebSocket subscription handlers in Yamcs bypass the object-level authorization checks enforced by their REST API counterparts, allowing any authenticated user to subscribe to the `packets`, `algorithm-status`, and `mdb-changes` topics and receive data their role explicitly restricts. Yamcs versions up to 5.12.7 and 5.13.0-5.13.1 are affected, exposing raw telemetry packets, algorithm execution status, and mission database changes to low-privilege principals. No public exploit code has been identified and no CISA KEV listing exists, but the exploit path is structurally trivial for any credentialed user given standard WebSocket client access.
Cross-tenant kanban bucket injection in Vikunja API (≤ 2.3.0) allows any authenticated user to relocate their own bucket into any other tenant's project view by supplying an arbitrary `project_view_id` in the JSON request body of the bucket update endpoint. The `Bucket.Update()` function in `pkg/models/kanban.go` mass-assigns `project_view_id` directly to the database row via xorm, while the `CanUpdate` authorization check only validates the URL path parameters - never the body field. A detailed curl-based proof-of-concept is publicly available in the GitHub security advisory GHSA-569v-q83c-3j3g, though no active exploitation has been confirmed (not in CISA KEV).
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Authorization bypass in Vikunja's project duplication API allows any authenticated user to inject an attacker-owned project into any other user's or team's project hierarchy without write access to the target parent. Affected versions span v0.21.0 through v2.3.0 - the entire post-namespace-migration release history - and exploitation requires only a single authenticated API call with no special configuration. No public exploit exists beyond the proof of concept published in the vendor advisory, and the CVE is not listed in the CISA KEV catalog; however, the trivial reproducibility and lack of rate-limiting or secondary authorization checks on the duplicate route make this a meaningful risk on any shared Vikunja instance.
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other users' feedback records by supplying arbitrary feedback identifiers to the PUT and DELETE API endpoints. The server performs no ownership verification before processing these operations (CWE-639), enabling silent corruption of human-rating datasets used in LLM evaluation and RLHF pipelines. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated access to six REST endpoints on StarRocks' frontend HTTP port allows remote attackers to enumerate cluster topology, database metadata, JVM statistics, and version information without credentials, affecting all releases through 4.0.13. Five REST handler classes in the FE component override execute() directly rather than implementing executeWithoutPassword(), inadvertently bypassing the authentication gate enforced by the RestBaseAction base class. No public exploit code or active exploitation has been confirmed at time of analysis; however, the reconnaissance value of the disclosed data materially reduces the effort required for targeted follow-on attacks against the same infrastructure.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-tenant authorization bypass in Hatchet's Dispatcher gRPC service (versions 0.40.0 through 0.91.1) permits any authenticated low-privilege tenant to overwrite worker affinity labels or force-disconnect workers belonging to other tenants on the same instance. The two affected RPCs - UpsertWorkerLabels and Unsubscribe - validate the caller's bearer token only for analytics and response shaping, never to authorize the worker_id supplied in the request body, constituting a classic IDOR (CWE-639) across tenant boundaries. A vendor-released patch is available in version 0.91.2; no public exploit or active exploitation has been identified at time of analysis.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.
Broken object-level authorization in Sulu CMS's media move endpoint (prior to 2.6.25 and 3.0.8) allows authenticated backend users to bypass collection-level access controls and exfiltrate restricted media assets. The move API validates permissions against the attacker-supplied collection ID in the request body rather than the media item's actual stored source collection, enabling an authenticated user with edit rights on any collection to relocate content out of a restricted collection they cannot legitimately access. No public exploit has been identified at time of analysis and no KEV listing exists; exploitation is bounded by the requirement for a valid backend account.
Sulu CMS versions prior to 2.6.25 and 3.0.8 allow authenticated admin users to generate or revoke public preview links for any page, article, or snippet - including content in webspaces they are explicitly forbidden from viewing - because PreviewLinkManager::generate() and PreviewLinkManager::revoke() omit the VIEW permission check before executing. The resulting preview URLs are publicly accessible via an opaque token with no authentication required, meaning the attacker or any recipient of the link can read otherwise-restricted CMS content. No public exploit has been identified at time of analysis, but the attack path is straightforward and directly reproducible from the published commit diff and GitHub security advisory.
