Authentication Bypass

SurrealDB before version 3.1.0 leaks restricted field values to authenticated record users by exploiting an indexed COUNT query optimization that skips field-level SELECT permission checks. When a field is protected by DEFINE FIELD ... PERMISSIONS FOR select but is also covered by a DEFINE INDEX, an attacker holding table-level SELECT can confirm or enumerate the field's contents by submitting SELECT count() FROM t WHERE hidden_field = 'guess' GROUP ALL - the query planner's indexed fast path returns a nonzero count for correct guesses without ever evaluating the permission predicate. No public exploit exists and the vulnerability is not in CISA KEV; however, the attack is straightforwardly reconstructable from the detailed vendor advisory.

Unauthenticated namespace and database creation in SurrealDB before 3.1.0 exposes any network-reachable instance to unauthorized catalog manipulation. The RPC use method and SurrealQL executor's USE NS/USE DB handling silently creates namespaces and databases that don't yet exist without verifying whether the caller holds DEFINE NAMESPACE or DEFINE DATABASE authority, making a completely unauthenticated guest session sufficient to pollute or exhaust the catalog. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects limited impact - data within existing namespaces cannot be read or modified - but the storage exhaustion vector and the ability to resurrect deliberately dropped namespaces via stale tokens represent meaningful operational risk for multi-tenant or publicly exposed deployments.

Field-level SELECT permission bypass in SurrealDB 3.1.0-3.1.4 allows authenticated record users to recover field values explicitly hidden by DEFINE FIELD ... PERMISSIONS FOR select NONE by routing queries through graph-edge (`->`) or back-reference (`<~`) traversals rather than direct table scans. The shared `resolve_record_batch` helper used by the 3.1.x query planner's GraphEdgeScan and ReferenceScan paths enforces only table-level authorization, silently skipping the `build_field_state`/`filter_fields_by_permission` routines applied on all other read paths. No public exploit has been identified at time of analysis; vendor-released patch is available in version 3.1.5.

Permissions bypass in SurrealDB before 3.2.0 allows any authenticated user to write to tables they lack explicit access to by embedding data-modifying statements inside PERMISSIONS clauses. Because the database disables enforcement during PERMISSIONS clause evaluation, embedded CREATE, UPDATE, DELETE, or UPSERT statements execute without access control checks, enabling unauthorized writes and data corruption across any table in the instance. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) indicates straightforward network exploitation by any low-privilege authenticated user.

ThumbPress WordPress plugin (all versions before 6.2.2) allows any authenticated subscriber-level user to deactivate the plugin by exploiting a missing capability check on an AJAX action endpoint. This disrupts the site's image-handling functionality, constituting a targeted availability and integrity attack against WordPress installations. A publicly available exploit exists per WPScan; the vulnerability is not listed in CISA KEV, so active widespread exploitation is not confirmed at time of analysis.

PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, allowing any remote, unauthenticated attacker to retrieve the secret order key of arbitrary WooCommerce orders. Under certain plugin configurations, the same endpoint additionally permits modification of order statuses, extending impact to data integrity. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at only 0.13% (3rd percentile), indicating limited observed exploitation despite the SSVC Automatable=yes classification - no public exploit identified at time of analysis beyond the POC, and this CVE is not currently listed in CISA KEV.

PayPlus Payment Gateway WordPress plugin before 8.2.2 exposes an unauthenticated AJAX action that performs no authorization or order-ownership validation, enabling any remote unauthenticated actor to tamper with payment-related metadata on arbitrary WooCommerce orders across the site. A publicly available proof-of-concept exploit exists, and the SSVC framework classifies this as automatable with partial technical impact, making scripted mass-scanning of vulnerable WooCommerce shops feasible. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.13% (3rd percentile) suggests opportunistic rather than widespread exploitation at time of analysis.

Unauthenticated comment manipulation in the Kirki WordPress plugin (versions before 6.0.12) allows remote attackers to overwrite the content of any existing comment or inject new pre-approved comments under a spoofed identity, bypassing moderation entirely. The root cause is a missing authorization check (CWE-862) on a REST API route exposed by the plugin by default. A publicly available proof-of-concept exploit exists per WPScan, and SSVC classifies the attack as automatable, increasing the likelihood of mass exploitation against unpatched sites. No CISA KEV listing is present, but the trivial attack path warrants prompt patching.

Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1) permits any unauthenticated internet visitor to cancel arbitrary bookings on affected sites. The action is exposed without capability checks or ownership verification, meaning no login or elevated role is required. A public proof-of-concept is available via WPScan; no confirmed active exploitation in CISA KEV at time of analysis, though the trivial attack complexity makes opportunistic abuse realistic.

Incorrect authorization on REST API endpoints in the All in One SEO WordPress plugin (before 4.9.9) allows authenticated users with low-level roles such as Contributor to overwrite or reset the site-wide AI integration configuration. The flaw is classified under CWE-863 (Incorrect Authorization), meaning the plugin registers REST API routes without enforcing appropriate role checks before permitting state-modifying operations. A publicly available proof-of-concept exists per WPScan, though no active exploitation has been confirmed by CISA KEV. The practical blast radius is limited to integrity of the plugin's AI settings, with no evidence of confidentiality or availability impact.

