Authentication Bypass
Monthly
Missing authorization on four Socket.IO event handlers in FUXA 1.3.2 and earlier exposes SCADA/HMI system-discovery metadata - device topology, node attributes, host network interfaces, and device tags - to any remote unauthenticated or guest user when the platform's security mode (secureEnabled=true) is active. The DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js omit the isSocketAdminAuthorized check that governs other protected events, creating an authorization gap specifically in hardened deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible nature and zero-privilege requirement make passive reconnaissance trivial against exposed instances. A vendor-released patch is available in FUXA v1.3.3.
Unauthenticated sensitive information disclosure in SJRC F11 SJ-GPS-PRO GPS drone firmware (build 2019-09-17) exposes device data to any adjacent-network attacker via an inetd service that performs no credential validation. The root cause is CWE-306 (Missing Authentication for Critical Function): the inetd service accepts connections and returns sensitive information without requiring any authentication, matching the Authentication Bypass tag. No public exploit code has been confirmed absent, as a researcher-published GitHub advisory with a dedicated CVE advisory document exists, indicating public documentation of the attack method. No active exploitation has been confirmed by CISA KEV at the time of this analysis.
Privilege escalation in Malcolm's nginx Lua RBAC layer allows authenticated low-privilege users to access administrator-only endpoints by submitting percent-encoded request URIs that bypass the access control gate. Malcolm versions up to and including 26.07.1 are affected, with restricted paths including /htadmin, /arkime/api/esadmin, NetBox, and file upload endpoints all reachable via this encoding bypass. A proof-of-concept exists per SSVC classification, though this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Arbitrary file read in OpenList prior to 4.2.4 enables authenticated users with CanShare permission to bypass directory boundary enforcement and exfiltrate files outside their assigned BasePath. The flaw in the share creation and update handlers uses Go's strings.HasPrefix without a separator-aware boundary check, so a user restricted to /base can create a valid share for /base2/secret.txt because the prefix match returns true. A detailed proof-of-concept is publicly documented in GHSA-86cx-wwf4-phq4; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The `/debug/vrlog` endpoint, registered via `addHttpEndpoint()` in `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`, invokes `vrlogStatsHandler()` without the `acl.CheckAccessHTTP(r, acl.DEBUGGING)` guard applied to every comparable debug endpoint, violating the operator-configured security policy. Critically, the feature is disabled by default since v22 and requires explicit opt-in via `--vreplication-enable-http-log`, which materially limits real-world exposure; no public exploit has been identified and the CVE is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in Kurrier's API layer exposes webhook and identity resource metadata to any authenticated API user prior to version 1.2.4. Any holder of a valid Kurrier API key can read and enumerate webhook configurations and identity records belonging to other accounts by supplying a victim's resource identifier to four unprotected GET and list endpoints. Confidentiality impact is limited to resource metadata - cross-user write and delete operations were already blocked - but the flaw enables reconnaissance of account configurations within a shared Kurrier instance. No public exploit code has been identified at time of analysis.
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) allows a single compromised member cluster to overwrite the endpoint records of other clusters in the mesh. Because the submariner-k8s-broker-cluster Role granted to every joined cluster carries more write access than it needs, an attacker holding one cluster's broker credentials can reroute inter-cluster tunnel traffic through attacker-controlled endpoints and mount a mesh-wide man-in-the-middle. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Socket.IO namespace access control bypass in MagicMirror² prior to v2.37.0 allows unauthenticated adjacent-network clients to interact directly with module helpers, bypassing the configured ipWhitelist that protects only the Express HTTP layer. Affected deployments binding to non-loopback interfaces can be exploited for server-side request forgery via the default newsfeed and calendar helpers, and conditionally for command execution via child_process.exec through the updatenotification helper when a third-party module update is pending. No public exploit code has been identified at time of analysis and this vulnerability is not in CISA KEV.
Broken authorization in Saleor's centralized GraphQL permission utility allows unauthenticated callers to silently modify channel-level order settings and enumerate hidden storefront objects that should require management privileges. Versions 3.14.67 through the pre-patch releases across the 3.21.x, 3.22.x, and 3.23.x branches are affected, with the headless GraphQL API serving as the attack surface. Fixed releases 3.21.67, 3.22.63, and 3.23.22 are vendor-confirmed; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cleartext storage of a long-lived broker service account bearer token in the Submariner Custom Resource specification exposes full mesh network control to any Kubernetes principal with CR read access. Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) is confirmed affected via CPE. An attacker who retrieves the token - through a routine `kubectl get` invocation or direct etcd access - gains unrestricted authority to manage Submariner endpoints, secrets, and cross-cluster network resources, constituting a complete compromise of the multi-cluster network plane. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The LDAP Source debug API endpoint in authentik, an open-source identity provider, omits the object-level read-authorization filter present on the rest of the API prior to versions 2026.2.6 and 2026.5.5, enabling unauthenticated callers to retrieve LDAP directory metadata from any configured LDAP Source. Any network-reachable client can invoke the diagnostic action, causing the authentik server to connect to the upstream directory with its stored bind credentials and return a bounded set of distinguished names and attribute names - exposing account and group naming conventions and directory structure without disclosing attribute values. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitrary headers into encrypted tunnel requests destined for Germany's electronic patient record (ePA) backend, potentially exposing other patients' medical records or bypassing authorization controls. The flaw exists in the build_inner_header function of app/vau/VAUProtokoll.py, which interpolates user-controlled values - including insurant_id and USER_AGENT - directly into raw HTTP header strings without stripping carriage-return or line-feed characters. No public exploit code has been identified at time of analysis, and the issue is fixed in release 1.3.0.
Improper access control (CWE-284) in the custom fields webservice API of Joomla! CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 allows authenticated high-privilege users to create custom fields for components whose ACL restrictions should deny them access. The flaw represents an authorization bypass at the API layer - the REST webservice endpoints for custom fields do not enforce the same component-level ACL checks applied in the web UI, creating a privilege boundary discrepancy. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 with PR:H reflects that exploitation is constrained to already-authenticated, elevated users.
Improper access control in Joomla! CMS 5.1.0-5.4.7 and 6.0.0-6.1.2 leaks restricted contact data into schema.org structured data snippets embedded in page output. The CMS fails to enforce ACL rules during schema.org contact snippet generation, allowing contact details for items that should be inaccessible to be injected into structured metadata visible in page source. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
Improper ACL enforcement in Joomla! CMS batch copy functionality allows authenticated backend users to copy content items they do not have edit permissions for, effectively bypassing content-level access controls. Affected versions span two active release branches: 4.0.0-5.4.7 and 6.0.0-6.1.2, covering a broad portion of active Joomla deployments. No public exploit code exists at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in active exploitation campaigns.
Joomla! CMS exposes a broken access control flaw on its webservices API category endpoints, permitting users who lack the requisite ACL permissions to create content categories they are explicitly not authorized to manage. The issue spans a large installed base across two major release lines: versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are confirmed affected. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, but the flaw is network-accessible, requires no complex conditions to trigger via the webservices interface, and was reported directly by the Joomla project.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.
MyBB's calendar module prior to version 1.8.40 exposes private forum events to any authenticated user possessing calendar viewing or moderation permissions, due to seven missing authorization checks across calendar.php action handlers. Authenticated forum members can read and modify private calendar events created by other users - data the event creator intended to restrict exclusively to themselves. No public exploit code has been identified at time of analysis and the flaw is absent from CISA KEV, but exploitation requires only a standard low-privilege forum account, keeping the practical barrier for abuse low.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Incorrect authorization in MyBB's calendar module prior to version 1.8.40 allows authenticated users holding moderation rights on one calendar to relocate events to calendars where they possess only viewing permissions. The `do_move` action in `calendar.php` validated `canmoderateevents` for the source calendar but omitted the equivalent check for the destination, enabling unauthorized cross-calendar event manipulation. No public exploit code or active exploitation has been identified; the fix is confirmed in version 1.8.40 via a one-line permission guard added to the destination calendar lookup.
Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
File/directory key confusion in Copyparty before 1.20.17 allows an authenticated user holding a valid file key to escalate that key into a directory key, gaining unauthorized read access to the entire containing folder. The flaw stems from a missing guard in httpcli.py that unconditionally set the directory key flag even when a file key was active. Exploitation is constrained to volumes where administrators have explicitly enabled both file-key (fk or fka) and directory-key (dk or dks) volume flags simultaneously - a non-default combination - and no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Broken Access Control in WP Table Builder WordPress plugin versions 2.2.0 and earlier permits authenticated Contributor-level users to invoke restricted plugin functionality beyond their assigned role scope, resulting in unauthorized integrity impact against site content. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate whether the requesting user holds sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and KEV status is not confirmed, placing this in a managed-patching priority tier rather than an emergency response category.
Broken access control in Gravity Booster - Styles & Layouts for Gravity Forms (WordPress plugin by WPMonks) through version 6.0 permits any authenticated subscriber to invoke functionality restricted to higher-privileged roles, yielding limited but real confidentiality and integrity impact. Reported by Patchstack and catalogued as EUVD-2026-60813, the flaw stems from missing authorization checks (CWE-862) on plugin operations, enabling subscriber-level users to read or modify form style and layout configurations beyond their intended permissions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, placing this in the category of medium-severity findings warranting patching rather than emergency response.
Broken authentication in WPEverest's User Registration WordPress plugin (versions 5.2.6 and below) permits subscriber-level authenticated users to bypass authentication controls and perform unauthorized actions beyond their role permissions. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable with low-privilege access required, producing limited but real integrity and availability impact. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenticated subscriber to bypass role-based authorization checks and access data restricted to higher-privilege roles, resulting in high confidentiality impact. The CVSS vector confirms this is network-exploitable with low complexity and no user interaction required beyond holding a subscriber-level account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation on open-registration LMS platforms makes this a credible threat to sensitive course and student data.
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface elevate practical risk for any business relying on appointment integrity.
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the Modal Survey WordPress plugin (versions up to and including 2.0.2.2.3) allows authenticated subscribers to bypass authorization controls and access survey objects belonging to other users by manipulating user-controlled keys in requests. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting the attack surface to sites with open registration or with existing low-privilege user accounts. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authorization bypass in Dolibarr ERP/CRM's clonetasks mass action allows authenticated users with project creation permissions to insert task records into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check within actions_massactions.inc.php incorrectly grants authorization to non-members when it should deny them. The attacker controls the target via a user-supplied projectid POST parameter, making exploitation straightforward for any authenticated user with basic project permissions. No public exploit code has been identified at time of analysis, and a vendor patch is available via upstream commit.
Authorization bypass in EdoWEB (all versions before 780-g7) by Netiket Information Technologies allows authenticated low-privileged users to access ACL-restricted functionality and data by manipulating user-controlled keys. The flaw is rooted in CWE-639 (Insecure Direct Object Reference), where the application trusts a client-supplied key without verifying the requesting user's authorization to the referenced object. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; exploitation is constrained by high attack complexity and a required authenticated session.
Same-origin policy bypass in Firefox's ImageLib image rendering component allows remote attackers to read cross-origin data or perform unauthorized cross-origin writes against victims using unpatched browser versions. Affected releases span the main Firefox channel (prior to 154) and three ESR branches (prior to ESR 115.39, ESR 140.14, and ESR 153.1), placing a large share of the global Firefox install base at risk until patched. The CVSS 5.4 score reflects limited confidentiality and integrity impact with no authentication requirement on the attacker side, though no public exploit has been identified and this CVE is not listed in the CISA KEV catalog at the time of analysis.
Same-origin policy bypass in Firefox's Audio/Video Playback component exposes users to cross-origin data reads and limited content manipulation when visiting a malicious webpage. All Firefox stable releases prior to 154 and both ESR tracks prior to 140.14 and 153.1 are affected, with Mozilla issuing a coordinated advisory series (mfsa2026-74 through mfsa2026-80) covering the full release matrix. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction but no credentials or special configuration.
Same-origin policy bypass in Firefox's Networking: Cookies component exposes users to cross-origin cookie theft and manipulation when visiting attacker-controlled pages. All Firefox versions prior to 154 and both ESR branches prior to ESR 140.14 and ESR 153.1 are affected, with Mozilla publishing at least six separate security advisories (mfsa2026-74 through mfsa2026-80) indicating broad coverage across release tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the CVSS 5.4 Medium score reflects real but bounded confidentiality and integrity risk, gated by a mandatory user-interaction requirement.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
Batch and time-series HTTP handlers in ArcadeDB before 26.8.1 omit the setCurrentUser call when dispatching work to worker threads, causing the fine-grained per-type ACL layer to silently skip authorization checks for those endpoints. Authenticated users with restricted per-type permissions can read from and write to data types they are not authorized to access by routing requests through the affected handlers. No public exploit has been identified and the CVSS 4.0 score of 2.3 reflects the narrow exploitation prerequisites - only deployments actively using per-type or per-group ACLs are vulnerable.
Keycloak's authorization services group policy provider grants unauthorized access to protected resources by matching group membership using only group names in tokens rather than full hierarchical paths. Authenticated users whose account belongs to a same-named but structurally distinct group can be silently elevated to the permissions of an authorized group, bypassing fine-grained access controls. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is rated High given the policy bypass directly subverts resource access decisions.
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authentication process via manipulation of logic in apps/web/server/auth.ts, achieving a low-integrity impact on the vulnerable system without requiring credentials or user interaction. High attack complexity (AC:H) means exploitation demands engineered conditions in the OAuth callback flow rather than trivial exploitation. No vendor patch has been issued at time of analysis; a public proof-of-concept has been disclosed via GitHub issue #2920 and indexed by VulDB, no public exploit identified at time of analysis for widespread automated campaigns but the PoC reduces the barrier for targeted attacks.
Incorrect authorization in Mattermost Boards allows an authenticated board editor to relink any editable board to an arbitrary channel by exploiting a missing PermissionManageBoardRoles check on the channelId field of the batch endpoint. Affected are Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 (advisory MMSA-2026-00686). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to execute for any authenticated board editor.
Privilege escalation in Onyx Enterprise Edition (versions prior to 4.3.0) allows any authenticated curator to modify user groups outside their assigned scope, gaining unauthorized document access through the platform's OpenSearch access_control_list filter. The PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints relied solely on a role check confirming the caller held curator status somewhere in the system, but the underlying database functions update_user_group and add_users_to_user_group never invoked _validate_curator_can_modify_group to scope that access to specific groups. No public exploit has been identified at time of analysis, and the issue is fixed in the vendor-released version 4.3.0.
IPSec authentication bypass in Apple iOS and iPadOS (all versions prior to 26.6.1) allows an adjacent-network attacker to circumvent IPSec mutual authentication and intercept device network traffic. The root cause is improper state management (CWE-287) in the IPSec stack, corrected in iOS 26.6.1 and iPadOS 26.6.1. No public exploit code has been identified at time of analysis, and EPSS at 0.19% (10th percentile) confirms minimal observed exploitation activity.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Missing authorization enforcement on the log-inputs API endpoint in MLflow 3.13.0 through 3.14.x allows any authenticated user to inject fabricated DatasetInput records into another user's run lineage metadata without holding UPDATE permission on that run. The root cause is that the LogInputs (and LogOutputs) handler was simply never registered in the BEFORE_REQUEST_HANDLERS auth middleware map, leaving the POST /api/2.0/mlflow/runs/log-inputs endpoint unguarded. No active exploitation has been confirmed (not listed in CISA KEV), and a vendor-released patch is available in version 3.15.0.
Privilege escalation in JumpServer prior to 4.10.17 allows an authenticated user holding the `users.invite_user` permission to silently overwrite any existing organization member's role assignments by re-submitting that member through the invite API endpoint, enabling both upward privilege escalation and downward administrator demotion. The root cause is a single Django ORM call - `user.org_roles.set(org_roles)` in `apps/users/api/user.py` - which unconditionally replaces the full many-to-many role set without verifying whether the target already belongs to the organization. No public exploit has been identified and this CVE is not listed in CISA KEV; a confirmed patch is available in v4.10.17.