Missing authentication on the edit endpoint in cu silicon up to version 0.1.5 allows unauthenticated remote attackers to interact with the `create_app` function in `views.py` without any credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no special conditions against a network-accessible deployment, and a publicly available proof-of-concept exploit (E:P) reduces the barrier to abuse. No vendor patch exists; the vendor did not respond to coordinated disclosure, leaving users without an official fix.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Incorrect authorization in Wallos prior to version 4.9.1 allows any authenticated user to consume another user's third-party currency API credentials. The endpoint endpoints/currency/update_exchange.php selects the first Fixer or API Layer provider key stored globally rather than scoping it to the requesting user, meaning a user without their own API key can trigger exchange-rate refreshes that exhaust a different user's API quota. No public exploit has been identified at time of analysis, and the vendor-released patch (v4.9.1) resolves the cross-user data isolation flaw.
Missing authentication on the DownloadPublic endpoint in sdcb chats through version 1.12.0 exposes signed file downloads to unauthenticated remote access, representing a CWE-306 failure in the .NET FileController. The flaw is network-exploitable but carries a CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact. A proof-of-concept exploit has been publicly released, and the vendor has not responded to disclosure, leaving no official patch available.
Tenant isolation is broken in dibo-software diboot 3.8.0, where the `/api/iam/tenant/resource` endpoint fails to enforce access controls on the user-supplied `tenantId` argument. A low-privileged authenticated user can substitute an arbitrary tenant identifier to access or modify resource assignments belonging to other tenants - a classic authorization bypass in a multi-tenant IAM context. A public proof-of-concept exploit has been disclosed; the vendor did not respond to responsible disclosure, leaving no official patch available.
Authorization bypass in dibo-software diboot 3.8.0 exposes the AI Session Endpoint (/api/ai-session/) to insecure direct object reference (IDOR) exploitation, allowing low-privilege authenticated users to access or manipulate AI session resources belonging to other users. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to verify that the requesting user is authorized to act on the referenced session identifier. A public exploit has been disclosed, and the vendor did not respond to early notification - no patch is available at time of analysis.
IP-based access control bypass in MegaEase EaseProbe up to 2.3.0 allows unauthenticated remote attackers to spoof their source IP by manipulating HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP), circumventing middleware-enforced restrictions in the web monitoring interface. The vulnerable logic resides in the `realIP` function within `web/server.go`, which trusts attacker-controlled headers without validating that the request originated from a legitimate trusted proxy. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure.
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.
Broken access control in JoomShaper's Helix Ultimate Joomla template extension (versions prior to 2.2.10) allows authenticated backend users to overwrite layout parameters for arbitrary menu items by calling the save-megamenu-settings AJAX endpoint without holding core.edit or core.admin permissions on the targeted com_menus item. The endpoint fails to enforce Joomla's native per-item and component-level ACL checks server-side, meaning any user with backend access can tamper with menu configurations they do not own. No public exploit code and no CISA KEV listing exist at time of analysis.
Arbitrary file deletion within Joomla's `/images/` directory is achievable in Helix Ultimate versions before 2.2.10 by authenticated Author-level users. The `Blog::remove_image()` method validates that the requesting user holds edit rights over the supplied article ID but performs no ownership check on the accompanying image path parameter (`src`), allowing an author to target files belonging to other articles or other content under `/images/`. On Joomla 3 builds where physical file deletion is triggered, this broken object-level authorization flaw enables destructive content tampering without administrative privileges. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated syslog configuration manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows adjacent-network attackers to alter logging behavior by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The setSyslogCfg function performs no access control checks before applying submitted configuration changes (CWE-284), enabling log suppression or redirection that could obscure evidence of concurrent or subsequent malicious activity. No public exploit code has been identified and the EPSS score of 0.16% reflects minimal current exploitation interest; this vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the internal Wi-Fi client MAC-to-IP mapping table to any attacker with adjacent network access. The getWiFiIpMacTable function in the router's CGI handler fails to enforce authentication, allowing a crafted POST request to /cgi-bin/cstecgi.cgi to return a full enumeration of connected wireless clients. No public exploit has been identified at time of analysis; EPSS at 0.16% (6th percentile) reflects minimal observed exploitation interest.