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: copy only received bytes on short ep0 read ffs_ep0_read() allocates its control-OUT data buffer with kmalloc() (not kzalloc) at the Length value from the Setup packet, then copies that full len to userspace regardless of how many bytes were actually received: data = kmalloc(len, GFP_KERNEL); ... ret = __ffs_ep0_queue_wait(ffs, data, len); if ((ret > 0) && (copy_to_user(buf, data, len))) ret = -EFAULT; __ffs_ep0_queue_wait() returns req->actual, which on a short control OUT transfer is strictly less than len. The copy_to_user() call still copies len bytes, so on a short OUT the last (len - ret) bytes of the kmalloc() buffer -- uninitialised slab residue -- are delivered to the FunctionFS daemon. Short ep0 OUT completions are specified USB control-transfer behavior and are produced by in-tree UDCs: * dwc2 continues on req->actual < req->length for ep0 DATA OUT (short-not-ok is the only ep0-OUT stall path). * aspeed_udc ends ep0 OUT on rx_len < ep->ep.maxpacket. * renesas_usbf logs "ep0 short packet" and completes the request. * dwc3 stalls on short IN but not on short OUT. A short ep0 OUT is therefore not evidence of a broken UDC; it is a normal condition f_fs has to cope with. The sibling gadgetfs implementation in drivers/usb/gadget/legacy/inode.c already does this correctly via min(len, dev->req->actual) before copy_to_user(). This patch brings f_fs.c to the same safe pattern rather than trimming at a defensive layer. The bug is reached from the FunctionFS device node, which in real deployments is owned by the privileged gadget daemon (adbd, UMS, composite gadget services, etc.); it is not reachable from unprivileged userspace. Linux host stacks normally reject short-wLength control OUTs before they reach the gadget, so reproducing this required a build that bypasses that host-side check. With the bypass in place, a 1-byte payload on a 64-byte Setup produces 63 bytes of non-canary slab residue in the daemon's read buffer. Fix by copying only ret (actually received) bytes to userspace.

Improper authorization across multiple dashboard API endpoints in MoviePilot through version 2.13.5 allows any authenticated low-privilege user to access administrative telemetry that should be restricted to superusers. The root cause, confirmed by patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, is that route handlers in `app/api/endpoints/dashboard.py` used `verify_token` (any valid session) rather than `get_current_active_superuser` for endpoints exposing system stats, storage, CPU/memory usage, downloader metrics, and scheduler information. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.

Authorization bypass in guohongze adminset 0.61 and earlier allows authenticated remote attackers to access or manipulate deployment resources belonging to other projects by substituting arbitrary project_id values in requests to the Delivery Deployment Endpoint (delivery/deli.py). This CWE-639 flaw - Authorization Bypass Through User-Controlled Key - is a classic IDOR pattern where the application accepts user-supplied object identifiers without verifying ownership. A public proof-of-concept exploit is available via GitHub issue #161, and the vendor has not responded to the responsible disclosure; no patch exists at time of analysis.

Missing authorization in the OAuth Credential Revoke Handler of geex-arts django-jet (versions up to 1.0.8) permits remote unauthenticated actors to revoke OAuth credentials without any access control check. The CVSS 4.0 vector (PR:N/UI:N) confirms no privileges or user interaction are required, and a public exploit exists (E:P). The project maintainer has not responded to the responsible disclosure, meaning no patch is available and no vendor advisory has been issued.

Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.

Missing authentication on the AjaxAdmin AJAX endpoint in newpanjing simpleui 2026.01.13 allows unauthenticated remote attackers to invoke privileged Django admin actions via the `self.get_action` function in `simpleui/admin.py`. A public proof-of-concept exploit exists on GitHub (issue #537), and the vendor has not responded to the disclosure, leaving the vulnerability unpatched. No active exploitation confirmed by CISA KEV, but the combination of PR:N network exposure and available POC makes any internet-facing deployment immediately actionable by low-skill attackers.

Unauthenticated remote access to the project upload endpoint in Gerapy up to 0.9.13 is possible because the `@permission_classes([IsAuthenticated])` decorator was commented out in `gerapy/server/core/views.py`, permitting any network-reachable attacker to submit arbitrary zip archives without credentials. Source code review of patch commit bd4891c6 (PR #319) reveals that the same unpatched endpoint also contained a Zip Slip (path traversal) flaw in the archive extraction logic, meaning the combined exposure allows unauthenticated arbitrary file writes to any path the Gerapy process can reach. A public proof-of-concept has been disclosed via GitHub issue #317; this CVE is not currently listed in the CISA KEV catalog.

IP allowlist bypass in Sipeed PicoClaw's First Run Setup middleware allows remote unauthenticated attackers to circumvent CIDR-based access controls by injecting a spoofed trusted IP address into the `X-Forwarded-For` header, exploiting the pre-patch logic that blindly trusted the leftmost header value without validating intermediate proxies. All versions through 0.2.9 are affected via the `web/backend/middleware/access_control.go` component. A public proof-of-concept is confirmed (CVSS 4.0 E:P), though high attack complexity and the narrow setup-phase window substantially limit real-world impact; no active exploitation has been confirmed in CISA KEV.

Incorrect authorization in zevorn rt-claw up to version 0.2.0 permits remote unauthenticated attackers to invoke privileged RPC functions without valid credentials. The flaw resides in the `claw_tool_invoke` function within the swarm service RPC Handler (`claw/services/swarm/swarm.c`), where authorization checks are insufficiently enforced, enabling authentication bypass. A publicly available proof-of-concept exploit exists via GitHub issue #133; no patch has been released and the project maintainer has not responded to the disclosure.

Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to bypass access controls via manipulation of the ExecTool.Execute function in credentialed_exec.go. The CVSS 4.0 vector confirms network-accessible exploitation requiring only low-privilege credentials, with limited but confirmed confidentiality, integrity, and availability impact on the vulnerable system. A publicly available proof-of-concept exploit exists (tracked in GitHub issue #1215), though the overall CVSS 4.0 base score of 2.1 reflects constrained real-world impact.

Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauthorized actions by sending crafted group messages through the `handleMessageReceive` function in `pkg/channels/feishu/feishu_64.go`. All versions up to and including 0.2.9 are affected. A publicly available proof-of-concept exploit exists via GitHub issue #3082, but the issue was closed automatically due to inactivity - indicating no vendor-supplied fix has been released. No public exploit identified at time of analysis as actively exploited in the wild.

Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass access controls and perform unauthorized actions on affected deployments running version 0.2.9 and earlier. The flaw resides in the dispatchIncoming function within pkg/channels/wecom/wecom.go, where incoming group messages are processed without properly verifying the caller's authorization level. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates exploitation remains opportunistic rather than widespread at time of analysis.

Incorrect authorization in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to bypass access controls in the Swarm RPC Receiver component, enabling unauthorized read, write, and availability impact against affected deployments. The flaw resides specifically in the handle_rpc_request function within claw/services/swarm/swarm.c, where authorization logic fails to correctly validate the calling actor. A publicly available proof-of-concept exploit exists, the project has not responded to responsible disclosure, and no patch has been released, leaving all installations on or below v0.2.0 without a vendor-provided fix.

Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remote attackers to invoke tool functionality without proper permission checks. The flaw resides in the `ToolsInvokeHandler.ServeHTTP` function within `internal/http/tools_invoke.go`, where authorization is absent rather than bypassed cryptographically. A public proof-of-concept exploit is available via GitHub, lowering the bar for exploitation; however, this CVE is not currently listed in the CISA KEV catalog, so confirmed active exploitation has not been established at time of analysis.

Incorrect authorization in GoClaw's execution approval module (versions up to 3.13.2) allows a high-privileged attacker on an adjacent network to bypass the binary execution allowlist enforced by the extractBin, RequestApproval, and matchesAllowlist functions. Despite the Authentication Bypass tag, exploitation is constrained to adjacent-network, high-privilege contexts per the CVSS 4.0 vector, limiting opportunistic abuse. A public proof-of-concept is available via the project's GitHub issue tracker, making exploitation accessible to any attacker who already meets the privilege and network prerequisites.

Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attackers to bypass binary execution controls by manipulating the isSafeBin function in internal/tools/exec_approval.go. The authorization logic flaw permits approval of binaries that should be restricted, with potential for unauthorized code execution within the tool's operational context - particularly impactful in pipeline or build automation deployments. A publicly available proof-of-concept exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.

Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth limit by chaining native function calls with embedded JavaScript that issues new queries, triggering infinite recursion and depleting server memory. Affected versions span all SurrealDB releases before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1, but only when the scripting capability is explicitly enabled via a non-default flag. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, any authenticated user on an exposed instance can reliably cause a denial of service.

DNS rebinding SSRF bypass in SurrealDB's http::* query functions allows authenticated low-privileged users to reach internal network endpoints that administrators explicitly blocked via the --deny-net flag. The server validates the user-supplied hostname string against the deny list rather than the resolved IP address, so a hostname that resolves to a blocked internal IP passes the check and the outbound request is issued anyway. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the CVSS 4.0 subsequent-system impact is rated High across all three CIA components, reflecting that internal services reached via this SSRF bypass may be completely unauthenticated and expose credentials, metadata, or allow configuration changes.

Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access controls in the RequestApproval function, potentially approving privileged operations without proper authorization. All versions up to and including 3.13.2 of nextlevelbuilder/goclaw are affected. A public exploit has been disclosed via GitHub, though no CISA KEV listing confirms active exploitation at this time.

Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attackers to replay previously captured webhook requests against the ParseRequest function, injecting fraudulent LINE messaging events without possessing the channel secret. All versions through 0.2.9 are affected. A public exploit exists, and the vendor closed the GitHub disclosure as 'not planned,' confirming no official patch will be issued.

Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate other users by manipulating the Username argument in the OpenAPI chat_send endpoint. Affected is the function OpenApiRoute.chat_send in astrbot/dashboard/routes/open_api.py, exposing confidentiality, integrity, and availability at a limited level. A public proof-of-concept exploit exists on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released.

Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat sessions belonging to other users by manipulating the Username parameter in the session-listing endpoint, affecting all versions up to and including 4.25.5. The vulnerable function `OpenApiRoute.get_chat_sessions` in `astrbot/dashboard/routes/open_api.py` fails to verify that the requesting user is authorized to access the target Username's session data (CWE-639 IDOR). A public proof-of-concept exploit exists on GitHub; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the low attack complexity and published POC materially lower the exploitation barrier.

Unauthenticated exposure of full Kubernetes cluster routing topology and cache-cluster shard addresses in Zalando Skipper's routesrv component (versions prior to 0.27.13) allows any in-cluster pod to retrieve Ingress/RouteGroup configurations, OAuth/OIDC filter chains, backend URLs, and Redis/Valkey shard addresses via plain HTTP GET requests to predictable endpoints. An attacker who has established any pod foothold within the cluster can bypass Kubernetes RBAC entirely - escalating from namespace-scoped access to cluster-wide routing intelligence - enabling targeted follow-on attacks against cache infrastructure and internal backends. No public exploit code is confirmed and this CVE does not appear in the CISA KEV catalog, but the GHSA advisory provides a complete, step-by-step attack path with specific endpoint enumeration that substantially lowers the practical exploitation bar.

