Authentication Bypass

Broken access control in ACF Extended (WordPress plugin) through version 0.9.2.6 allows contributor-level authenticated users to perform privileged operations beyond their intended role boundaries. The root cause is CWE-862 (Missing Authorization): the plugin executes certain sensitive actions without verifying the requesting user holds sufficient permissions. No active exploitation or public proof-of-concept has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit for any user holding a contributor account on an affected site.

Race condition in filebrowser's TUS resumable upload handler allows authenticated low-privileged users to bypass declared Upload-Length limits by issuing concurrent PATCH requests to the same offset. Affected versions start at 2.24.0. A successful exploit causes files to be written beyond their declared sizes, and may trigger upload completion hooks for oversized payloads - potentially abusing downstream processing logic. No public exploit code or CISA KEV listing exists at time of analysis.

Authenticated Sieve script manipulation in OX Dovecot Pro and CE allows low-privileged mail users to bypass configured per-user CPU resource limits and accumulate orphaned compiled script files on disk. By repeatedly switching the active Sieve script, an attacker resets the CPU accounting stored in each compiled artifact, circumventing the server-enforced cap indefinitely; separately, deleted or renamed scripts leave compiled files behind, causing unbounded disk growth. Sustained exploitation degrades mail delivery service across shared infrastructure. No public exploits are known, no CISA KEV listing exists, and the vendor-reported CVSS severity is Low (3.1).

Authentication bypass in OX Dovecot Pro and CE allows any host configured as a trusted proxy to impersonate arbitrary mail users without knowing their passwords, by injecting forged fields into Dovecot's internal authentication pipeline. The flaw is conditional: both a trusted proxy must be configured and the password database must honour a field permitting password-free authentication - deployments without trusted proxies are fully unaffected. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis.

OAuth2 multi-scope enforcement bypass in OX Dovecot Pro and CE allows an attacker holding a partial-scope OAuth2 token to authenticate and perform operations beyond their granted permissions via the remote token validation path. The remote validation logic incorrectly accepts a token carrying only one of several required scopes, while the local validation path correctly enforces all configured scope requirements - creating an inconsistency exploitable by any holder of a legitimately issued but insufficiently scoped token. No public exploit identified at time of analysis; CVSS 5.9 Medium with high integrity impact reflects a real but configuration-gated privilege escalation risk.

Authentication bypass in OX Dovecot Pro and OX Dovecot CE (both Open-Xchange GmbH email server products) allows a low-privileged authenticated attacker to circumvent access controls and achieve limited integrity impact over the mail service. The vulnerability is classified under CWE-284 (Improper Access Control) and carries a low CVSS base score of 3.1, reflecting high attack complexity and constrained impact - no confidentiality or availability loss is indicated. No public exploit code is known and this CVE is not listed in the CISA KEV catalog.

SMTP smuggling in Open-Xchange's OX Dovecot Pro and Community Edition allows an unauthenticated attacker to inject forged SMTP commands into messages relayed through Dovecot, bypassing its outbound content-sanitization logic. By embedding crafted bare carriage return sequences in a message body - delivered via Sieve redirect or submission relay - the attacker causes a vulnerable downstream mail server to misinterpret message body content as new SMTP envelope commands, enabling injection of spoofed email. This is the same vulnerability class as CVE-2023-51764 (Postfix) and CVE-2023-51766 (Exim); no public exploit code exists and the CVE is not listed in CISA's KEV catalog.

Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified; however, the low complexity and zero-privilege requirement make opportunistic abuse plausible.

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate another process's debug session without proper ownership or ptrace authorization. (cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5)

Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.

Quiz and Survey Master (QSM) WordPress plugin versions before 11.2.4 expose quiz question banks, hints, and correct answer keys to any authenticated Contributor-level user via a REST API route lacking authorization checks. The flaw allows a low-privileged user to read quiz content owned by other users on the same WordPress installation, undermining academic integrity and confidentiality of proprietary quiz material. No confirmed active exploitation is recorded in CISA KEV, but a publicly available proof-of-concept is documented by WPScan, making opportunistic exploitation trivial for any authenticated site member.

Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. A publicly available proof-of-concept exists; however, SSVC data confirms no active exploitation detected at time of analysis, and the patch is available in version 3.8.2.

Unauthenticated file upload in the Shared Files (before 1.7.67) and Shared Files Pro (before 1.7.70) WordPress plugins exposes an upload handler that performs no capability check and relies on a nonce embedded in every public page - making the nonce an ineffective authorization barrier. Any unauthenticated visitor can upload files within WordPress's allowed MIME type list to a publicly accessible server directory, and the server's absolute filesystem path is returned in the response, aiding reconnaissance. Publicly available exploit code exists (confirmed by WPScan); however, active exploitation has not been confirmed and the CVE is not listed in CISA KEV.