Broken object-level authorization on the portal ping and wake-on-LAN endpoints in Next Terminal exposes all registered asset metadata and WoL controls to any authenticated portal user, regardless of their assigned asset permissions. The wildcard CPE (all versions) indicates no patched release exists, and the flaw is rooted in CWE-862 (Missing Authorization) - a structural gap in the access-control layer rather than a logic edge case. An attacker holding any valid portal credential can silently enumerate asset display names, IP addresses, reachability status, and connection timing, then issue WoL packets to bring unauthorized offline assets online. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integrity bypass in ApostropheCMS page management allows authenticated low-privileged editors to move pages into restricted subtrees they have no create rights over, and indirectly re-rank admin-only sibling pages via an unchecked database updateMany call. All deployments running ApostropheCMS prior to 4.32.0 are affected; the flaw exists in the REST page update endpoint and requires no special configuration to reach. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack path through documented REST parameters is straightforward for any CMS insider.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.
Account enumeration in JetBrains YouTrack before version 2026.2.18112 exposes internal user accounts to any authenticated user through insufficient authorization controls on the users search endpoint. The root cause is CWE-862 (Missing Authorization): the endpoint performs no privilege check beyond requiring a valid session, allowing low-privilege users to systematically extract account identifiers across the entire instance. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the straightforward exploitation path makes patching a clear priority.
Passkey management in New API, an LLM gateway and AI asset management system, permits lower-privileged administrators to delete passkeys belonging to same-level or higher-privileged accounts-including the root account-via the DELETE /api/user/:id/reset_passkey endpoint. Versions 0.9.1.3 through 1.0.0-rc.7 (exclusive) are affected because AdminResetPasskey in controller/passkey.go omits the canManageTargetRole authorization check applied consistently to every comparable privileged-account-management endpoint in the codebase. No public exploit has been identified at time of analysis, but successful exploitation silently removes a FIDO2 second factor from high-value accounts, potentially enabling credential-only takeover as a follow-on attack.
Unauthorized private message excerpt exposure in Discourse allows authenticated category group moderators to read flag-related companion PM content they were never intended to access, via the review queue API. Affected are Discourse deployments with category group moderation enabled running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1. No public exploit exists and the issue is absent from CISA KEV; however, the missing authorization check (CWE-862) means any authenticated category group moderator can silently read confidential flag discussion excerpts, directly undermining the trust model of the platform's moderation system.
Information disclosure in Discourse allows authenticated group members to access unpublished shared-draft content through improperly guarded API endpoints. Group members holding view-only activity permissions - but explicitly excluded from shared-draft access - can retrieve draft topic titles and post excerpts via the group posts and group mentions endpoints due to a missing authorization check (CWE-862). Fixed versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Hidden post content disclosure in Discourse allows unauthenticated visitors and search-engine crawlers to read first-post content that was explicitly hidden or made unviewable through moderation controls. Affected versions span multiple release branches prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The authorization check governing post visibility is not applied when generating Q&A JSON-LD structured data, so the raw excerpt appears in publicly-served HTML. No public exploit code exists and this vulnerability is not listed in CISA KEV.
UpTrain versions 0.7.1 and prior expose a critical authentication bypass combining two design flaws: a static default API key that equals the default username (making it predictable to any observer), and a permissive CORS policy that allows cross-origin requests from any domain. Any malicious website can authenticate to a reachable UpTrain instance by embedding the known static key in the `uptrain-access-token` header, performing privileged operations as the default user. Proof-of-concept exploit code exists (confirmed by CVSS 4.0 E:P metric), and no vendor patch has been released as of publication.
Unauthorized message injection in the Mattermost GitLab Plugin (<=11.8) allows authenticated users to post bot-authored messages containing arbitrary URLs into restricted channels by exploiting two missing authorization checks: channel permission verification on the caller-supplied `post_id` parameter, and GitLab instance validation of the `web_url` parameter. Exploitation targets the `createIssue` and `attachCommentToIssue` API endpoints without requiring elevated privileges. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity and authenticated-only prerequisite make this a realistic internal threat in any Mattermost deployment running the GitLab integration.
Privilege escalation in Mattermost's channel administration API allows authenticated channel administrators to assign non-channel-scoped roles to channel members, exceeding their intended authorization boundary. Three active release lines are affected: 10.11.x through 10.11.21, 11.7.x through 11.7.6, and 11.8.x through 11.8.2. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private channel membership disclosure in Mattermost's Boards feature allows any authenticated team member to enumerate who belongs to private channels they are not authorized to view. Affected across three concurrently maintained release trains - 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 - the flaw is exploitable by any valid team account via standard board management API calls. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 4.3 (PR:L, C:L) accurately reflects the limited but real confidentiality impact, particularly meaningful in regulated environments where private channel membership itself is sensitive.
Mattermost's Playbooks feature in versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 omits run-state enforcement on API write operations, allowing any authenticated run participant to alter completed playbook runs via REST and GraphQL endpoints. An attacker with low privileges can overwrite status, checklists, retrospective content, ownership, and participant lists on runs that should be immutable once finished, undermining post-incident audit integrity. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in Mattermost's OAuth and personal access token management endpoints allows an OAuth application holding a delegated user token to call account-management endpoints beyond its intended scope, revoking the victim user's authorizations or tokens for unrelated integrations. Affected are Mattermost 11.7.0 through 11.7.6 and 10.11.0 through 10.11.21. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, network-accessible nature of the flaw makes it straightforward to abuse for any actor who has legitimately obtained an OAuth delegated token.
Privilege escalation in Mattermost's Boards feature allows a low-privileged board member to elevate a guest user to Board Admin by importing a specially crafted .boardarchive file. Affected are Mattermost versions 10.11.0 through 10.11.21 and 11.7.0 through 11.7.6. No public exploit or KEV listing has been identified, but the low attack complexity and the insider-threat profile make this a meaningful risk in multi-tenant or externally-collaborative Mattermost deployments.
Incorrect authorization in Mattermost's ABAC policy unassign API endpoint allows an authenticated team administrator to remove attribute-based access control policy assignments from channels that no longer belong to their team. Affected releases are Mattermost 11.7.0 through 11.7.6 and 11.8.0 through 11.8.3, tracked as MMSA-2026-00718 (ENISA EUVD-2026-60212). The exploit window opens when a channel is migrated between teams and the endpoint fails to re-verify team membership before executing the unassignment, letting a malicious admin modify access-control policy state beyond their administrative boundary.
Privilege retention in Mattermost Boards allows a user demoted to System Guest to continue exercising Board Admin privileges via the Boards REST API or UI. Affected are Mattermost versions 11.7.0-11.7.6, 10.11.0-10.11.21, and 11.8.0-11.8.3, where the SchemeAdmin flag is not reconciled against the user's current role during or after demotion. An authenticated attacker in this state can invoke admin-only Boards operations - including modifying board permissions and settings - without detection by role-based access checks. No public exploit code is identified and no CISA KEV listing is present at time of analysis.
Key derivation bypass in jahlives/openssl_encrypt PHP library before 1.4.6 allows offline password cracking at SHA-256 speed against credentials derived under the flawed sequential XOR composition mode. An algebraic cancellation in the key generation routine causes the memory-hard KDF's final stage to nullify itself, stripping the configured computational cost entirely and collapsing security to that of a single SHA-256 hash. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the impact is severe for any application storing user passwords in the vulnerable configuration.
Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. A public proof-of-concept exploit is available on GitHub; however, the CVSS 4.0 score of 2.0 and the PR:H requirement confirm that exploitation is bounded to already-authenticated high-privilege accounts, not unauthenticated external actors.
Authorization bypass in Webkul Bagisto's cache management endpoint allows authenticated low-privileged remote attackers to execute unauthorized cache management operations by manipulating the `action` parameter at `/admin/configuration/cache-management/execute`. Affected versions span the entire 2.4.x branch (2.4.0 through 2.4.4), with CWE-639 (Authorization Bypass Through User-Controlled Key) as the root cause. A public proof-of-concept exploit has been released, and the vendor has confirmed awareness with partial remediation underway - though no specific fixed version has been disclosed; no public exploit identified at time of analysis maps to confirmed active exploitation in CISA KEV.
Unauthenticated access to a phone-number lookup endpoint in ShopSmart Loyalty for WooCommerce (versions ≤1.0.0) exposes customer PII - name, email address, and loyalty account balance - to any caller who supplies a valid phone number. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the plugin performs no ownership or identity check before returning profile data. A public exploit exists via WPScan; the SSVC framework flags the attack as automatable, enabling systematic bulk harvesting of customer records across affected WooCommerce stores.