Authentication bypass in Microsoft Edge (Chromium-based) allows an unauthenticated remote attacker to perform network-based tampering through an alternate path or channel that circumvents access controls (CWE-288). Affected users must interact with attacker-controlled content for exploitation to succeed (UI:R per CVSS), limiting opportunistic automation but keeping phishing-based delivery viable. No public exploit identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.

IBM Verify Identity Access and IBM Security Verify Access - both appliance and container deployments - expose an incorrect authorization flaw (CWE-863) that allows an authenticated attacker with read-only privileges to perform unauthorized modifications and deployments outside their assigned permission scope. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective Container variants. A vendor patch is available per IBM advisory 7279510; no public exploit code or CISA KEV listing has been identified at time of analysis.

CORS misconfiguration in HCL DevOps Loop enables authenticated network-adjacent attackers to perform unauthorized cross-origin requests against the application. The improper CORS policy potentially allows untrusted domains to read application responses, exposing session-bound resources to attacker-controlled origins. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the tag 'Authentication Bypass' suggests resource exposure can undermine access control assumptions.

Forced browsing vulnerability in HCL DevOps Loop allows authenticated low-privileged users to access restricted administrative endpoints by directly navigating to protected URLs without proper authorization enforcement. The application fails to validate that the requesting user holds sufficient privileges before serving administrative responses, enabling unauthorized access to admin functionality over the network. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthorized role removal in Keycloak's admin REST API allows a delegated administrator to strip privileged child roles from composite roles they are not authorized to manage, corrupting the role hierarchy and revoking access for users and administrators who depend on those composite roles. Affected products span Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, in multi-tenant enterprise deployments where delegated administration is common, the integrity impact to IAM role structures is operationally significant.

SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record users to infer the relative sort order of field values protected by field-level SELECT permissions. By issuing ORDER BY queries against indexed restricted fields, an attacker with normal table SELECT access can observe that rows are returned in the hidden field's true sorted order even though the field value itself is correctly redacted to null at projection time. No public exploit has been identified at time of analysis, and CISA KEV has not listed this vulnerability; however, the attack surface is inherent to any indexed field protected by field-level permissions in affected versions.

Authorization bypass in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows an authenticated low-privileged user to access confidential data belonging to other users by manipulating user-controlled identifier keys in requests. The flaw (CWE-639, IDOR class) exposes high-confidentiality data without requiring elevated privileges or user interaction, over the network. No public exploit or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Turkey's national CERT (TR-CERT) via advisory TR-26-0573.

Unauthenticated information disclosure in TheHive through 4.1.24 exposes sensitive configuration data - including the datastore attachment protection password, SSO settings, MFA capabilities, and clustered node addresses - to any network-reachable attacker via a single GET request to /api/status. The root cause is a missing authentication gate in the StatusCtrl.scala handler, a CWE-306 class defect. A public proof-of-concept is available on GitHub demonstrating trivial exploitation; no CISA KEV listing at time of analysis, though the exposed credentials materially increase lateral movement risk beyond the moderate CVSS score suggests.

Post-leave room state disclosure in Dendrite through 0.13.8 allows authenticated local users to retrieve unfiltered current room state from rooms they have previously exited. The syncapi /context endpoint in syncapi/routing/context.go performs an incomplete membership check - evaluating only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership - effectively treating departed users as current members for this endpoint alone. A publicly available proof-of-concept exists per VulnCheck and the geo-chen research disclosure; no active exploitation has been confirmed via CISA KEV at time of analysis.

Missing authorization in GitHub Enterprise Server's delegated bypass endpoint exposes private repository metadata to any authenticated user with write access to a single repository on the same instance. The endpoint resolves rule suites from attacker-supplied encoded identifiers without verifying that the caller holds read permission on the target repository; because these identifiers are sequential, an attacker can enumerate them to harvest private repository names, owners, branch names, commit SHAs, commit messages, and pushing actors across the entire GHES instance. No public exploit identified at time of analysis; the issue was responsibly disclosed via the GitHub Bug Bounty program and vendor-released patches are available across all active support branches.

Missing authorization in mosaxiv clawlet up to version 0.2.10 allows low-privileged remote attackers to list and remove cron jobs through the cron Chat Tool component without proper permission checks. The affected functions are list and remove in tools/tool_cron.go, enabling unauthorized enumeration and deletion of scheduled tasks. A public exploit exists via the project's GitHub issue tracker; the maintainer closed the report as 'not planned,' meaning no vendor patch is forthcoming.

Broken access control in Keycloak's organization management component allows a delegated administrator holding only organization management permissions to exploit the invitation API to provision new user accounts and inject unauthorized members into organizations. The attacker generates an invitation for a fabricated email address, then retrieves the secret registration link directly via the API - bypassing the email delivery step entirely - and uses it to self-register accounts without possessing user management permissions. No public exploit has been identified at time of analysis; exploitation is gated by the PR:H requirement (delegated administrator credentials), limiting realistic threat actors to insider or compromised-admin scenarios.

Missing authentication on the executor_manager control-plane API in poco-ai/poco-claw through version 0.5.4 allows adjacent-network attackers to invoke the `create_task` endpoint without any credentials, enabling unauthorized task submission to the AI agent execution engine. The CVSS 4.0 vector (AV:A) confirms exploitation requires adjacency to the internal network segment hosting the executor manager service - it is not directly internet-exploitable. Public exploit code has been disclosed via GitHub issues #136/#137 and PR #135; no CISA KEV listing exists at time of analysis.