Unauthenticated disclosure of advanced wireless configuration on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 is possible by any attacker with LAN or WiFi adjacency to the device. The getWiFiAdvancedCfg handler in /cgi-bin/cstecgi.cgi performs no access-control check before returning advanced WiFi settings in response to a crafted POST request. No public exploit has been identified and EPSS is very low (0.18%, 7th percentile); exploitation is bounded to adjacent-network attackers and carries no integrity or availability impact.

Guest Wi-Fi configuration exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker without credentials to retrieve the router's guest wireless settings by sending a crafted POST to /cgi-bin/cstecgi.cgi invoking the getWiFiGuestCfg function. The CGI dispatcher performs no session or privilege check before returning guest SSID and passphrase data, a pattern consistent with multiple other access-control deficiencies in the same firmware. No public exploit code or active exploitation has been identified; EPSS stands at 0.18% (7th percentile) and SSVC rates technical impact as partial.

Unauthenticated storage configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the device's storage feature state to any attacker on the adjacent network. The `getStorageCfg` function in the CGI handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control, allowing a crafted POST request to retrieve storage configuration data without credentials. Impact is limited to read-only disclosure of storage feature state - not credentials or encryption keys - and no public exploit or active exploitation has been identified at time of analysis.

Smart QoS configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows unauthenticated attackers on the same network segment to read QoS rules and configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getSmartQosCfg function lacks any access control enforcement, exposing network prioritization policies and associated device rules without credentials. EPSS is low (0.18%, 7th percentile) and no active exploitation has been identified; however, this flaw is consistent with a documented systemic pattern of missing authentication across multiple TOTOLINK T6 CGI endpoints.

Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes UPnP enablement status and parsed port-mapping rules to adjacent-network attackers. The getUPnPCfg CGI handler on /cgi-bin/cstecgi.cgi accepts POST requests without enforcing authentication, violating the access-control model for device configuration endpoints. No active exploitation has been recorded and EPSS sits at the 7th percentile, reflecting low real-world threat at this time.

Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) exposes schedule and scheduled-reboot configuration to any adjacent-network host. The CGI dispatcher at /cgi-bin/cstecgi.cgi serves the getScheduleCfg function without validating session credentials, allowing any LAN or Wi-Fi neighbor to retrieve timing configuration data via a crafted POST request. No public exploit identified at time of analysis, and the 0.18% EPSS score at the 7th percentile reflects very limited exploitation probability.

Incorrect access control in the TOTOLINK T6 router's `getStaticDhcpRules` CGI handler exposes static DHCP reservation rules to any unauthenticated attacker within adjacent network range, requiring only a crafted POST to `/cgi-bin/cstecgi.cgi`. Affected firmware is version 4.1.5cu.748_B20211015; the attack vector is limited to adjacent network (LAN or Wi-Fi), narrowing the realistic threat surface considerably. No public exploit code or active exploitation has been identified; the EPSS score of 0.18% (7th percentile) confirms very low exploitation probability at time of analysis.

Unauthenticated guest Wi-Fi credential exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows adjacent-network attackers to retrieve the guest network SSID and password by posting a crafted request to /cgi-bin/cstecgi.cgi targeting the getWiFiEasyGuestCfg handler, which performs no session or authentication validation before returning configuration data. The vulnerability is part of a broader pattern of access-control omissions across this firmware's CGI dispatcher. No public exploit or CISA KEV listing exists, and the 0.18% EPSS score (7th percentile) reflects minimal automated exploitation interest; the adjacent-network constraint (AV:A) limits the realistic attacker population to physically proximate parties.

Unauthenticated DDNS credential disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker on the local network to retrieve the router's configured DDNS domain, username, and password by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getDdnsCfg function lacks any authentication gate (CWE-284), returning sensitive DDNS account credentials without verifying session state. No public exploit code and no CISA KEV entry exist; EPSS sits at 0.18%, indicating opportunistic rather than systematic exploitation.

Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh portal table data to any adjacent network attacker. The getMeshPortalTable function in /cgi-bin/cstecgi.cgi performs no authentication check, allowing a crafted POST request to retrieve mesh network topology details without credentials. No active exploitation is confirmed and EPSS is low (0.18%), but the adjacent-network vector means exploitation is trivially simple for any attacker already on the local network.

Unauthenticated access to the RebootSystem function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to force an immediate device reboot by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS vector (AV:A) constrains the attack to the same LAN or WiFi segment, limiting exposure to local network adversaries. No public exploit code has been confirmed and EPSS sits at 0.18% (7th percentile), reflecting negligible observed exploitation pressure; researcher coordination documents are publicly available on GitHub.

Incorrect access control in the TOTOLINK T6 router firmware exposes VPN pass-through and WAN ping filter settings to unauthenticated adjacent-network attackers. Firmware version 4.1.5cu.748_B20211015 fails to enforce authentication on the getVpnPassCfg function reachable via a crafted POST to /cgi-bin/cstecgi.cgi, leaking network configuration data. EPSS sits at 0.18% (7th percentile), no public exploit code has been identified, and this CVE is not listed in the CISA KEV catalog.

Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes AP-specific Wi-Fi scheduling rules to adjacent-network attackers. The getApWiFiSchCfg CGI function at /cgi-bin/cstecgi.cgi enforces no access control, allowing any host on the same network segment to retrieve scheduling configurations via a crafted POST request without credentials. No active exploitation or public exploit code has been identified; EPSS at 0.18% and SSVC 'Exploitation: none' both confirm low real-world priority.

Incorrect access control in the getDeviceInfo endpoint of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes device identification details to unauthenticated adjacent-network attackers via a crafted POST request to /cgi-bin/cstecgi.cgi. The missing authentication check on this CGI function allows any host on the same network segment to enumerate device model, firmware version, and related identification metadata without credentials. No public exploit or active exploitation has been identified; with an EPSS of 0.18% (7th percentile) and adjacent-only reach, real-world risk is low.

Unauthenticated MAC filter rule disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits any LAN-adjacent device to retrieve the router's MAC address filtering policy via a crafted POST to /cgi-bin/cstecgi.cgi without credentials. The getMacFilterRules CGI handler fails to enforce access control (CWE-284), exposing firewall policy data that could assist a local attacker in MAC address spoofing to bypass network access restrictions. No public exploit code or active exploitation is identified; EPSS of 0.18% (7th percentile) reflects negligible real-world exploitation interest.

Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Telnet service enablement status to any attacker on the adjacent network segment. The getTelnetCfg function in the CGI interface fails to enforce access control, allowing an unauthenticated POST request to /cgi-bin/cstecgi.cgi to reveal whether the Telnet daemon is active - a reconnaissance-grade leak rather than a full compromise. No public exploitation or active KEV listing exists; EPSS at 0.17% (7th percentile) reflects minimal real-world exploitation interest.

Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WPS runtime status to any attacker on the adjacent network. The `getStaticDhcpRules` CGI handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control, allowing a crafted POST request to retrieve WPS operational state without credentials. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.18% (7th percentile) reflects correspondingly low real-world exploitation interest.

Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to retrieve traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The getTracerouteCfg function applies no access control (CWE-284), returning routing diagnostic data including network hop topology and IP addresses to any LAN-resident requester. EPSS is 0.17% (7th percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing this firmly in a low-priority category despite the zero-authentication requirement.

Incorrect access control in the getAccessDeviceCfg handler of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any unauthenticated device on the local network to retrieve access-device policy rules and client connection state by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CWE-284 flaw exposes MAC-address-level access control lists and client status, enabling network reconnaissance by co-located attackers. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.18% (7th percentile) reflects minimal observed scanning activity; GitHub CVE coordination repositories are referenced but contain no confirmed public exploit code.

Unauthenticated disclosure of Wi-Fi scheduling rules in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to read the router's getWiFiScheduleCfg configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The CGI handler performs no access control check before returning scheduling policy data. No public exploit code or active exploitation has been identified; EPSS is 0.18% (7th percentile), consistent with limited real-world attacker interest.

Unauthenticated wireless credential exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any device on the adjacent network to retrieve SSIDs and Wi-Fi pre-shared keys by sending a crafted POST request to the router's `/cgi-bin/cstecgi.cgi` CGI endpoint invoking the `getWiFiBasicCfg` function. The handler performs no authentication check before returning sensitive wireless configuration data, meaning no credentials, tokens, or session state are required. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), indicating limited observed exploitation pressure to date.

WatchGuard Dimension exposes a server-side configuration endpoint that fails to enforce the client-side lock/unlock workflow state, allowing any authenticated read-write administrator to submit configuration changes directly to the API without completing the UI unlock step. This creates a race condition where a privileged user can silently overwrite changes being made by a second concurrent administrator session. No public exploit exists and exploitation requires valid administrator credentials, but the flaw undermines the integrity of multi-administrator change management workflows in Dimension deployments.

WatchGuard Dimension, the network security visibility and management platform, contains a business logic flaw (CWE-284) that permits an authenticated administrator to trigger multiple backend operations within a single logical request flow by sending a specially crafted HTTP request. All versions of Dimension are listed as affected via the wildcard CPE, and the impact is high confidentiality exposure on the Dimension system itself with limited subsequent-system effect. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the PR:H requirement constrains exploitation to actors who already hold or have compromised administrator credentials.

Hard-coded credentials in the Bendix EC80ESP and EC80ESP+ Brake ECU family allow an adjacent-network attacker to bypass authentication and disable automatic traction control and electronic stability program functions on commercial heavy vehicles. All ten identified EC80ESP/EC80ESP+ variants across J1708, CAN, PLC, and TPMS configurations are affected, with no version exclusion identified in CPE data. No public exploit or KEV-confirmed active exploitation has been identified, though the safety-critical nature of the affected system significantly amplifies real-world operational risk beyond the moderate CVSS score.