Incorrect access control in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes the setWizardCfg CGI endpoint to unauthenticated reconfiguration by any attacker with adjacent network access. An actor on the same local network segment can issue a crafted POST request to /cgi-bin/cstecgi.cgi to silently overwrite WAN settings, Wi-Fi parameters, or device initialization state without supplying any credentials. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low observed exploitation interest.
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
Four discrete access control defects in DataEase's sharing link module (versions before 2.10.26) allow any authenticated platform user to cross-access password-protected shares, enumerate other users' share mappings, and disrupt share availability by manipulating tickets they do not own. The flaws span ticket validation (cross-share reuse via ShareTicketManage.validateTicket), password-verification bypass of the mandatory-ticket policy (POST /de2api/share/validate), unauthorized ticket mutation/deletion, and insecure user-ID handling in the share enumeration endpoint. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Authorization bypass in ToolJet before v3.16.208 permits any authenticated user to enumerate, create, rename, and delete TooljetDB tables belonging to arbitrary workspaces by supplying a foreign organizationId in the URL path of affected API endpoints. The TooljetDB controller accepts organizationId from the request path without validating it against the requesting user's actual workspace context, completely breaking tenant isolation in multi-workspace deployments. No public exploit code and no CISA KEV listing exist at time of analysis, but the flaw is trivially exploitable by any authenticated user with network access to the instance.
Cross-workspace authorization bypass in ToolJet through 3.0.0-ee-beta.2 exposes TooljetDB table schemas and restricted app definitions to authenticated low-privilege users via the POST /api/v2/resources/export endpoint. Authenticated users can supply an arbitrary organization_id in the request body to extract database schemas belonging to workspaces they are not members of, and can additionally sidestep per-app granular export permissions within their own workspace to retrieve restricted app definitions. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires valid credentials.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
Insecure Direct Object Reference in GROWI's bookmark folder APIs allows authenticated users to retrieve, modify, and delete other users' private bookmark data without authorization. Affected across all tracked versions per CPE data (cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:*), exploitation requires only a valid session - no elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the attack pattern (predictable or enumerable object IDs in API endpoints) is trivially reproducible by any authenticated user.
Incorrect authorization in GROWI exposes other users' bookmark data to unauthenticated remote attackers without any privileges or user interaction. The flaw (CWE-863) indicates that bookmark retrieval endpoints fail to enforce proper access control checks, allowing any network-accessible attacker to enumerate or read bookmark data belonging to arbitrary users. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
FilterForm in ash_phoenix (versions 0.6.0-rc.1 through 2.3.24) exposes private relationship data to authenticated users by resolving attacker-controlled filter path parameters through private Ash relationship traversal rather than the public-only gate. By supplying crafted path or field form values targeting non-public relationships, an authenticated attacker converts query result row counts into a boolean oracle over data the resource author explicitly marked private. The CVSS 4.0 score is 2.3 (Low); no active exploitation is identified and no public proof-of-concept exists at time of analysis.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
Unauthenticated remote attackers can bypass authorization controls in SeaCMS 13.6 via the `/ass.php` endpoint, disclosing premium or paywalled content URLs without valid subscription credentials. The vulnerability exploits CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where a user-supplied parameter determines access rights without server-side validation. A publicly available proof-of-concept is referenced in a GitHub security advisory; no active exploitation has been confirmed by CISA KEV, and impact is confined to information disclosure with no integrity or availability consequences.
Unauthenticated access to the CloudSrvVersionCheck function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to trigger cloud-based firmware update checks by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The root cause is CWE-284 (Improper Access Control) - the function processes requests without verifying caller identity, a systemic pattern observed across multiple CGI handlers in this firmware batch. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.18% (7th percentile) indicates low probability of automated exploitation.
Unauthenticated log erasure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes network defenders to forensic blind spots. The clearTracerouteLog CGI endpoint imposes no access control, allowing any network-reachable attacker to wipe traceroute history via a crafted POST to /cgi-bin/cstecgi.cgi. While integrity impact is rated low (log data only), this capability is routinely used as a cover-tracks primitive following initial compromise of the router or downstream network activity. No active exploitation confirmed; EPSS is 0.18% (7th percentile), consistent with a niche SOHO device.