Broken object-level authorization in the WPS Bookings for WooCommerce WordPress plugin (all versions before 3.11.7) allows any authenticated low-privilege user - including Subscribers and Customers - to cancel booking orders belonging to other customers without ownership verification. This IDOR flaw (CWE-639) enables a malicious registered user to void legitimate bookings across the platform, causing business disruption and financial harm to merchants and their customers. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS at 0.13% (3rd percentile) indicates limited observed exploitation activity at time of analysis.

Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.

Improper Access Control in TXOne Networks' Removable Media Validation function allows a local administrator to bypass the file lockdown mechanism enforced by SafePortAgent (before 3.2.5024) and StellarProtect (3.2.4011 through before 5.0.1083), enabling unauthorized file transfer to a protected device via specially prepared removable media. The attack requires pre-positioning unauthorized files on the removable media before insertion, making this a deliberate, multi-step insider or supply-chain adjacent threat rather than opportunistic exploitation. No public exploit code or active exploitation has been identified at time of analysis; the vendor self-reported this issue through their PSIRT.

Authorization bypass in the WP ERP WordPress plugin (versions through 1.17.6) allows authenticated attackers with subscriber-level access to create arbitrary company locations in the ERP database. The flaw stems from a missing authorization check in the plugin's Admin AJAX handler, as identified by Wordfence and corroborated by source code references at includes/Admin/Ajax.php. No public exploit code or CISA KEV listing exists at time of analysis, but the low privilege bar (any registered WordPress user) on a network-accessible endpoint makes opportunistic abuse straightforward on sites with open user registration.

Subscriber-level WordPress users can exfiltrate complete PII datasets from all Ninja Forms submissions site-wide in Ninja Forms - Excel Export versions up to and including 3.3.6 by supplying arbitrary values to the `spreadsheet_export_form_id` parameter, which lacks authorization validation at the export endpoint. The missing access control enables horizontal privilege escalation across all form IDs on the installation, delivering names, email addresses, phone numbers, physical addresses, and any other collected PII as downloadable XLSX files to low-privileged users who should have no cross-form access. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the low attack complexity (AC:L, no user interaction required beyond subscriber-level credentials) makes this a meaningful data privacy risk on WordPress sites with open user registration.

Unauthenticated settings reset in the Fense Proxy & VPN Blocker WordPress plugin (versions up to and including 3.0.1) allows any remote attacker to wipe the plugin's API key cache and configuration by invoking an unprotected AJAX endpoint. The fense_bpvt_save_settings() function is registered to both wp_ajax_* and wp_ajax_nopriv_* hooks without any capability check or nonce validation, meaning it is reachable without authentication and calls delete_option() and delete_transient() unconditionally on plugin-critical data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack is trivial to execute and carries a meaningful functional consequence: disabling the site's VPN and proxy detection capability.

Broken access control in Grav Flex-Objects before 1.4.3 permits authenticated users holding only the api.access permission to perform full CRUD operations on directories lacking explicit permission configurations via the admin-next REST API. The vulnerability bypasses intended authorization controls (CWE-862) because the REST API fails to enforce object-level permission checks when no explicit policy is defined for a directory. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 4.0 AT:P metric confirms exploitation depends on the target instance containing permission-less directories, which may be common in default or lightly configured deployments.

Authorization bypass in OpenClaw before version 2026.5.18 allows authenticated low-privilege callers to exceed their intended permissions within the skill command dispatch subsystem. Exploiting misconfigured or reachable input paths, an attacker can circumvent tool policy restrictions and execute or persist actions at a higher trust level than authorized when the affected feature is active and reachable. No public exploit code or active exploitation has been identified; the CVSS 4.0 score of 2.3 reflects the specific preconditions required for successful exploitation.

Authorization bypass in OpenClaw MS Teams before 2026.5.12 allows authenticated lower-privileged users to escalate their effective permissions by spoofing display names that the `allowFrom` access-control feature trusts as immutable identifiers. The root flaw (CWE-290) is that the authorization decision is anchored to a mutable attribute - the display name - rather than a stable, non-spoofable identity token. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 2.3 reflects the limited blast radius and the attack requirement precondition.

Incorrect authorization in OpenClaw's ClickClack allowFrom feature permits a lower-trust, authenticated caller to exceed their intended permission boundary - executing or persisting non-allowlisted commands - on versions 2026.5.12 through before 2026.5.26. The flaw (CWE-863) is contingent on the ClickClack allowFrom feature being both enabled and reachable, which meaningfully limits the exploitable population. No public exploit exists and the vulnerability is not listed in CISA KEV; a CVSS 4.0 score of 2.3 reflects the constrained attack surface.

WebSocket authentication rate limit bypass in OpenClaw versions 2026.2.25 through pre-2026.5.26 enables lower-trust callers or configured non-browser input paths to flood authentication attempts without being throttled at the gateway layer. The impact is limited to availability - an attacker can consume gateway connection and compute resources, degrading service for legitimate users. No public exploit has been identified at time of analysis and OpenClaw does not appear in the CISA KEV catalog.

Authorization bypass in OpenClaw's hooks `allowedAgentIds` validation allows a lower-trust authenticated caller to circumvent agent ID restrictions by submitting blank agent IDs, effectively elevating privileges to perform actions gated behind stronger policy controls. Affected versions span OpenClaw 2026.2.12 through versions prior to 2026.5.26, with the flaw traceable to improper input validation of the agent identifier field during hook processing. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the high integrity impact (VI:H per CVSS 4.0) signals meaningful risk to deployments that rely on agent-scoped authorization boundaries.