Persistent ad-blocking bypass in Adblock for Youtube Extension versions up to 7.2.1 on Google Chrome allows remote web content to silently disable the extension's filtering rules by exploiting an improper authorization flaw (CWE-285) in the contentscript.js event listener. The updateDynamicRules function processes the yt-anti-adblock-detected DOM event without verifying the caller's origin or authorization, meaning any adversarial webpage can trigger the function and persistently disable ad blocking. Publicly available exploit code demonstrates this technique; the vulnerability is not listed in the CISA KEV catalog and no vendor patch exists, as the maintainer did not respond to pre-disclosure outreach.
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. The vendor has independently confirmed the vulnerability exists. No public exploit code or CISA KEV listing is identified at time of analysis.
Authentication bypass in TreeFrog Framework through version 2.11.2 exploits a timing side-channel in the Session Cookie Handler, where std::strncmp's early-exit comparison behavior allows remote attackers to statistically recover valid session token values and forge authenticated sessions. Any web application compiled against the affected framework that uses default session cookie authentication is exposed. A public proof-of-concept exploit has been released, increasing targeted risk despite the high attack complexity required.
The Acer Planet9 desktop application contains a hardcoded read-only API key that grants unauthenticated network access to Acer's internal repositories. Any user possessing the application binary can extract this credential via static analysis, access repository contents, and recover embedded administrative credentials from within those repositories - potentially enabling administrative control over repository infrastructure and software source code modification. No public exploit code exists at time of analysis (CVSS 4.0 E:U), and Acer has released an update to remediate the issue.
The backup endpoint on LB-Link WR1210M firmware 1.0.3 exposes device configuration data to unauthenticated adjacent-network attackers due to missing authentication in the main() function of /www/cgi-bin/backup.cgi. Any attacker on the same local network segment can retrieve the router's backup archive without credentials, potentially obtaining Wi-Fi passphrases, administrative passwords, and network configuration. No public exploit has been identified at time of analysis, and the vendor did not respond to responsible disclosure, leaving no patch available.
Authorization bypass in CodeCanyon's TimeCamp Integration for CRM (all versions through 2.8) allows authenticated remote attackers to manipulate the contact_id parameter submitted to the /clients/save_contact endpoint, overwriting or corrupting contact records belonging to other users without owning those records. The flaw is a classic Insecure Direct Object Reference (CWE-639): the application trusts the caller-supplied contact_id without verifying record ownership against the authenticated session. Publicly available exploit code exists on GitHub, materially lowering the barrier to exploitation.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository.
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.
Authorization bypass in the ShortPixel Adaptive Images WordPress plugin (all versions ≤ 3.11.5) allows authenticated subscribers to modify configuration settings of co-installed optimization plugins including WP Rocket, Autoptimize, Imagify, LiteSpeed Cache, and ShortPixel Image Optimizer, as well as the plugin's own API key and account binding. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting opportunistic risk but making it relevant where open user registration is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Insecure Direct Object Reference in the PPWP - Password Protect Pages WordPress plugin (all versions ≤ 1.9.20) allows any authenticated Contributor-level user to overwrite the password on any password-protected post site-wide, then access that previously restricted content. The vulnerability exists in the `ppw_free_set_password` AJAX handler, which accepts a user-controlled post identifier without verifying the requesting user's authorization over the target object (CWE-639). No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; a fix commit is available in the WordPress plugin repository.
Authorization bypass in the Everest Forms WordPress plugin (all versions ≤ 3.5.2) allows authenticated attackers holding any delegated Everest Forms capability to activate arbitrary already-installed WordPress plugins - including previously deactivated or known-vulnerable ones - without the WordPress core `activate_plugins` capability. The flaw exists in AJAX handlers (`class-evf-ajax.php`) and REST API endpoints (`class-evf-modules.php`) that issue nonces to any delegated EVF user on admin pages but fail to enforce the required core capability before executing plugin activation. No public exploit is identified at time of analysis, though Wordfence has published direct source code references to the vulnerable handlers, reducing the research burden for potential exploitation.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade change_non_present_huge_pmd() rewrites a writable device-private PMD swap entry into a readable one without carrying pmd_swp_uffd_wp() across. The PTE-level change_softleaf_pte() does this correctly; mirror that here, matching what copy_huge_pmd() does for the fork path. Without the carry, a plain mprotect() over a UFFD_WP-marked device-private THP strips the bit and the trap is bypassed on swap-in.
In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300->kref, with vub300_delete() freeing the mmc host when the last reference is dropped. The probe error path after the inactivity timer has been armed still bypasses that lifetime rule, however, and falls through to mmc_free_host() directly if mmc_add_host() fails. The race window is between arming the inactivity timer and reaching the probe error unwind after mmc_add_host() fails: probe thread timer/workqueue ------------ --------------- kref_init(&vub300->kref) ref = 1 kref_get(&vub300->kref) ref = 2, timer ref add_timer(inactivity_timer) fires after one second | | race window |<----------------------------------------------------> | mmc_add_host(mmc) inactivity timer fires vub300_queue_dead_work() kref_get() ref = 3 queue_work(deadwork) mmc_add_host() fails timer_delete_sync() mmc_free_host(mmc) frees vub300 deadwork runs use-after-free The inactivity timeout is one second, so this would require mmc_add_host() to both fail and take more than one second to do so. This is unlikely to happen in practice, but the error path is still wrong. timer_delete_sync() only waits for the timer callback itself. It does not flush deadwork that the callback may already have queued. As a result, queued deadwork can still hold a kref while the probe error path directly frees the backing mmc host, including the vub300 storage. Fix this by using the same lifetime mechanism as disconnect. Clear vub300->interface so that the timer callback and any queued deadwork return early and drop their references, then drop the initial probe reference and return without falling through to err_free_host.
Missing authorization on four Socket.IO event handlers in FUXA 1.3.2 and earlier exposes SCADA/HMI system-discovery metadata - device topology, node attributes, host network interfaces, and device tags - to any remote unauthenticated or guest user when the platform's security mode (secureEnabled=true) is active. The DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js omit the isSocketAdminAuthorized check that governs other protected events, creating an authorization gap specifically in hardened deployments. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible nature and zero-privilege requirement make passive reconnaissance trivial against exposed instances. A vendor-released patch is available in FUXA v1.3.3.
Unauthenticated sensitive information disclosure in SJRC F11 SJ-GPS-PRO GPS drone firmware (build 2019-09-17) exposes device data to any adjacent-network attacker via an inetd service that performs no credential validation. The root cause is CWE-306 (Missing Authentication for Critical Function): the inetd service accepts connections and returns sensitive information without requiring any authentication, matching the Authentication Bypass tag. No public exploit code has been confirmed absent, as a researcher-published GitHub advisory with a dedicated CVE advisory document exists, indicating public documentation of the attack method. No active exploitation has been confirmed by CISA KEV at the time of this analysis.
Privilege escalation in Malcolm's nginx Lua RBAC layer allows authenticated low-privilege users to access administrator-only endpoints by submitting percent-encoded request URIs that bypass the access control gate. Malcolm versions up to and including 26.07.1 are affected, with restricted paths including /htadmin, /arkime/api/esadmin, NetBox, and file upload endpoints all reachable via this encoding bypass. A proof-of-concept exists per SSVC classification, though this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Arbitrary file read in OpenList prior to 4.2.4 enables authenticated users with CanShare permission to bypass directory boundary enforcement and exfiltrate files outside their assigned BasePath. The flaw in the share creation and update handlers uses Go's strings.HasPrefix without a separator-aware boundary check, so a user restricted to /base can create a valid share for /base2/secret.txt because the prefix match returns true. A detailed proof-of-concept is publicly documented in GHSA-86cx-wwf4-phq4; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated read access to VReplication log data in Vitess vttablet (versions 24.0.2 and earlier) exposes raw SQL statements and bound application parameter values to any caller who can reach the debug HTTP port. The `/debug/vrlog` endpoint, registered via `addHttpEndpoint()` in `go/vt/vttablet/tabletmanager/vreplication/vrlog.go`, invokes `vrlogStatsHandler()` without the `acl.CheckAccessHTTP(r, acl.DEBUGGING)` guard applied to every comparable debug endpoint, violating the operator-configured security policy. Critically, the feature is disabled by default since v22 and requires explicit opt-in via `--vreplication-enable-http-log`, which materially limits real-world exposure; no public exploit has been identified and the CVE is not listed in CISA KEV.