Unauthenticated LAN configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker on the adjacent network to modify the router's LAN settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi targeting the setLanCfg handler, which lacks access control enforcement. The attack requires only adjacent network positioning - no credentials, no user interaction - and can alter LAN network parameters such as IP addressing, subnet masks, or gateway settings. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.18%, reflecting low observed interest.
Project restriction bypass in a network address set management component allows an authenticated user within one project to access or manipulate network address sets belonging to another project, violating multi-tenant isolation boundaries. The vulnerability is reported by Ubuntu vendor under GHSA-6v6x-387m-rj4w. No CVSS score, CWE classification, or confirmed patch version is available in the provided intelligence; the following analysis is substantially inferred from the advisory title and source.
NoSQL injection in FastGPT Community Edition 4.10.0-4.14.0 allows unauthenticated remote attackers to bypass authorization on the POST /api/core/chat/getHistories endpoint by embedding MongoDB operators in crafted JSON payloads, exposing chat history titles for all users across the platform. A public proof-of-concept repository (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) exists, materially lowering the exploitation bar. EPSS at 0.33% (26th percentile) indicates no widespread exploitation observed yet, but the zero-authentication-required, low-complexity attack surface makes this a realistic opportunistic threat against internet-exposed deployments.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to delete Wi-Fi schedule entries without credentials by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delWiFiScheduleCfg CGI handler fails to enforce authentication before processing deletion requests, enabling unauthorized modification of time-based Wi-Fi access control policies. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.18% (7th percentile), indicating minimal observed exploitation pressure.
Unauthenticated remote manipulation of wireless roaming configuration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setRoamingCfg function through /cgi-bin/cstecgi.cgi with no access control enforcement, allowing any network-reachable attacker to overwrite roaming behavior via a crafted POST request. The device performs no authentication check before processing configuration changes through this handler, consistent with a broader pattern of access control failures across multiple TOTOLINK T6 CGI endpoints documented in coordinated disclosure repositories. No public exploit code has been identified and EPSS is 0.16%, suggesting limited active exploitation interest at this time.
Incorrect access control in the SystemSettings function of TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes administrative import and export endpoint information to unauthenticated remote attackers. By sending a crafted POST request to /cgi-bin/cstecgi.cgi, an attacker can enumerate configuration management endpoints without any credentials. No public exploit code or CISA KEV listing exists; EPSS at 0.16% (6th percentile) reflects negligible observed exploitation activity, though the disclosed endpoint data could facilitate chained attacks against the device's management API.
Unauthenticated access control bypass in TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows any attacker on the adjacent network to arbitrarily modify Wi-Fi scheduling via the setWiFiScheduleCfg handler. By sending a crafted POST to /cgi-bin/cstecgi.cgi without credentials, an attacker can suppress or extend wireless availability windows, causing service disruption for wireless clients. EPSS at 0.18% (7th percentile) and absence from CISA KEV reflect no known active exploitation at time of analysis.
Unauthenticated write access to the setApWiFiSchCfg function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to arbitrarily overwrite the device's AP wireless availability schedule by posting a crafted request to /cgi-bin/cstecgi.cgi. The CVSS PR:N metric confirms no credentials are required; the attack surface is the standard CGI management endpoint. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.16% (6th percentile), but the unauthenticated network vector makes this trivially reproducible against any device exposing its management interface to untrusted networks.
Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits unauthenticated adjacent-network attackers to overwrite QoS traffic-shaping configuration via a crafted POST to /cgi-bin/cstecgi.cgi, intentionally degrading traffic handling for legitimate network users. The attack requires no credentials and no user interaction, but is bounded to Layer 2 adjacency (LAN or Wi-Fi segment), preventing internet-based exploitation. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) reflects low observed exploitation activity.
Unauthenticated firewall policy manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setIpPortFilterRules function to any attacker on the adjacent network segment. A crafted POST request to /cgi-bin/cstecgi.cgi bypasses all access control (CWE-284) and allows modification of the device's IP/port filtering rules without credentials. No active exploitation is confirmed in CISA KEV, and EPSS at 0.18% (7th percentile) reflects limited opportunistic risk, consistent with the adjacent-only attack vector.