Improper authorization in LimeSurvey Community Edition 7.0.5 allows authenticated users holding only the `settings:read` permission to invoke the survey menu entry creation endpoint (`POST /index.php/admin/menuentries/sa/create`) without the required `settings:update` privilege, constituting vertical privilege escalation within the application's RBAC model. The same endpoint permits submission of menu IDs that the normal interface restricts to superadministrators, enabling unauthorized manipulation of administrative navigation records. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS 4.0 scores this at 5.1 (Medium), consistent with the limited integrity-only impact and high authentication prerequisite.

EAZ EazyFix 12.9 exposes a security feature bypass (CWE-325: Missing Required Cryptographic Step) that allows a highly privileged local attacker to disable Secure Boot, undermining the firmware-level integrity chain that prevents unauthorized boot components from executing. The MSRC entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25250 confirms Microsoft ecosystem relevance, suggesting the flaw interacts with Windows Secure Boot validation. No public exploit is identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Filesystem containment bypass in NLTK's Downloader component allows local attackers with write access to a shared download directory to overwrite arbitrary files outside the intended install root by planting hardlinks before a download operation. All NLTK versions prior to 3.10.3 are affected via the Downloader.download and Downloader.incr_download methods, which fail to validate link targets during package extraction. No public exploit has been identified at time of analysis; risk is highest in shared multi-user environments such as HPC clusters or build servers where the NLTK data directory is world- or group-writable.

OpenFaaS gateway versions 0.27.11 through 0.27.13 expose the administrative GET /system/telemetry route without authentication even when basic_auth is enabled, allowing any network-reachable client to retrieve provider telemetry data without credentials. The TelemetryHandler was omitted from the auth.DecorateWithBasicAuth wrapper applied to all other /system/* routes - confirmed by fix commit 8d803bf9 in the official repository. No active exploitation is confirmed (not in CISA KEV), though a researcher advisory is publicly available and a patch exists in version 0.27.14.

Incorrect authorization in Fonoster through 0.22.7 allows any authenticated user to rename arbitrary workspaces across the entire deployment. The `Identity/UpdateWorkspace` gRPC handler in `createUpdateWorkspace.ts` issues a PERMISSION_DENIED callback upon failing a membership check but omits a `return` statement, so `prisma.workspace.update` executes regardless and commits the rename before a second error callback fires. Compounding the flaw, the `Identity/UpdateWorkspace` path is misclassified under `fullIdentityAccess` in the gRPC interceptor rather than workspace-scoped access controls, meaning the base USER role is sufficient for exploitation. No public exploit is identified at time of analysis; CVSS 4.0 rates this 5.3 (Medium) with low-privilege, network-accessible exploitation.

Unauthenticated notification injection in APITable through 1.13.0-beta.1 permits any network-reachable client to write arbitrary messages into any user's inbox by exploiting a missing-authentication annotation on the internal notification create endpoint. The InternalNotifyController marks its create handler with requiredLogin = false, causing ResourceInterceptor to skip all session and API key validation; because the nginx gateway bundled with the product proxies every /api path to the Java backend, the endpoint POST /api/v1/internal/notification/create is fully exposed to unauthenticated callers. Setting fromUserId to 0 makes injected messages render as legitimate system notifications, enabling platform-wide social-engineering attacks; no public exploit code has been identified at time of analysis, though the flaw is documented in a public GitHub issue (no KEV listing).

Improper access control on the debug and test interface of the Johnson Controls T2000 building automation controller exposes restricted device functionality to anyone with physical access, requiring no authentication. Versions prior to 31.6 are affected, with the primary risk being high availability disruption of the device alongside limited integrity modification capability. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.

DNS label length truncation in the Ruby resolv gem (versions before 0.7.2 and before 0.3.2) enables attacker-controlled hostnames to produce wire-format DNS queries naming a domain the attacker chose rather than the one the application intended. The flaw allows hostname allowlists and DNS egress controls to be silently bypassed - the validated string appears legitimate but the bytes transmitted to the recursive resolver describe a different name. No public exploit code has been identified at time of analysis, but the Scope:Changed CVSS rating reflects real spillover impact on DNS resolvers and audit logs beyond the vulnerable application itself.

Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrieve assignment records belonging to other users by supplying an arbitrary user_id parameter. Affected are Flowintel instances up to and including version 3.3.0, per EUVD-2026-67127. The fix, confirmed via commit 10ec32e7, elevates the required privilege level by replacing the api_required decorator with admin_or_org_admin_required, restricting cross-user assignment queries to administrators only. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Cross-organization IDOR in Katello's Content View Filter Rules API allows authenticated low-privileged users to access and modify filter rules belonging to Content View Filters in other organizations by supplying a foreign filter identifier. Red Hat Satellite 6 deployments running multi-organization configurations are affected, as the API enforces authorization on the Content View but fails to validate the parent Content View Filter's organizational boundary. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects the limited scope - authenticated access and Satellite's enterprise context constrain real-world exposure.