Insecure Direct Object Reference (IDOR) in Kurrier's API layer exposes webhook and identity resource metadata to any authenticated API user prior to version 1.2.4. Any holder of a valid Kurrier API key can read and enumerate webhook configurations and identity records belonging to other accounts by supplying a victim's resource identifier to four unprotected GET and list endpoints. Confidentiality impact is limited to resource metadata - cross-user write and delete operations were already blocked - but the flaw enables reconnaissance of account configurations within a shared Kurrier instance. No public exploit code has been identified at time of analysis.
Cross-cluster traffic interception in Submariner (shipped within Red Hat Advanced Cluster Management for Kubernetes 2) allows a single compromised member cluster to overwrite the endpoint records of other clusters in the mesh. Because the submariner-k8s-broker-cluster Role granted to every joined cluster carries more write access than it needs, an attacker holding one cluster's broker credentials can reroute inter-cluster tunnel traffic through attacker-controlled endpoints and mount a mesh-wide man-in-the-middle. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Socket.IO namespace access control bypass in MagicMirror² prior to v2.37.0 allows unauthenticated adjacent-network clients to interact directly with module helpers, bypassing the configured ipWhitelist that protects only the Express HTTP layer. Affected deployments binding to non-loopback interfaces can be exploited for server-side request forgery via the default newsfeed and calendar helpers, and conditionally for command execution via child_process.exec through the updatenotification helper when a third-party module update is pending. No public exploit code has been identified at time of analysis and this vulnerability is not in CISA KEV.
Broken authorization in Saleor's centralized GraphQL permission utility allows unauthenticated callers to silently modify channel-level order settings and enumerate hidden storefront objects that should require management privileges. Versions 3.14.67 through the pre-patch releases across the 3.21.x, 3.22.x, and 3.23.x branches are affected, with the headless GraphQL API serving as the attack surface. Fixed releases 3.21.67, 3.22.63, and 3.23.22 are vendor-confirmed; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cleartext storage of a long-lived broker service account bearer token in the Submariner Custom Resource specification exposes full mesh network control to any Kubernetes principal with CR read access. Red Hat Advanced Cluster Management for Kubernetes 2 (RHACM 2) is confirmed affected via CPE. An attacker who retrieves the token - through a routine `kubectl get` invocation or direct etcd access - gains unrestricted authority to manage Submariner endpoints, secrets, and cross-cluster network resources, constituting a complete compromise of the multi-cluster network plane. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The LDAP Source debug API endpoint in authentik, an open-source identity provider, omits the object-level read-authorization filter present on the rest of the API prior to versions 2026.2.6 and 2026.5.5, enabling unauthenticated callers to retrieve LDAP directory metadata from any configured LDAP Source. Any network-reachable client can invoke the diagnostic action, causing the authentik server to connect to the upstream directory with its stored bind credentials and return a bounded set of distinguished names and attribute names - exposing account and group naming conventions and directory structure without disclosing attribute values. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
CRLF injection in ePA 3.x Integration's VAU inner HTTP request builder allows an authenticated attacker to inject arbitrary headers into encrypted tunnel requests destined for Germany's electronic patient record (ePA) backend, potentially exposing other patients' medical records or bypassing authorization controls. The flaw exists in the build_inner_header function of app/vau/VAUProtokoll.py, which interpolates user-controlled values - including insurant_id and USER_AGENT - directly into raw HTTP header strings without stripping carriage-return or line-feed characters. No public exploit code has been identified at time of analysis, and the issue is fixed in release 1.3.0.
Improper access control (CWE-284) in the custom fields webservice API of Joomla! CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 allows authenticated high-privilege users to create custom fields for components whose ACL restrictions should deny them access. The flaw represents an authorization bypass at the API layer - the REST webservice endpoints for custom fields do not enforce the same component-level ACL checks applied in the web UI, creating a privilege boundary discrepancy. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 with PR:H reflects that exploitation is constrained to already-authenticated, elevated users.
Improper access control in Joomla! CMS 5.1.0-5.4.7 and 6.0.0-6.1.2 leaks restricted contact data into schema.org structured data snippets embedded in page output. The CMS fails to enforce ACL rules during schema.org contact snippet generation, allowing contact details for items that should be inaccessible to be injected into structured metadata visible in page source. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
Improper ACL enforcement in Joomla! CMS batch copy functionality allows authenticated backend users to copy content items they do not have edit permissions for, effectively bypassing content-level access controls. Affected versions span two active release branches: 4.0.0-5.4.7 and 6.0.0-6.1.2, covering a broad portion of active Joomla deployments. No public exploit code exists at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in active exploitation campaigns.
Joomla! CMS exposes a broken access control flaw on its webservices API category endpoints, permitting users who lack the requisite ACL permissions to create content categories they are explicitly not authorized to manage. The issue spans a large installed base across two major release lines: versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are confirmed affected. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, but the flaw is network-accessible, requires no complex conditions to trigger via the webservices interface, and was reported directly by the Joomla project.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.
MyBB's calendar module prior to version 1.8.40 exposes private forum events to any authenticated user possessing calendar viewing or moderation permissions, due to seven missing authorization checks across calendar.php action handlers. Authenticated forum members can read and modify private calendar events created by other users - data the event creator intended to restrict exclusively to themselves. No public exploit code has been identified at time of analysis and the flaw is absent from CISA KEV, but exploitation requires only a standard low-privilege forum account, keeping the practical barrier for abuse low.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Incorrect authorization in MyBB's calendar module prior to version 1.8.40 allows authenticated users holding moderation rights on one calendar to relocate events to calendars where they possess only viewing permissions. The `do_move` action in `calendar.php` validated `canmoderateevents` for the source calendar but omitted the equivalent check for the destination, enabling unauthorized cross-calendar event manipulation. No public exploit code or active exploitation has been identified; the fix is confirmed in version 1.8.40 via a one-line permission guard added to the destination calendar lookup.
Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
File/directory key confusion in Copyparty before 1.20.17 allows an authenticated user holding a valid file key to escalate that key into a directory key, gaining unauthorized read access to the entire containing folder. The flaw stems from a missing guard in httpcli.py that unconditionally set the directory key flag even when a file key was active. Exploitation is constrained to volumes where administrators have explicitly enabled both file-key (fk or fka) and directory-key (dk or dks) volume flags simultaneously - a non-default combination - and no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated IDOR in the Razorpay for WooCommerce WordPress plugin (versions ≤ 4.8.7) allows remote attackers to manipulate order object references without any authentication, potentially bypassing payment authorization checks or modifying order state. Reported by Patchstack and corroborated by ENISA EUVD-2026-60817, this affects all WooCommerce stores running the vulnerable plugin versions with the Razorpay payment gateway active. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network vector with low attack complexity means opportunistic abuse requires minimal skill.
Broken Access Control in WP Table Builder WordPress plugin versions 2.2.0 and earlier permits authenticated Contributor-level users to invoke restricted plugin functionality beyond their assigned role scope, resulting in unauthorized integrity impact against site content. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate whether the requesting user holds sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and KEV status is not confirmed, placing this in a managed-patching priority tier rather than an emergency response category.
Broken access control in Gravity Booster - Styles & Layouts for Gravity Forms (WordPress plugin by WPMonks) through version 6.0 permits any authenticated subscriber to invoke functionality restricted to higher-privileged roles, yielding limited but real confidentiality and integrity impact. Reported by Patchstack and catalogued as EUVD-2026-60813, the flaw stems from missing authorization checks (CWE-862) on plugin operations, enabling subscriber-level users to read or modify form style and layout configurations beyond their intended permissions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in RomethemeForm For Elementor WordPress plugin versions 1.2.6 and earlier permits authenticated users holding the Contributor role to perform actions that exceed their authorized permission scope. Rooted in missing authorization checks (CWE-862), the flaw allows low-privilege WordPress users - who normally cannot publish content or manage plugin settings - to trigger restricted plugin functionality, resulting in unauthorized integrity impact. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, placing this in the category of medium-severity findings warranting patching rather than emergency response.