Unauthenticated mesh configuration tampering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with adjacent network access to overwrite WiFi mesh settings by sending a crafted POST request directly to the /cgi-bin/cstecgi.cgi handler without supplying credentials. The setWiFiMeshConfig function applies no access control check before processing the request, a CWE-284 (Improper Access Control) condition consistent with a pattern of missing authentication enforcement observed across multiple CGI handlers in this firmware. No public exploit is confirmed and EPSS sits at 0.18% (7th percentile), marking this as low exploitation probability, though the adjacent-network-only constraint is the primary practical barrier rather than any authentication requirement.
GraphQL subscription payloads carrying unauthorized record data leak to authenticated subscribers in ash_graphql 1.4.0-1.10.x due to a missing authorization filter in the batch-processing codepath of AshGraphql.Subscription.Batcher. When two or more subscription notifications arrive within the default one-second batching window, only the first is passed through the should_send?/1 authorization gate; all subsequent notifications in the same batch bypass that check entirely and are published to the subscriber's WebSocket connection. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 1.11.0.
Improper authorization in sambitraj Student Management System allows authenticated low-privileged users (students) to access or tamper with other students' records by manipulating the `roll_no` parameter in `student_dashboard.php`. Confirmed by CPE `cpe:2.3:a:sambitraj:student_management_system:*:*:*:*:*:*:*:*`, all commits up to `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5` are affected. A public proof-of-concept is available via a GitHub issue; the project has not responded to disclosure, leaving the flaw unpatched with no KEV listing.
Authentication bypass in Magma 1.9.0's AMF Registration Complete Message Handler allows remote, unauthenticated attackers to manipulate registration state in the 5G core network's Access and Mobility Management Function. The vulnerable code path resides in tasks/amf/amf_fsm.cpp, where the finite state machine processing Registration Complete messages fails to properly verify actor identity per CWE-287. A public proof-of-concept exploit exists (GitHub issue #16020), and no confirmed patch version has been identified at time of analysis.
Broken access control in Admidio's profile_function.php allows any authenticated low-privilege user to enumerate another user's future role memberships by directly invoking the reload_future_memberships endpoint with a known victim UUID. Affected are all Admidio installations running versions prior to 5.0.12. An attacker with a valid account can bypass profile-level authorization to harvest sensitive organizational membership planning data without elevated privileges; no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference in Dolibarr's Users::getGroups REST API endpoint allows any authenticated user to read group memberships of arbitrary users across tenant boundaries without authorization. Versions 10.0.0 through 23.x omit the per-object access check in GET /users/{id}/groups, exposing group names, entity associations, and private notes to any API credential holder. Fixed in 24.0.0; no public exploit or CISA KEV listing identified at time of analysis.
Aggregate authorization bypass in ash_sql 0.1.0 through 0.7.0 allows a caller to receive aggregate data - counts, sums, or lists - computed over rows that a stricter actor- or tenant-scoped filter should have excluded. The root cause is a single-character logical operator error in AshSql.Aggregate.different_queries?/2 (AND instead of OR), causing same-named aggregates carrying different authorization filters to be treated as already-computed identical queries, returning the first-registered broader value. No public exploit has been identified at time of analysis, and the vendor-confirmed fix is available in ash_sql 0.7.1.
Authorization policy bypass in ash_sql (versions 0.4.1 through 0.7.0) silently drops the caller-supplied `exists/2` predicate when a relationship combines a limit or `from_many?` declaration with a `parent(...)`-referencing filter or sort. Policy expressions such as `authorize_if expr(exists(memberships, user_id == ^actor(:id)))` degenerate to matching any actor that has any related row regardless of the actor-ID condition, enabling unauthorized access to data the policy was designed to protect. No public exploit code is known at time of analysis and no CISA KEV listing exists; a vendor-released patch is available in version 0.7.1.
Cross-tenant aggregate data leakage in ash_sql affects Elixir applications using schema-based multitenancy with strategy(:context), covering versions 0.1.0 through 0.7.0. The AshSql.AggregateQuery.add_single_aggs/5 function discards the tenant schema prefix when rebuilding outer queries for distinct aggregates, causing aggregate computations to silently read the repository default schema instead of the tenant's isolated schema. An authenticated tenant user can thereby receive aggregate values - counts, sums, or other statistics - derived from another tenant's rows, breaching the core data isolation guarantee of the multitenant deployment. No public exploit has been identified and the issue is not listed in CISA KEV.