Authentication bypass in OpenClaw before 2026.6.5 enables lower-trust network callers to forge A2UI actions that require higher authorization by submitting crafted HTTP Canvas responses through configured input paths. The flaw (CWE-345: Insufficient Verification of Data Authenticity) allows an attacker to subvert OpenClaw's trust hierarchy and execute privileged actions on downstream systems (SC:H/SI:H per CVSS 4.0), without any direct impact on the OpenClaw instance itself. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog; the CVSS 4.0 score of 5.1 reflects significant real-world constraints from high attack complexity and required user interaction.

Missing authorization in OpenClaw's Discord moderation action handling allows a low-privilege caller to perform moderation operations - such as banning, kicking, or muting users - that should require elevated permissions. All OpenClaw versions prior to 2026.6.9 are affected per the vendor's GitHub security advisory (GHSA-f6p7-6326-vf7v), reported by VulnCheck. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the CVSS 4.0 integrity impact is rated High, reflecting meaningful abuse potential where a lower-trust actor gains outsized moderation authority over a Discord community.

Missing authorization controls in OpenClaw's MS Teams message actions feature permit a low-privilege authenticated caller to invoke operations that should require elevated permissions or policy checks, resulting in high integrity impact (VI:H per the CVSS 4.0 vector) on affected deployments. The flaw spans versions 2026.4.12-beta.1 through 2026.6.5, and practical severity is configuration-dependent - exploitation is gated on the MS Teams feature being enabled and reachable. No public exploit code exists and the vulnerability is not in the CISA KEV catalog; the vendor confirmed and patched the issue in 2026.6.6.

Incorrect access control in the Proxmox Virtual Environment qemu-server component exposes hashed passwords to authenticated low-privilege users via the cloudinit/dump API endpoint. Affects PVE 8.x before 8.4.8 and 9.x before 9.1.8. An attacker with minimal PVE credentials can retrieve cloud-init password hashes for VMs, enabling offline cracking and potential lateral movement into guest systems. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Improper authorization in BunkerWeb's web UI middleware allows authenticated reader-role accounts to permanently delete WAF job cache files in versions 1.6.2 through 1.6.11. The BiscuitMiddleware bypass list incorrectly included the `/cache/` URL prefix, causing the `POST /cache/delete` route to skip Biscuit role-based access control and enforce only Flask's `@login_required` decorator, making write-privileged cache operations accessible to any authenticated user. Deleted cache can include blacklists, GeoIP data, ModSecurity CRS rules, CrowdSec data, and ACME/Let's Encrypt certificate material, degrading WAF protective capability. No public exploit is identified at time of analysis; vendor-released patch is available in version 1.6.12.

Cross-namespace authorization bypass in Envoy Gateway allows an authenticated user with HTTPRoute creation rights to route traffic to backend resources in foreign namespaces without the required Gateway API ReferenceGrant consent from the target namespace owner. Affected versions span all releases before 1.7.4 and the 1.8.x line before 1.8.1. The flaw is specific to extension-managed custom backendRefs: standard Gateway API backendRefs are not affected, but when extensions introduce custom backend resource types, the ReferenceGrant enforcement gate is skipped entirely, violating the multi-tenant isolation guarantee the Gateway API cross-namespace model is designed to provide. No public exploit or CISA KEV listing exists at time of analysis.

Group search in Keycloak's administrative API leaks unauthorized parent group details to delegated administrators when Fine-Grained Admin Permissions v2 (FGAP v2) is enabled. A delegated admin with read access to a child group can trigger the flaw simply by searching for that child group, causing the API response to incorrectly return full attribute and configuration data for parent groups they have no authorization to view. CVSS 4.3 Medium (PR:L, C:L) reflects its limited confidentiality impact and authenticated-only exploitability; no active exploitation or public proof-of-concept has been identified at time of analysis.

Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-series - contains a missing authentication flaw in the WMI-to-SMI interface that permits a local privileged attacker to arbitrarily trigger System Management Interrupt handlers, enabling execution at the SMM firmware level below the operating system security boundary. No public exploit code has been identified at time of analysis, and CISA KEV listing is not confirmed. The practical threat is post-compromise firmware persistence: an attacker already holding OS-level administrative privileges could use this flaw to manipulate firmware behavior in ways invisible to endpoint security tools, bypassing Secure Boot or implanting persistent code in System Management Mode.

Lenovo Smart Connect for Windows exposes an improper access control flaw that permits a local authenticated user to read files belonging to other users on the same machine. Discovered through Lenovo's own internal security assessment and documented under advisory LEN-218281, the flaw carries a CVSS 4.0 score of 6.8 with a local, low-privilege attack vector and high confidentiality impact. No public exploit code and no CISA KEV listing exist at time of analysis, limiting immediate risk to multi-user Windows environments where Lenovo Smart Connect is installed.

Telemetry archive exposure in Yamcs mission control framework allows any authenticated user to dump the entire raw packet archive by exploiting a broken object-level authorization check in the exportPackets API. Versions prior to 5.12.8 (stable) and 5.13.2 (development) are affected. No public exploit or CISA KEV listing exists, but the attack requires only a valid session and a trivially crafted HTTP request, making it immediately actionable for any insider or compromised account.