Broken authentication in WPEverest's User Registration WordPress plugin (versions 5.2.6 and below) permits subscriber-level authenticated users to bypass authentication controls and perform unauthorized actions beyond their role permissions. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable with low-privilege access required, producing limited but real integrity and availability impact. No public exploit code or active CISA KEV listing has been identified at time of analysis.
Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenticated subscriber to bypass role-based authorization checks and access data restricted to higher-privilege roles, resulting in high confidentiality impact. The CVSS vector confirms this is network-exploitable with low complexity and no user interaction required beyond holding a subscriber-level account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation on open-registration LMS platforms makes this a credible threat to sensitive course and student data.
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface elevate practical risk for any business relying on appointment integrity.
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting.
Broken access control in GiveWP WordPress plugin versions up to and including 4.16.5.1 allows unauthenticated remote attackers to bypass authorization checks and interact with restricted plugin functionality. Reported by Patchstack (ENISA EUVD-2026-60779), the flaw maps to CWE-862 (Missing Authorization), meaning the plugin fails to verify caller permissions before executing sensitive operations. The CVSS vector confirms no credentials or user interaction are required, resulting in limited but real confidentiality and integrity impact - likely exposure or manipulation of donation records or plugin-controlled data. No public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the Modal Survey WordPress plugin (versions up to and including 2.0.2.2.3) allows authenticated subscribers to bypass authorization controls and access survey objects belonging to other users by manipulating user-controlled keys in requests. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting the attack surface to sites with open registration or with existing low-privilege user accounts. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Authorization bypass in Dolibarr ERP/CRM's clonetasks mass action allows authenticated users with project creation permissions to insert task records into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check within actions_massactions.inc.php incorrectly grants authorization to non-members when it should deny them. The attacker controls the target via a user-supplied projectid POST parameter, making exploitation straightforward for any authenticated user with basic project permissions. No public exploit code has been identified at time of analysis, and a vendor patch is available via upstream commit.
Authorization bypass in EdoWEB (all versions before 780-g7) by Netiket Information Technologies allows authenticated low-privileged users to access ACL-restricted functionality and data by manipulating user-controlled keys. The flaw is rooted in CWE-639 (Insecure Direct Object Reference), where the application trusts a client-supplied key without verifying the requesting user's authorization to the referenced object. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; exploitation is constrained by high attack complexity and a required authenticated session.
Same-origin policy bypass in Firefox's ImageLib image rendering component allows remote attackers to read cross-origin data or perform unauthorized cross-origin writes against victims using unpatched browser versions. Affected releases span the main Firefox channel (prior to 154) and three ESR branches (prior to ESR 115.39, ESR 140.14, and ESR 153.1), placing a large share of the global Firefox install base at risk until patched. The CVSS 5.4 score reflects limited confidentiality and integrity impact with no authentication requirement on the attacker side, though no public exploit has been identified and this CVE is not listed in the CISA KEV catalog at the time of analysis.
Same-origin policy bypass in Firefox's Audio/Video Playback component exposes users to cross-origin data reads and limited content manipulation when visiting a malicious webpage. All Firefox stable releases prior to 154 and both ESR tracks prior to 140.14 and 153.1 are affected, with Mozilla issuing a coordinated advisory series (mfsa2026-74 through mfsa2026-80) covering the full release matrix. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires user interaction but no credentials or special configuration.
Same-origin policy bypass in Firefox's Networking: Cookies component exposes users to cross-origin cookie theft and manipulation when visiting attacker-controlled pages. All Firefox versions prior to 154 and both ESR branches prior to ESR 140.14 and ESR 153.1 are affected, with Mozilla publishing at least six separate security advisories (mfsa2026-74 through mfsa2026-80) indicating broad coverage across release tracks. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the CVSS 5.4 Medium score reflects real but bounded confidentiality and integrity risk, gated by a mandatory user-interaction requirement.
DLL sideloading in the Zabbix Agent Windows installer allows a local attacker with write access to a custom installation directory to plant a malicious DLL that the agent process subsequently loads. The installer previously failed to validate whether a user-selected directory had appropriately restrictive access controls, leaving deployments in permissive directories silently exposed. No public exploit has been identified at time of analysis, and the vendor has already shipped a hardened installer that warns users before proceeding with potentially unsafe target directories.
Batch and time-series HTTP handlers in ArcadeDB before 26.8.1 omit the setCurrentUser call when dispatching work to worker threads, causing the fine-grained per-type ACL layer to silently skip authorization checks for those endpoints. Authenticated users with restricted per-type permissions can read from and write to data types they are not authorized to access by routing requests through the affected handlers. No public exploit has been identified and the CVSS 4.0 score of 2.3 reflects the narrow exploitation prerequisites - only deployments actively using per-type or per-group ACLs are vulnerable.
Keycloak's authorization services group policy provider grants unauthorized access to protected resources by matching group membership using only group names in tokens rather than full hierarchical paths. Authenticated users whose account belongs to a same-named but structurally distinct group can be silently elevated to the permissions of an authorized group, bypassing fine-grained access controls. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is rated High given the policy bypass directly subverts resource access decisions.
OAuth Sign-In bypass in Karakeep up to version 0.32.0 allows unauthenticated remote attackers to subvert the authentication process via manipulation of logic in apps/web/server/auth.ts, achieving a low-integrity impact on the vulnerable system without requiring credentials or user interaction. High attack complexity (AC:H) means exploitation demands engineered conditions in the OAuth callback flow rather than trivial exploitation. No vendor patch has been issued at time of analysis; a public proof-of-concept has been disclosed via GitHub issue #2920 and indexed by VulDB, no public exploit identified at time of analysis for widespread automated campaigns but the PoC reduces the barrier for targeted attacks.
Incorrect authorization in Mattermost Boards allows an authenticated board editor to relink any editable board to an arbitrary channel by exploiting a missing PermissionManageBoardRoles check on the channelId field of the batch endpoint. Affected are Mattermost versions 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 (advisory MMSA-2026-00686). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to execute for any authenticated board editor.
Privilege escalation in Onyx Enterprise Edition (versions prior to 4.3.0) allows any authenticated curator to modify user groups outside their assigned scope, gaining unauthorized document access through the platform's OpenSearch access_control_list filter. The PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints relied solely on a role check confirming the caller held curator status somewhere in the system, but the underlying database functions update_user_group and add_users_to_user_group never invoked _validate_curator_can_modify_group to scope that access to specific groups. No public exploit has been identified at time of analysis, and the issue is fixed in the vendor-released version 4.3.0.
IPSec authentication bypass in Apple iOS and iPadOS (all versions prior to 26.6.1) allows an adjacent-network attacker to circumvent IPSec mutual authentication and intercept device network traffic. The root cause is improper state management (CWE-287) in the IPSec stack, corrected in iOS 26.6.1 and iPadOS 26.6.1. No public exploit code has been identified at time of analysis, and EPSS at 0.19% (10th percentile) confirms minimal observed exploitation activity.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Missing authorization enforcement on the log-inputs API endpoint in MLflow 3.13.0 through 3.14.x allows any authenticated user to inject fabricated DatasetInput records into another user's run lineage metadata without holding UPDATE permission on that run. The root cause is that the LogInputs (and LogOutputs) handler was simply never registered in the BEFORE_REQUEST_HANDLERS auth middleware map, leaving the POST /api/2.0/mlflow/runs/log-inputs endpoint unguarded. No active exploitation has been confirmed (not listed in CISA KEV), and a vendor-released patch is available in version 3.15.0.
Privilege escalation in JumpServer prior to 4.10.17 allows an authenticated user holding the `users.invite_user` permission to silently overwrite any existing organization member's role assignments by re-submitting that member through the invite API endpoint, enabling both upward privilege escalation and downward administrator demotion. The root cause is a single Django ORM call - `user.org_roles.set(org_roles)` in `apps/users/api/user.py` - which unconditionally replaces the full many-to-many role set without verifying whether the target already belongs to the organization. No public exploit has been identified and this CVE is not listed in CISA KEV; a confirmed patch is available in v4.10.17.