AshOban versions 0.2.5 through 0.8.13 expose an authorization bypass and tenant isolation break in the build_trigger/3 function, allowing any user whose input reaches the :args option to retarget update or destroy background jobs at arbitrary records - including records belonging to other tenants. The root cause is an Elixir atom-vs-string key collision: trusted job fields are stored as atom keys, user-supplied :args arrive as string keys after JSON round-tripping, Map.merge sees no collision and both survive, and JSON serialization then keeps the last (string) key when the job is persisted, causing the worker to read attacker-controlled values. No public exploit has been identified at time of analysis, though the mechanism is straightforward and fully documented by the vendor advisory GHSA-gj9p-x393-rf9h.
Improper access control in SiteServer SSCMS 7.4.0's Agent Installation Workflow allows remote attackers to bypass security restrictions by manipulating the SecurityKey argument, potentially gaining unauthorized access to protected functionality. The CVSS 4.0 score of 2.3 reflects genuine exploitation difficulty - high attack complexity and required passive user interaction significantly limit opportunistic abuse - though the authentication bypass characterization indicates a security boundary violation is achievable under the right conditions. No patch is available; the project has not responded to responsible disclosure submitted via GitHub issue #3898, and no public exploit has been identified at this time.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to bypass the refresh token requirement entirely. By sending a non-POST HTTP request to the jwt_refresh route, the library still issues a new valid JWT access token without validating a refresh token, enabling perpetual session extension. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the patch is available in version 2.47.0.
Unauthorized deletion of arbitrary membership plans is possible in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.11) due to a missing capability check on an AJAX endpoint accessible to any logged-in user. Any subscriber-level WordPress account holder can send a crafted AJAX request to invoke the unprotected action and permanently remove membership plans without administrative authorization. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.13% (3rd percentile) indicates very limited observed exploitation activity at time of analysis, and the vulnerability is not listed in CISA KEV.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Payment verification bypass in MasterStudy LMS WordPress Plugin before 3.7.40 permits unauthenticated attackers to fraudulently complete full-price course orders by submitting payment webhook notifications with only a token amount. The plugin neglects to validate the transaction amount, receiving account, currency, or payment status before updating order state to completed, granting unauthorized access to paid LMS content. A public proof-of-concept is available via WPScan, though EPSS remains low at 0.15% (4th percentile) and no CISA KEV listing has been confirmed.
Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.5 exposes an Insecure Direct Object Reference (IDOR) flaw in its customer-portal subscription cancellation endpoint, allowing an authenticated portal user to cancel subscriptions belonging to entirely different customers by substituting an arbitrary subscription ID in the cancellation request. Exploitation requires prior knowledge of the victim's Stripe subscription ID, which is high-entropy and not enumerable through the plugin itself, meaningfully constraining real-world exploitation despite a publicly available proof-of-concept. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries a negligible EPSS score of 0.13% (3rd percentile), consistent with the practical access barrier imposed by the non-guessable subscription identifier.
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide administrator-reserved WordPress settings by invoking the plugin's automated SEO fix endpoint without proper capability verification. The root cause (CWE-863, Incorrect Authorization) is a missing capability check in the fix-handling code path - WordPress requires specific admin capabilities such as manage_options to alter core settings, but Rank Math does not enforce these checks before acting on the request. A publicly available proof-of-concept is documented via WPScan; the vulnerability is not in CISA KEV, and the EPSS score of 0.13% indicates very low observed exploitation activity at time of analysis.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. A publicly available exploit exists via WPScan, though EPSS (0.14%, 3rd percentile) indicates limited automated exploitation activity at time of analysis; no CISA KEV confirmation of active widespread exploitation is present.
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile), indicating no confirmed widespread exploitation at time of analysis.
Catfolders Document Gallery Pro WordPress plugin before version 2.0.7 exposes private, unpublished folder contents to unauthenticated remote attackers through two compounding weaknesses: REST API routes that lack authorization checks, and a content-identifying token scheme that can be forged entirely client-side without prior authenticated access. Any network-accessible attacker can enumerate and download files from folders site administrators intentionally withheld from public publication. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.14% (3rd percentile), indicating limited observed opportunistic activity at time of analysis.