Broken access control in Perfect Support Ticketing & Document Management System through version 1.7 permits authenticated Agent-level users to manipulate the Support Agent assignment field on tickets beyond their authorized scope, including adding or removing Superadmin accounts. The vulnerability stems from missing server-side authorization checks (CWE-862), allowing role-based access controls to be circumvented entirely by any Agent assigned to a ticket. A publicly available exploit exists per VulnCheck and a GitHub PoC disclosure; no CISA KEV listing is present at time of analysis.

Cross-device system_info disclosure in Microsoft UFO's WebSocket server allows any authenticated DEVICE-role client to retrieve another enrolled device's server-side system_info - including hostname, IP address, and metadata tags - by supplying an arbitrary target_id in a DEVICE_INFO_REQUEST message. Affected versions 3.0.0 through 3.0.5 authenticate the caller's role but omit object-level authorization in handle_device_info_request and get_device_info (ufo/server/ws/handler.py), meaning DEVICE clients can enumerate peers that only CONSTELLATION controllers should be able to query. No public exploit identified at time of analysis; vendor-released patch is version 3.0.6.

Cross-tenant IDOR in Roskus Prospero Flow CRM before 5.5.3 allows any authenticated user to read, modify, and delete order and order-item records belonging to other companies (tenants) by supplying sequential integer IDs to five REST API endpoints. The root cause is missing company_id scoping in Eloquent ORM queries across all Order and OrderItem controllers, making every tenant's order data globally accessible to any platform user. No public exploit code or CISA KEV entry exists at time of analysis, but exploitation requires only a valid account and standard HTTP iteration - no special tools or expertise needed.

Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capture and retransmit valid authentication messages, gaining unauthorized access as a legitimate user. The application lacks message-freshness enforcement - no timestamps or nonce mechanisms are applied to bound the validity window of authentication data, a design gap classified under CWE-294. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the combination of high attack complexity and mandatory user interaction substantially limits realistic exploitation scope.

Webhook token disclosure in stoatchat (the Rust 'delta' backend of the Revolt/stoatchat platform) lets any channel member holding only ViewChannel (read) permission enumerate a channel's webhooks and read their secret tokens. Because a retrieved token authorizes posting, the attacker can then inject arbitrary messages while impersonating a bot or webhook, bypassing the channel's ManageWebhooks and posting permissions. Reported by VulnCheck and fixed in 20250210-1 (0.8.2); no public exploit identified at time of analysis.

ubuntu-pro-client (formerly ubuntu-advantage-tools) leaks Ubuntu Pro bearer tokens to unprivileged local users via the Linux /proc filesystem on all supported Ubuntu LTS releases from 14.04 through 26.04. When the client validates APT credentials, it spawns /usr/lib/apt/apt-helper with the secret token embedded in a cleartext URL argument (https://bearer:<token>@esm.ubuntu.com/), which any local low-privileged user can read from /proc/<pid>/cmdline on default-configured systems. The stolen token enables unauthorized access to the victim's Ubuntu Pro ESM repositories. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.

Unauthenticated API access in HCL DFXServer exposes application endpoints to any network-reachable user without identity verification. The missing access control allows interactions with protected functionality - including read and write operations - from a browser or client that holds no valid session or credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS 6.3 medium score and PR:N vector confirm that authentication is not required to reach the affected endpoints.

Authorization bypass in the WPBot AI ChatBot plugin for WordPress (all versions ≤ 8.5.6) permits any subscriber-level authenticated user to invoke the plugin's RAG document re-embedding functionality without authorization, directly modifying the rag_documents database table and triggering calls to the site owner's paid AI APIs (OpenAI, Gemini, OpenRouter, or xAI). The root cause is a missing capability check in class-qcld-bot-rag.php, confirmed by Wordfence and traceable to specific code paths in qcld-wpwbot.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.3 Medium score reflects constrained direct security impact - though financial harm from API credit exhaustion represents the primary real-world risk.

Unauthorized deletion of chat session records in the WPBot WordPress plugin affects all versions through 8.5.6, allowing unauthenticated remote attackers to wipe arbitrary conversation history and user records by supplying a crafted userid parameter to unprotected endpoints. The root cause is a missing authorization check (CWE-862) in the chat sessions module, confirmed by Wordfence with source-level references to the vulnerable code in wpbot-chat-sessions.php. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS-assigned score of 5.3 Medium reflects the limited scope: data deletion with no confidentiality or availability impact on the service itself.

Authorization bypass in the Themify Builder WordPress plugin (all versions through 7.7.7) permits any authenticated subscriber-level user to overwrite or delete CSS stylesheet files for arbitrary posts - including private and draft posts owned by other users - and modify plugin-scoped font options site-wide. The CSRF nonce (tf_nonce) nominally required to gate these actions is broadcast to every authenticated user visiting any public front-end builder page via wp_localize_script, making it trivially collectible and rendering it ineffective as a security control. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified at time of analysis.

Authorization bypass in The Cache Purger WordPress plugin (all versions through 2.3.20) allows any subscriber-level authenticated user to permanently destroy the plugin's entire cache-purge audit log (wp-content/purge.log). The root cause is that the tcp_log_purge nonce - the only credential required to trigger log deletion - is rendered in the WordPress admin bar on frontend pages visible to all authenticated users, including the lowest-privilege subscribers, making the authorization check trivially bypassable. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

RTMKit WordPress plugin versions before 2.0.9 allows users holding at least the Author role to invoke a restricted builder AJAX action without adequate capability verification, letting them create and activate site-wide templates that override globally displayed areas - headers, footers, and other layout regions - ordinarily controlled only by administrators. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile) and CISA KEV does not list active exploitation, suggesting opportunistic rather than widespread abuse. The integrity impact is real but bounded: no data theft or remote code execution occurs, only unauthorized content modification visible to all site visitors.