Broken object-level authorization on the portal ping and wake-on-LAN endpoints in Next Terminal exposes all registered asset metadata and WoL controls to any authenticated portal user, regardless of their assigned asset permissions. The wildcard CPE (all versions) indicates no patched release exists, and the flaw is rooted in CWE-862 (Missing Authorization) - a structural gap in the access-control layer rather than a logic edge case. An attacker holding any valid portal credential can silently enumerate asset display names, IP addresses, reachability status, and connection timing, then issue WoL packets to bring unauthorized offline assets online. No public exploit code or CISA KEV listing has been identified at time of analysis.
Integrity bypass in ApostropheCMS page management allows authenticated low-privileged editors to move pages into restricted subtrees they have no create rights over, and indirectly re-rank admin-only sibling pages via an unchecked database updateMany call. All deployments running ApostropheCMS prior to 4.32.0 are affected; the flaw exists in the REST page update endpoint and requires no special configuration to reach. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the attack path through documented REST parameters is straightforward for any CMS insider.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.
Account enumeration in JetBrains YouTrack before version 2026.2.18112 exposes internal user accounts to any authenticated user through insufficient authorization controls on the users search endpoint. The root cause is CWE-862 (Missing Authorization): the endpoint performs no privilege check beyond requiring a valid session, allowing low-privilege users to systematically extract account identifiers across the entire instance. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the straightforward exploitation path makes patching a clear priority.
Passkey management in New API, an LLM gateway and AI asset management system, permits lower-privileged administrators to delete passkeys belonging to same-level or higher-privileged accounts-including the root account-via the DELETE /api/user/:id/reset_passkey endpoint. Versions 0.9.1.3 through 1.0.0-rc.7 (exclusive) are affected because AdminResetPasskey in controller/passkey.go omits the canManageTargetRole authorization check applied consistently to every comparable privileged-account-management endpoint in the codebase. No public exploit has been identified at time of analysis, but successful exploitation silently removes a FIDO2 second factor from high-value accounts, potentially enabling credential-only takeover as a follow-on attack.
Unauthorized private message excerpt exposure in Discourse allows authenticated category group moderators to read flag-related companion PM content they were never intended to access, via the review queue API. Affected are Discourse deployments with category group moderation enabled running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1. No public exploit exists and the issue is absent from CISA KEV; however, the missing authorization check (CWE-862) means any authenticated category group moderator can silently read confidential flag discussion excerpts, directly undermining the trust model of the platform's moderation system.
Information disclosure in Discourse allows authenticated group members to access unpublished shared-draft content through improperly guarded API endpoints. Group members holding view-only activity permissions - but explicitly excluded from shared-draft access - can retrieve draft topic titles and post excerpts via the group posts and group mentions endpoints due to a missing authorization check (CWE-862). Fixed versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Hidden post content disclosure in Discourse allows unauthenticated visitors and search-engine crawlers to read first-post content that was explicitly hidden or made unviewable through moderation controls. Affected versions span multiple release branches prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The authorization check governing post visibility is not applied when generating Q&A JSON-LD structured data, so the raw excerpt appears in publicly-served HTML. No public exploit code exists and this vulnerability is not listed in CISA KEV.
UpTrain versions 0.7.1 and prior expose a critical authentication bypass combining two design flaws: a static default API key that equals the default username (making it predictable to any observer), and a permissive CORS policy that allows cross-origin requests from any domain. Any malicious website can authenticate to a reachable UpTrain instance by embedding the known static key in the `uptrain-access-token` header, performing privileged operations as the default user. Proof-of-concept exploit code exists (confirmed by CVSS 4.0 E:P metric), and no vendor patch has been released as of publication.
Unauthorized message injection in the Mattermost GitLab Plugin (<=11.8) allows authenticated users to post bot-authored messages containing arbitrary URLs into restricted channels by exploiting two missing authorization checks: channel permission verification on the caller-supplied `post_id` parameter, and GitLab instance validation of the `web_url` parameter. Exploitation targets the `createIssue` and `attachCommentToIssue` API endpoints without requiring elevated privileges. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity and authenticated-only prerequisite make this a realistic internal threat in any Mattermost deployment running the GitLab integration.
Privilege escalation in Mattermost's channel administration API allows authenticated channel administrators to assign non-channel-scoped roles to channel members, exceeding their intended authorization boundary. Three active release lines are affected: 10.11.x through 10.11.21, 11.7.x through 11.7.6, and 11.8.x through 11.8.2. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private channel membership disclosure in Mattermost's Boards feature allows any authenticated team member to enumerate who belongs to private channels they are not authorized to view. Affected across three concurrently maintained release trains - 11.7.x through 11.7.6, 10.11.x through 10.11.21, and 11.8.x through 11.8.3 - the flaw is exploitable by any valid team account via standard board management API calls. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 4.3 (PR:L, C:L) accurately reflects the limited but real confidentiality impact, particularly meaningful in regulated environments where private channel membership itself is sensitive.
Mattermost's Playbooks feature in versions 11.7.x through 11.7.6 and 10.11.x through 10.11.21 omits run-state enforcement on API write operations, allowing any authenticated run participant to alter completed playbook runs via REST and GraphQL endpoints. An attacker with low privileges can overwrite status, checklists, retrospective content, ownership, and participant lists on runs that should be immutable once finished, undermining post-incident audit integrity. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in Mattermost's OAuth and personal access token management endpoints allows an OAuth application holding a delegated user token to call account-management endpoints beyond its intended scope, revoking the victim user's authorizations or tokens for unrelated integrations. Affected are Mattermost 11.7.0 through 11.7.6 and 10.11.0 through 10.11.21. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, though the low-complexity, network-accessible nature of the flaw makes it straightforward to abuse for any actor who has legitimately obtained an OAuth delegated token.
Privilege escalation in Mattermost's Boards feature allows a low-privileged board member to elevate a guest user to Board Admin by importing a specially crafted .boardarchive file. Affected are Mattermost versions 10.11.0 through 10.11.21 and 11.7.0 through 11.7.6. No public exploit or KEV listing has been identified, but the low attack complexity and the insider-threat profile make this a meaningful risk in multi-tenant or externally-collaborative Mattermost deployments.
Incorrect authorization in Mattermost's ABAC policy unassign API endpoint allows an authenticated team administrator to remove attribute-based access control policy assignments from channels that no longer belong to their team. Affected releases are Mattermost 11.7.0 through 11.7.6 and 11.8.0 through 11.8.3, tracked as MMSA-2026-00718 (ENISA EUVD-2026-60212). The exploit window opens when a channel is migrated between teams and the endpoint fails to re-verify team membership before executing the unassignment, letting a malicious admin modify access-control policy state beyond their administrative boundary.
Privilege retention in Mattermost Boards allows a user demoted to System Guest to continue exercising Board Admin privileges via the Boards REST API or UI. Affected are Mattermost versions 11.7.0-11.7.6, 10.11.0-10.11.21, and 11.8.0-11.8.3, where the SchemeAdmin flag is not reconciled against the user's current role during or after demotion. An authenticated attacker in this state can invoke admin-only Boards operations - including modifying board permissions and settings - without detection by role-based access checks. No public exploit code is identified and no CISA KEV listing is present at time of analysis.
Key derivation bypass in jahlives/openssl_encrypt PHP library before 1.4.6 allows offline password cracking at SHA-256 speed against credentials derived under the flawed sequential XOR composition mode. An algebraic cancellation in the key generation routine causes the memory-hard KDF's final stage to nullify itself, stripping the configured computational cost entirely and collapsing security to that of a single SHA-256 hash. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the impact is severe for any application storing user passwords in the vulnerable configuration.
Authorization bypass in Bagisto's backend RMA endpoint allows authenticated admin-level users to access or manipulate Return Merchandise Authorization records they are not authorized to view or modify, affecting all Bagisto releases through version 2.4.4. The flaw is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class weakness in the /admin/sales/rma/requests handler, enabling horizontal privilege escalation across sales data within the admin panel. A public proof-of-concept exploit is available on GitHub; however, the CVSS 4.0 score of 2.0 and the PR:H requirement confirm that exploitation is bounded to already-authenticated high-privilege accounts, not unauthenticated external actors.