Authorization bypass via user-controlled key in Summit Security Systems AdisyonPro (all versions before v5.21.0) allows unauthenticated remote attackers to access application functionality that should be restricted by access control lists, resulting in integrity and availability impact. The flaw is classified as CWE-639, an Insecure Direct Object Reference (IDOR)-class weakness in which the application accepts user-supplied keys to gate access to protected resources without adequate server-side authorization validation. No public exploit code or active exploitation has been identified at time of analysis.

Foreman's template revision endpoint, as shipped in Red Hat Satellite 6, exposes historical template contents across organizational and location boundaries due to missing object-level authorization (IDOR/BOLA, CWE-639). An authenticated user holding any template-related permission - as minimal as view_ptables - can retrieve audit-history revisions owned by other organizations simply by supplying a guessable audit ID. Template revisions may contain credentials, secrets, or sensitive configuration data, making the confidentiality impact high despite the low attack complexity. No public exploit has been identified at time of analysis, though the low-privilege entry bar lowers the practical exploitation threshold significantly.

Broken access control in the Kali Forms WordPress plugin (versions ≤ 2.4.23) exposes one or more plugin endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication and no user interaction against any internet-exposed WordPress site running an affected version. Impact is constrained to integrity (I:L), indicating unauthorized modification of form data or plugin state, with no confidentiality or availability consequences identified. No public exploit or active exploitation has been identified at time of analysis.

Broken access control in the Ditty WordPress plugin (versions up to and including 3.1.67) allows subscriber-level authenticated users to perform actions beyond their authorized scope, classified under CWE-862 (Missing Authorization). Reported by Patchstack with a CVSS 3.1 score of 5.3 Medium, the flaw is particularly impactful on WordPress sites with open user registration, where any self-registered subscriber could exploit it. No public exploit code and no CISA KEV listing are identified at time of analysis.

Broken access control in FluentPlayer Pro (WordPress plugin by WP Manage Ninja) version 1.3.2 and earlier allows authenticated high-privilege users - specifically those with Editor-level roles - to perform integrity-affecting actions that should be restricted to higher authorization tiers. The flaw stems from missing authorization checks (CWE-862) on editor-facing endpoints, enabling unauthorized content modification within the plugin. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.

Broken access control in the Push Notification for Post and BuddyPress WordPress plugin (version <= 3.20) allows authenticated users with subscriber-level privileges to perform actions restricted to higher-privileged roles, resulting in unauthorized read and write access. Exploitation requires only a valid WordPress subscriber account on the target site, making it relevant wherever the plugin is installed on community-oriented or membership-based WordPress sites running BuddyPress. No public exploit has been identified at time of analysis, and the CVSS score of 5.4 (Medium) reflects limited but real integrity and confidentiality impact without availability consequences.

Unauthorized subscription manipulation in the Notifima WordPress plugin (all versions through 3.1.3) allows authenticated attackers holding only Subscriber-level accounts to unsubscribe arbitrary customers from product stock-alert notifications via an unprotected REST endpoint. The root cause is an IDOR (CWE-639): the endpoint accepts a user-controlled subscription identifier without verifying the caller is the subscription owner. No public exploit has been identified at time of analysis, EPSS sits at the 3rd percentile (0.13%), and CISA SSVC rates exploitation as none - making this a low-urgency but straightforward integrity flaw affecting WooCommerce notification workflows.

Broken object-level authorization in Joomla Event Manager before 5.0.1 allows any authenticated Joomla user to read attendee lists - including names, usernames, registration dates, and statuses - for events they do not manage. The exposure extends to unpublished events, meaning data intended to remain private before an event goes live is also accessible. No public exploit has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.

Insecure Direct Object Reference (IDOR) in Joomla Event Manager before version 5.0.1 allows authenticated event-owner users to take over events and venues belonging to other users by manipulating form fields in POST requests. Any registered user holding the eventowner=1 role or core.edit.own ACL permission can forge the record ID and created_by fields to reassign another user's event or venue record to themselves. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists for this CVE.

Unauthenticated content tampering in Joomla Event Manager before version 5.0.1 permits any anonymous visitor to overwrite and force-publish articles linked to events on the affected Joomla site. Rooted in CWE-284 (Improper Access Control), the extension fails to enforce authorization before processing article modification requests, treating a routine guest session token - automatically issued to every site visitor - as sufficient proof of permission. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication barrier means exploitation requires no special tooling or credentials.

Incorrect authorization in the JetBackup WordPress plugin (versions before 3.1.23.5) exposes full network backup archives and job logs to insufficiently privileged administrators on WordPress multisite installations. A main-site administrator who has not been granted Super Admin status can exploit the missing multisite authorization gate to download a complete backup of the entire network - encompassing every subsite's database, files, and the shared webroot. No public exploit has been identified at time of analysis, and CISA has not added this to KEV, but the confidentiality exposure is high for any multisite operator running the affected plugin.