Broken order authorization in MStore API WordPress plugin (before 4.21.1) allows any authenticated user, including low-privilege Subscribers, to mark arbitrary orders as paid without actual payment being taken. The plugin's wallet payment handler neither verifies that the targeted order belongs to the requesting user nor deducts the wallet balance for most payment methods, enabling financial fraud against WooCommerce stores. A publicly available exploit exists per WPScan, though EPSS sits at 0.13% (3rd percentile), suggesting limited opportunistic exploitation to date.
MStore API WordPress plugin before 4.21.1 allows any authenticated user - including the lowest-privilege Subscriber role - to mark arbitrary WooCommerce orders as completed and paid without making any payment, constituting a business-logic fraud vulnerability. The root cause is a missing ownership authorization check (CWE-862) in a delivery status endpoint that accepts order IDs without verifying they belong to the requesting user. A publicly available exploit exists, though EPSS at 0.13% (3rd percentile) indicates limited automated mass exploitation to date; this vulnerability is not currently listed in the CISA KEV catalog.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
Unauthorized token deletion in Graylog's REST API (versions 6.2.0 through 6.3.11, 7.0.0-7.0.6, and 7.1.0-7.1.1) allows any authenticated user to revoke access tokens belonging to other accounts - including administrators and service accounts - by exploiting a misplaced permission check in the token revocation endpoint. The flaw does not expose token secret values but can invalidate privileged credentials and disrupt automated integrations that rely on access tokens. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 6.3.12, 7.0.7, and 7.1.2.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.
IBM Concert versions 1.0.0 through 2.3.1 expose deployments to man-in-the-middle attacks due to improper TLS certificate validation (CWE-295), enabling remote attackers to intercept and manipulate communications between Concert components. The integrity impact is rated High by IBM's own CVSS scoring, meaning an adversary successfully positioned in the network path can perform unauthorized actions against affected Concert instances. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7285337.
Zephyr RTOS's WireGuard subsystem incorrectly bypasses Poly1305 authentication for keepalive packets, allowing a network attacker to spoof VPN connection status events on affected embedded devices. The flaw in `wg_process_data_message()` accepted any 16-byte type-4 transport-data message and returned before invoking `wg_decrypt_packet()`, meaning the Poly1305 MAC was never verified - only a cleartext receiver-index lookup and a non-cryptographic expiry check were performed. Exploitation is constrained to integrity spoofing of the `NET_EVENT_VPN_CONNECTED` management signal; no traffic injection, key disclosure, or session takeover is possible, and no public exploit has been identified at time of analysis.
Unauthenticated cluster node admission in Arc Enterprise allows a network attacker who can reach the coordinator TCP port to register a rogue node as a trusted cluster member when clustering is enabled without a configured shared secret. Once registered, the cluster router forwards legitimate end-user requests - including full HTTP headers such as Authorization and x-api-key - to attacker-controlled addresses, enabling credential interception. A detailed proof-of-concept is included in the advisory, and a vendor-released patch is available as of v26.06.2; no public exploit confirmed in CISA KEV at time of analysis.
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Spoofing via external file path control in Microsoft Edge (Chromium-based) enables a network-based, unauthenticated attacker to deceive users about the origin or content of resources rendered by the browser. The CVSS score of 6.5 (Medium) reflects a network-reachable attack requiring user interaction but no attacker privileges, with high confidentiality impact and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a vendor patch is available through Microsoft MSRC.
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Incorrect authorization in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to disclose limited information and cause minor integrity impact by luring a user to attacker-controlled web content. The flaw stems from CWE-863, where Edge's authorization logic fails to correctly enforce access boundaries, permitting content-triggered data exposure within the browser's security context. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC advisory.