Authorization bypass in Webkul Bagisto's cache management endpoint allows authenticated low-privileged remote attackers to execute unauthorized cache management operations by manipulating the `action` parameter at `/admin/configuration/cache-management/execute`. Affected versions span the entire 2.4.x branch (2.4.0 through 2.4.4), with CWE-639 (Authorization Bypass Through User-Controlled Key) as the root cause. A public proof-of-concept exploit has been released, and the vendor has confirmed awareness with partial remediation underway - though no specific fixed version has been disclosed; no public exploit identified at time of analysis maps to confirmed active exploitation in CISA KEV.
Unauthenticated access to a phone-number lookup endpoint in ShopSmart Loyalty for WooCommerce (versions ≤1.0.0) exposes customer PII - name, email address, and loyalty account balance - to any caller who supplies a valid phone number. Rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), the plugin performs no ownership or identity check before returning profile data. A public exploit exists via WPScan; the SSVC framework flags the attack as automatable, enabling systematic bulk harvesting of customer records across affected WooCommerce stores.
Persistent ad-blocking bypass in Adblock for Youtube Extension versions up to 7.2.1 on Google Chrome allows remote web content to silently disable the extension's filtering rules by exploiting an improper authorization flaw (CWE-285) in the contentscript.js event listener. The updateDynamicRules function processes the yt-anti-adblock-detected DOM event without verifying the caller's origin or authorization, meaning any adversarial webpage can trigger the function and persistently disable ad blocking. Publicly available exploit code demonstrates this technique; the vulnerability is not listed in the CISA KEV catalog and no vendor patch exists, as the maintainer did not respond to pre-disclosure outreach.
Authorization bypass in the WebDAV Service COPY/MOVE operations on seventeen GL.iNet router models running firmware up to 4.8.x allows remote unauthenticated attackers to read and write files outside their authorized share boundaries. The root cause, per the GitHub reference title 'WebDAV Public-Share Destination Authorization Bypass', is that the destination path supplied in COPY/MOVE requests is not properly authorization-checked against the caller's access scope - a classic CWE-639 user-controlled key bypass. The vendor has independently confirmed the vulnerability exists. No public exploit code or CISA KEV listing is identified at time of analysis.
Authentication bypass in TreeFrog Framework through version 2.11.2 exploits a timing side-channel in the Session Cookie Handler, where std::strncmp's early-exit comparison behavior allows remote attackers to statistically recover valid session token values and forge authenticated sessions. Any web application compiled against the affected framework that uses default session cookie authentication is exposed. A public proof-of-concept exploit has been released, increasing targeted risk despite the high attack complexity required.
The Acer Planet9 desktop application contains a hardcoded read-only API key that grants unauthenticated network access to Acer's internal repositories. Any user possessing the application binary can extract this credential via static analysis, access repository contents, and recover embedded administrative credentials from within those repositories - potentially enabling administrative control over repository infrastructure and software source code modification. No public exploit code exists at time of analysis (CVSS 4.0 E:U), and Acer has released an update to remediate the issue.
The backup endpoint on LB-Link WR1210M firmware 1.0.3 exposes device configuration data to unauthenticated adjacent-network attackers due to missing authentication in the main() function of /www/cgi-bin/backup.cgi. Any attacker on the same local network segment can retrieve the router's backup archive without credentials, potentially obtaining Wi-Fi passphrases, administrative passwords, and network configuration. No public exploit has been identified at time of analysis, and the vendor did not respond to responsible disclosure, leaving no patch available.
Authorization bypass in CodeCanyon's TimeCamp Integration for CRM (all versions through 2.8) allows authenticated remote attackers to manipulate the contact_id parameter submitted to the /clients/save_contact endpoint, overwriting or corrupting contact records belonging to other users without owning those records. The flaw is a classic Insecure Direct Object Reference (CWE-639): the application trusts the caller-supplied contact_id without verifying record ownership against the authenticated session. Publicly available exploit code exists on GitHub, materially lowering the barrier to exploitation.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository.
Insufficient authorization in the Visualizer WordPress plugin before 4.0.7 permits any authenticated Contributor-level user to retrieve the full configuration of every chart on the site through a single API request, bypassing the plugin's own UI-level access controls. The exposed configuration data may include credentials for remote data sources - such as database connection strings or API keys - that chart owners have configured. A publicly available proof-of-concept is referenced by WPScan; no active exploitation has been confirmed by CISA KEV, though the low barrier to exploitation makes patching urgent for any site with untrusted contributor accounts.
Improper payout validation in the Premium Packages WordPress plugin (all versions before 7.0.7) allows any authenticated user - including subscribers with zero sales history - to submit withdrawal requests for arbitrary monetary amounts. Because the plugin never cross-references the requested amount against the user's actual earned balance, a low-privilege attacker can fabricate a payout claim that an administrator may approve and disburse as real funds. A publicly available proof-of-concept exists; no confirmed active exploitation (CISA KEV) has been recorded, and EPSS probability stands at 0.14% (4th percentile), suggesting opportunistic rather than widespread targeting.
Authorization bypass in the ShortPixel Adaptive Images WordPress plugin (all versions ≤ 3.11.5) allows authenticated subscribers to modify configuration settings of co-installed optimization plugins including WP Rocket, Autoptimize, Imagify, LiteSpeed Cache, and ShortPixel Image Optimizer, as well as the plugin's own API key and account binding. The CVSS vector (PR:L) confirms exploitation requires at minimum a subscriber-level WordPress account, limiting opportunistic risk but making it relevant where open user registration is enabled. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Insecure Direct Object Reference in the PPWP - Password Protect Pages WordPress plugin (all versions ≤ 1.9.20) allows any authenticated Contributor-level user to overwrite the password on any password-protected post site-wide, then access that previously restricted content. The vulnerability exists in the `ppw_free_set_password` AJAX handler, which accepts a user-controlled post identifier without verifying the requesting user's authorization over the target object (CWE-639). No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis; a fix commit is available in the WordPress plugin repository.
Authorization bypass in the Everest Forms WordPress plugin (all versions ≤ 3.5.2) allows authenticated attackers holding any delegated Everest Forms capability to activate arbitrary already-installed WordPress plugins - including previously deactivated or known-vulnerable ones - without the WordPress core `activate_plugins` capability. The flaw exists in AJAX handlers (`class-evf-ajax.php`) and REST API endpoints (`class-evf-modules.php`) that issue nonces to any delegated EVF user on admin pages but fail to enforce the required core capability before executing plugin activation. No public exploit is identified at time of analysis, though Wordfence has published direct source code references to the vulnerable handlers, reducing the research burden for potential exploitation.
Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade change_non_present_huge_pmd() rewrites a writable device-private PMD swap entry into a readable one without carrying pmd_swp_uffd_wp() across. The PTE-level change_softleaf_pte() does this correctly; mirror that here, matching what copy_huge_pmd() does for the fork path. Without the carry, a plain mprotect() over a UFFD_WP-marked device-private THP strips the bit and the trap is bypassed on swap-in.
In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix use-after-free on probe failure The vub300 driver lifetime-manages its controller state using vub300->kref, with vub300_delete() freeing the mmc host when the last reference is dropped. The probe error path after the inactivity timer has been armed still bypasses that lifetime rule, however, and falls through to mmc_free_host() directly if mmc_add_host() fails. The race window is between arming the inactivity timer and reaching the probe error unwind after mmc_add_host() fails: probe thread timer/workqueue ------------ --------------- kref_init(&vub300->kref) ref = 1 kref_get(&vub300->kref) ref = 2, timer ref add_timer(inactivity_timer) fires after one second | | race window |<----------------------------------------------------> | mmc_add_host(mmc) inactivity timer fires vub300_queue_dead_work() kref_get() ref = 3 queue_work(deadwork) mmc_add_host() fails timer_delete_sync() mmc_free_host(mmc) frees vub300 deadwork runs use-after-free The inactivity timeout is one second, so this would require mmc_add_host() to both fail and take more than one second to do so. This is unlikely to happen in practice, but the error path is still wrong. timer_delete_sync() only waits for the timer callback itself. It does not flush deadwork that the callback may already have queued. As a result, queued deadwork can still hold a kref while the probe error path directly frees the backing mmc host, including the vub300 storage. Fix this by using the same lifetime mechanism as disconnect. Clear vub300->interface so that the timer callback and any queued deadwork return early and drop their references, then drop the initial probe reference and return without falling through to err_free_host.