Unauthorized stock manipulation in the ShopApper Mobile App for WooCommerce WordPress plugin (through v0.4.62) permits any authenticated user - including customers or subscribers holding the lowest default WordPress roles - to arbitrarily modify product stock quantities via an unprotected REST endpoint. The root cause is CWE-284 (Improper Access Control): the plugin registers a stock-update REST route without validating WordPress capability permissions, bypassing the access control layer that should restrict such operations to shop managers or administrators. EPSS is 0.13% (3rd percentile), SSVC confirms no known exploitation, and the vulnerability is absent from CISA KEV, indicating low real-world exploitation activity; however, the attack barrier is minimal for any registered site user.

Insecure Direct Object Reference in the ShopApper Mobile App Builder plugin for WooCommerce (WordPress) through version 0.4.62 exposes customer profile data to any authenticated user. Any registered shopper or subscriber can query the vulnerable REST endpoint with an arbitrary customer ID and receive that customer's email address, display name, and WordPress role assignments - without owning the profile. No public exploit has been identified (EPSS 0.13%, SSVC exploitation: none), but the low authentication bar makes the attack trivially accessible on stores with open user registration.

Unauthenticated arbitrary document download in the Document Embedder WordPress plugin before 2.3.1 exposes private and draft documents to any remote attacker via sequential ID enumeration. The plugin's download endpoint issues tokens and streams file content without first verifying the publication status of the requested document, creating a broken object-level authorization flaw (CWE-639). No active exploitation is confirmed (not in CISA KEV; EPSS 0.14%, 3rd percentile), though CISA SSVC classifies the attack as automatable, meaning scripted mass-enumeration is feasible without special tooling.

Unauthenticated attackers can disable the maintenance or coming-soon page on WordPress sites running the CMP plugin before version 4.1.18 by exploiting a missing authorization check (CWE-862) on an AJAX action endpoint. Exploitation is constrained to sites using a non-default countdown configuration, which alters the plugin's nonce handling to permit anonymous requests. Impact is limited to low-level integrity and confidentiality - the attack reveals content hidden behind the maintenance screen - and no public exploit has been identified at time of analysis, with EPSS rating exploitation probability at just 0.14% (3rd percentile).

Unauthenticated log extraction in Veno File Manager 4.4.9 exposes all application log data to any network-reachable attacker via a missing access control check on a PHP admin endpoint. The `/vfm-admin/admin-panel/view/save-cvs.php` script performs no authentication or authorization before processing POST requests, allowing arbitrary retrieval of log records from any specified date onward. A public proof-of-concept repository exists on GitHub (jfs-jfs/CVE-2026-37067); EPSS sits at 0.16% (6th percentile), indicating no widespread exploitation has been observed at time of analysis.

Unauthorized file access in Veno File Manager 4.4.9 exposes any user-uploaded file to other authenticated users via the /vfm-admin/ajax/streamvid.php streaming endpoint, which applies no per-user authorization enforcement before returning file content. An attacker holding a valid account on the same instance can craft a GET request to retrieve files belonging to any other user, provided the target file's path and filename are known. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37070; no active exploitation is confirmed by CISA KEV.

Unauthenticated SMTP abuse in Veno File Manager 4.4.9 exposes the `/vfm-admin/ajax/sendfiles.php` endpoint without any access control, allowing any remote attacker to send arbitrary emails through the application's pre-configured SMTP server. By submitting a crafted POST request with the appropriate parameters, an attacker can impersonate the legitimate server's email identity without knowing SMTP credentials - enabling spam delivery, phishing, or targeted social engineering from a trusted domain. No CISA KEV listing exists and EPSS is 0.16% (6th percentile), but a public proof-of-concept repository on GitHub lowers the exploitation barrier.

Reactor Netty HTTP Server incorrectly evaluates the remote client IP address in deployments where HAProxy PROXY Protocol support is enabled, potentially allowing network attackers to spoof their apparent source IP. Affected versions span the 1.0.x, 1.1.x/1.2.x, and 1.3.x branches. This flaw carries no confidentiality or availability impact per the CVSS vector, but can undermine IP-based access controls, rate limiting, audit logging, or allowlist/denylist enforcement that rely on the server's perception of the client IP. No public exploit code or CISA KEV listing is present at time of analysis.

Cross-cluster authorization bypass in KubePi 2.0.0 and earlier permits an authenticated user with management rights over one Kubernetes cluster to read or modify data in other clusters they were not granted access to. The cluster identifier passed in API request URLs is trusted without per-request validation against the calling user's cluster bindings, confirmed by the patch introducing `requireClusterAccess()` middleware across chart and cluster API handlers. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 4.0 subsequent-system impact (SC:H/SI:H/SA:H) reflects that successful exploitation grants high-impact lateral access across the full multi-cluster estate managed by the panel.

Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.

Global permission bypass in Weblate prior to 2026.7 allows authenticated team members to receive site-wide management permissions without satisfying their team's enforced two-factor authentication requirement. While 2FA enforcement was correctly applied to project-, component-, and workspace-scoped permissions, the same gate was absent for global permissions, meaning a user lacking a configured TOTP device could still access the site management interface at /manage/. No public exploit code is identified at time of analysis, and the issue is fixed in version 2026.7.