Unauthorized post title disclosure in the RTMKit WordPress plugin before 2.0.9 allows any site user holding at least the Contributor role to enumerate private, draft, pending, scheduled, and trashed posts authored by other users. The root cause is a missing capability check in an AJAX handler that resolves a caller-supplied post identifier directly - a classic IDOR (CWE-639) pattern. No public exploit is in CISA KEV, but a publicly available proof-of-concept exists per WPScan, and the vendor has released a patch in version 2.0.9.

Unauthorized access to private chatbot conversations in the AI Engine WordPress plugin before 3.5.5 allows any authenticated subscriber-level user to both read and overwrite other users' chat records when the discussions feature is enabled. The plugin fails to verify that a client-supplied conversation identifier belongs to the requesting user (CWE-639 IDOR), enabling session data theft and record hijacking. Public exploit code is available via WPScan, though EPSS stands at only 0.13% (3rd percentile), suggesting no widespread automated exploitation; active exploitation is not confirmed in the CISA KEV at time of analysis.

Sensitive information exposure in the List Category Posts WordPress plugin (all versions through 0.95.0) allows authenticated contributors to read non-public posts belonging to other users - including pending-review, scheduled, and trashed content with full body text, excerpts, authors, and custom-field metadata. Exploitation requires only a contributor-level account and the ability to embed the native [catlist] shortcode in a draft post, then preview it, triggering the flawed sanitize_status logic. This is a confirmed bypass of the incomplete authorization fix shipped in version 0.93.0 for CVE-2025-11377, indicating the root authorization flaw was never fully remediated. No public exploit code or CISA KEV listing is identified at time of analysis.

Missing authorization in the Catch Themes Demo Import WordPress plugin (versions up to and including 3.3) allows any subscriber-level authenticated user to force-install a hardcoded third-party plugin onto the target WordPress site. The vulnerability exists because catch_themes_demo_import_activate_plugin(), hooked on admin_init, invokes Plugin_Upgrader::install() to fetch and install 'essential-content-types' from WordPress.org before performing the current_user_can('activate_plugins') capability check - a classic authorization-check inversion. No public exploit code has been identified at time of analysis, and the constrained impact (only one hardcoded plugin can be installed, not arbitrary ones) meaningfully limits real-world severity despite the low authentication requirement.

Authorization bypass in RafyMrX TOKO-ONLINE-ROTI allows a low-privileged remote attacker to manipulate the `kd_cs` parameter in `proses/add.php` to access or modify data belonging to other customers, a classic CWE-639 Insecure Direct Object Reference pattern. The application up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 is confirmed affected, with no vendor patch available after the vendor failed to respond to responsible disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity of parameter manipulation makes this trivially reproducible with standard HTTP tooling.

Path traversal in LogicalDOC Enterprise up to v9.1.1 allows any authenticated user to read arbitrary files outside designated directories via the OnlyOfficeEditor servlet's fileExt parameter. Exploitation requires only a low-privilege account, no special configuration, and results in high confidentiality impact - potentially exposing system credentials, configuration files, or other sensitive data. A public vulnerability disclosure exists on GitHub (netero1010), indicating exploit techniques are accessible to the public; EPSS is low (0.33%) suggesting limited observed exploitation to date.

Cyrus IMAP through version 3.12.2 contains an authorization flaw in its XAPPLEPUSHSERVICE (XAPS) command that lets authenticated IMAP users enumerate arbitrary mailboxes belonging to other accounts and redirect Apple Push Notification Service alerts about those mailboxes to their own device. The flaw (CWE-863, Incorrect Authorization) does not expose message content - only whether a target mailbox exists and when its modification sequence (modseq) changes - but it enables cross-account probing and unauthorized push subscription in multi-tenant IMAP deployments. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the low CVSS score of 3.1 is consistent with the limited confidentiality impact and mandatory authentication requirement.

Incorrect authorization in Cyrus IMAP through 3.12.2 allows authenticated users to bypass mailbox ACL enforcement via the vacation Sieve script `:fcc` (file carbon copy) feature, enabling unauthorized message injection into any mailbox nameable by the script regardless of insert permissions. The CVSS vector (PR:L, AV:N) confirms network-triggerable exploitation requiring only a valid authenticated account, with low integrity and availability impact (C:N/I:L/A:L). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 3.12.3 addresses the flaw.

Unauthorized mailbox deletion in Cyrus IMAP through 3.12.2 allows any authenticated non-admin user to invoke the admin-only LOCALDELETE command, bypassing ACL enforcement entirely. Any user with a valid account on an affected server can permanently delete arbitrary mailboxes - including those they have no read, write, or administrative permissions over - simply by issuing the improperly guarded command. No public exploit has been identified at time of analysis, but the attack requires only authentication and knowledge of the command, making it low-complexity for any insider or account-compromised attacker.

Unauthorized mailbox access in Cyrus IMAP through 3.12.2 allows any authenticated user to read email from mailboxes they have no ACL permissions on by exploiting the GENURLAUTH command's failure to enforce access controls before issuing URLAUTH tokens. The authorization boundary between mailboxes is effectively eliminated for any user who can name a target mailbox, undermining the server's entire multi-user isolation model. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the impact is materially more significant in multi-tenant or shared-server environments than the CVSS score of 3.5 suggests.