Prompt injection in Microsoft Edge for iOS exposes users to network-based spoofing attacks through Microsoft Edge's AI/Copilot integration. Malicious web content can embed adversarial LLM prompts that, when processed by Edge's AI features, manipulate the model to produce spoofed or misleading output - potentially impersonating trusted content or bypassing AI-enforced guardrails. The CVSS vector (PR:N/UI:R) indicates no attacker authentication is required, but a user must interact with Edge on iOS while AI features are active. No public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
WebSocket subscription handlers in Yamcs bypass the object-level authorization checks enforced by their REST API counterparts, allowing any authenticated user to subscribe to the `packets`, `algorithm-status`, and `mdb-changes` topics and receive data their role explicitly restricts. Yamcs versions up to 5.12.7 and 5.13.0-5.13.1 are affected, exposing raw telemetry packets, algorithm execution status, and mission database changes to low-privilege principals. No public exploit code has been identified and no CISA KEV listing exists, but the exploit path is structurally trivial for any credentialed user given standard WebSocket client access.
Cross-tenant kanban bucket injection in Vikunja API (≤ 2.3.0) allows any authenticated user to relocate their own bucket into any other tenant's project view by supplying an arbitrary `project_view_id` in the JSON request body of the bucket update endpoint. The `Bucket.Update()` function in `pkg/models/kanban.go` mass-assigns `project_view_id` directly to the database row via xorm, while the `CanUpdate` authorization check only validates the URL path parameters - never the body field. A detailed curl-based proof-of-concept is publicly available in the GitHub security advisory GHSA-569v-q83c-3j3g, though no active exploitation has been confirmed (not in CISA KEV).
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Authorization bypass in Vikunja's project duplication API allows any authenticated user to inject an attacker-owned project into any other user's or team's project hierarchy without write access to the target parent. Affected versions span v0.21.0 through v2.3.0 - the entire post-namespace-migration release history - and exploitation requires only a single authenticated API call with no special configuration. No public exploit exists beyond the proof of concept published in the vendor advisory, and the CVE is not listed in the CISA KEV catalog; however, the trivial reproducibility and lack of rate-limiting or secondary authorization checks on the duplicate route make this a meaningful risk on any shared Vikunja instance.
Feedback endpoint authorization bypass in Chainlit through 2.12.0 allows authenticated users to modify or delete other users' feedback records by supplying arbitrary feedback identifiers to the PUT and DELETE API endpoints. The server performs no ownership verification before processing these operations (CWE-639), enabling silent corruption of human-rating datasets used in LLM evaluation and RLHF pipelines. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated access to six REST endpoints on StarRocks' frontend HTTP port allows remote attackers to enumerate cluster topology, database metadata, JVM statistics, and version information without credentials, affecting all releases through 4.0.13. Five REST handler classes in the FE component override execute() directly rather than implementing executeWithoutPassword(), inadvertently bypassing the authentication gate enforced by the RestBaseAction base class. No public exploit code or active exploitation has been confirmed at time of analysis; however, the reconnaissance value of the disclosed data materially reduces the effort required for targeted follow-on attacks against the same infrastructure.
Komodo through version 2.3.2 leaks internal resource identifiers and pollutes its audit log because the /execute and /execute/{variant} API handlers resolve resource names and write audit records before enforcing authorization checks. Authenticated low-privileged users can enumerate internal resource identifiers they lack permission to access and inject fraudulent audit entries that falsely attribute privileged operations, undermining forensic and compliance integrity. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated access to Spring Boot Actuator management endpoints in Zipkin through 3.6.1 exposes sensitive operational data and configuration controls on the same port as the tracing API. Remote attackers with network reach to the Zipkin API port can read environment variables, bean configurations, and storage backend credentials via endpoints such as /actuator/env and /actuator/beans, or silently suppress security-relevant logging by modifying log levels via /actuator/loggers. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-tenant authorization bypass in Hatchet's Dispatcher gRPC service (versions 0.40.0 through 0.91.1) permits any authenticated low-privilege tenant to overwrite worker affinity labels or force-disconnect workers belonging to other tenants on the same instance. The two affected RPCs - UpsertWorkerLabels and Unsubscribe - validate the caller's bearer token only for analytics and response shaping, never to authorize the worker_id supplied in the request body, constituting a classic IDOR (CWE-639) across tenant boundaries. A vendor-released patch is available in version 0.91.2; no public exploit or active exploitation has been identified at time of analysis.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits contributor-level authenticated users to perform unauthorized actions beyond their intended role scope. The flaw, reported by Patchstack and classified as CWE-862 (Missing Authorization), allows low-privileged WordPress users to impact site integrity and availability without administrative consent. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.
Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.