Static Web Server (SWS) through version 2.43.0 exposes its Prometheus /metrics endpoint to unauthenticated remote attackers when both the basic-auth and metrics compile-time features are simultaneously enabled, due to a middleware ordering defect in src/handler.rs that processes metrics requests before the authentication gate. Exploitation leaks operational intelligence - virtual host names, request volumes, error rates, latency histograms, and active connection counts - that can inform subsequent targeting or infrastructure mapping. No public exploit code or CISA KEV listing has been identified; however, the GitHub commit diff is publicly available and the attack surface is trivially reachable with a single unauthenticated HTTP GET to /metrics.

Object existence enumeration in Weblate prior to version 2026.7 allows authenticated low-privilege users to infer whether objects exist within private projects by observing differential HTTP response codes - HTTP 403 (Forbidden) for existing-but-inaccessible objects versus HTTP 404 (Not Found) for truly absent ones. Affected endpoints performing globally-scoped ORM lookups across changes, comments, and announcements fail to restrict results to projects the requesting user is authorized to view. No public exploit has been identified and this is not listed in CISA KEV; the CVSS 4.3 Medium rating reflects the authentication prerequisite and the narrow confidentiality impact (existence inference only, no content disclosure).

Sort validation bypass in Spring Data JPA allows remote, unauthenticated attackers to submit crafted payloads through untrusted sort parameters, circumventing the library's built-in Sort validation and potentially injecting malicious ordering expressions into the underlying JPA query layer. Affected versions span four release trains from 3.0.0 through 4.1.0, placing a large fraction of Spring Boot applications at risk where dynamic sorting is exposed to user-controlled input. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the 'Authentication Bypass' tag suggests practical risk may exceed what the CVSS 4.8 score implies.

Authorization bypass in Dell PowerProtect One versions 20.1.0.0 and below allows a remote low-privileged attacker to manipulate user-controlled keys and bypass object-level authorization checks, resulting in unauthorized data tampering. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where the application trusts client-supplied identifiers without server-side authorization validation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Improper access control in Dell iDRAC9 allows an unauthenticated remote attacker to access unauthorized data under high-complexity conditions. Affected generations are 14G firmware prior to 7.00.00.182 and 15G/16G firmware prior to 7.20.30.50. No public exploit code or CISA KEV listing has been identified at time of analysis, but iDRAC exposure on management networks represents a significant attack surface in enterprise environments.

Insecure Direct Object Reference in WP Data Access plugin for WordPress (all versions through 5.5.68) exposes protected app container data to unauthenticated attackers via the `check_app_access` function. The flaw stems from a logical mismatch: authorization is validated against the `app_id` parameter, but the subsequent data retrieval uses `cnt_id` without verifying that the requested container actually belongs to the authorized app - allowing a user to pass an authorized `app_id` to clear the access gate while supplying an arbitrary `cnt_id` to reach a different container's data. No public exploit code or KEV listing exists at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to abuse opportunistically.

Broken access control in Grafana OSS and Enterprise allows an organization administrator to delete dashboard snapshots owned by other organizations on the same multi-tenant instance, and to recover a snapshot's secret delete key by supplying only its public share key. The flaw crosses organizational trust boundaries within a shared Grafana deployment, enabling a malicious or compromised org-admin to both exfiltrate snapshot delete credentials and destroy data belonging to tenants they should have no access to. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and authenticated-network accessibility make this straightforward to exploit for any actor who holds org-admin credentials.

Missing authentication on a specific API endpoint in CAYIN CMS-WS and CMS-SE allows unauthenticated remote attackers to retrieve media file lists, resulting in partial information disclosure. All versions of both products are affected per CPE data, and the vulnerability requires no credentials, no user interaction, and no special network position - only HTTP reachability to the CMS instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and the confidentiality impact is limited to media asset enumeration rather than credential or configuration exposure.

Improper access control in Ericsson CodeChecker allows an authenticated user to delete all personal access tokens system-wide due to a SQLAlchemy ORM query bug in the token removal path. The DELETE query targets PersonalAccessTokenDB but applies a filter referencing Session table columns without any JOIN, causing SQLAlchemy to construct an implicit cross join (Cartesian product) that bypasses per-user scoping entirely. No active exploitation is confirmed in the CISA KEV catalog; however, the CVSS 4.0 supplemental metric E:P indicates a proof-of-concept exists, and the overall base score of 1.2 reflects high required privileges and low individual impact metrics.

Kids Mode on Vivo Android devices contains a pop-up logic flaw that permits physical-access bypass of the parental password gate, enabling a child or any person holding the device to launch Quick Apps outside the Kids Mode sandbox. The CVSS 4.0 score of 2.4 reflects the mandatory physical access requirement and limited low-level confidentiality and integrity impact on both the device and downstream mini-app systems. No public exploit code and no CISA KEV listing exist at time of analysis.

Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows any authenticated customer with a valid portal session to cancel, reactivate, or modify Stripe subscriptions belonging to other customers. The plugin's customer portal endpoints fail to verify that a subscription ID supplied in the request is actually owned by the authenticated session's bound customer, enabling horizontal privilege escalation across customer accounts. A publicly available proof-of-concept exists; exploitation probability is low per EPSS (0.16%, 5th percentile), but the business impact on affected merchants' subscription revenue could be significant despite the moderate CVSS score.

Unauthenticated ownership bypass in the Return Refund and Exchange For WooCommerce plugin (versions before 4.6.4) exposes guest order workflows to arbitrary third-party manipulation. Any unauthenticated network attacker who can reference a guest order ID can read private order messages, impersonate the customer by posting messages or attachments, and cancel active return requests - undermining both customer privacy and merchant return-process integrity. A publicly available proof-of-concept exists; however, exploitation probability is very low per EPSS (0.17%, 6th percentile), and no active exploitation has been confirmed by CISA KEV.

Unauthenticated payment bypass in the Eventin WordPress plugin before 4.1.19 lets any visitor fraudulently obtain valid paid event tickets without completing payment. By abusing a guest checkout token, an attacker can transition their own unpaid order to 'completed', triggering ticket issuance without a charge being processed. A publicly available proof-of-concept exists, and SSVC flags the attack as automatable - enabling scaled ticket fraud against any WordPress site running the affected plugin.

Unauthenticated remote attackers can invoke AI queries against a site owner's configured provider account through the AI Engine WordPress plugin before version 3.7.2. The plugin exposes an administration-only feature protected solely by a token it distributes to anonymous visitors - rather than a proper WordPress capability check - enabling any network-accessible attacker to submit arbitrary AI prompts billed to the operator's account. A publicly available proof-of-concept exists via WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog, and EPSS sits at 0.17% (6th percentile), suggesting limited confirmed mass exploitation at time of analysis.

Broken object-level authorization in the Project Manager WordPress plugin before 4.0.7 allows any authenticated user - including low-privilege subscribers - to read arbitrary users' activity histories, email addresses, and details of projects they have no legitimate access to via an unguarded REST API route. Affected versions span 2.2.0 through 4.0.6, with a patch released at 4.0.7. A publicly available proof-of-concept is documented by WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and EPSS probability remains low at 0.16%.

Improper access control in the Project Manager WordPress plugin before 4.0.7 exposes several REST API routes without project-membership enforcement, allowing any low-privilege authenticated user - including subscribers - to read task content and user email addresses across projects they do not belong to, and to modify task boards of arbitrary projects. The flaw is a classic CWE-284 (Improper Access Control) exploitable with no special configuration, network-accessible, and requiring only a valid WordPress account. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation; no public exploit identified at time of analysis confirms CISA KEV status, so active widespread exploitation cannot be confirmed.

Payment amount manipulation in the Booking Package WordPress plugin (versions before 1.7.25) allows unauthenticated remote attackers to complete paid service bookings at an arbitrary fraction of the legitimate price. The plugin derives the charge amount from attacker-controlled HTTP request values rather than authoritative server-stored pricing, a classic business-logic trust boundary failure. A publicly available exploit exists per WPScan, though no CISA KEV listing was provided in input data, and EPSS at 0.18% (7th percentile) suggests limited observed mass exploitation to date.

Unauthenticated access to a missing-authorization REST endpoint in the Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before version 3.7.1 exposes the site's connected compliance-service API secret and account credentials to any visitor. Using the retrieved secret, an attacker can call the connected third-party compliance service API to sever the plugin's integration, causing GDPR, CCPA, and cookie policy documents to stop displaying on the affected WordPress site. A public exploit exists per WPScan, though CISA has not listed this in KEV and SSVC rates active exploitation as none at time of analysis.

Unauthorized reservation creation in the WPCafe WordPress plugin (all versions before 3.0.18) exposes the administrator moderation workflow to unauthenticated bypass through a missing authorization check in its REST API endpoint. The endpoint validates only a publicly available nonce - a control that provides no meaningful access restriction - allowing any remote user to submit reservations with an arbitrary approval status, including self-approving bookings that administrators would otherwise need to review and accept. A proof-of-concept exploit is publicly available via WPScan; however, EPSS stands at 0.19% (9th percentile), indicating that exploitation has remained limited despite trivially low attack prerequisites.

Unauthenticated queue-trigger exposure in the Booking for Appointments and Events Calendar WordPress plugin (versions before 2.4.7) permits any remote visitor to force the dispatch of the plugin's pending notification queue and integration callbacks. Because the queue-processing endpoint performs no authentication check (CWE-287), an attacker needs no credentials or session to invoke it. A publicly available proof-of-concept exists per the WPScan report, though EPSS at 0.23% indicates exploitation has not yet reached widespread automated activity, and the vulnerability is not listed in CISA KEV.

Broken object-level authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through before 9.8) allows any authenticated employee account to overwrite a different employee's cabinet password, achieving full account takeover of the victim provider. The flaw exists because the plugin's password-update endpoint does not verify that the requesting employee owns the target provider account. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV at time of analysis.