Authentication Bypass

Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape process-level sandboxing constraints via a crafted HTML page. The vulnerability stems from improper input validation in Chrome's Navigation subsystem (CWE-20), and exploitation requires both a prior renderer compromise and user interaction. With a CVSS score of 3.1 (Low), EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, this is a low-urgency chained escalation risk rather than a primary attack vector - but it is meaningful in advanced threat scenarios where a renderer exploit already exists.

Incorrect reference resolution in Chrome's Preload subsystem (versions prior to 152.0.7977.65) allows remote attackers to bypass the Same-Origin Policy by serving a crafted HTML page to a victim. The vulnerability is limited to confidentiality impact at the low tier - an attacker can read a constrained subset of cross-origin data but cannot modify content or cause a denial of service. No public exploit code has been identified and the EPSS score of 0.31% (23rd percentile) reflects low real-world exploitation probability at time of analysis.

Incorrect authorization in Google Chrome's Extensions subsystem (versions prior to 152.0.7977.65) permits a remote attacker to bypass system access restrictions through a crafted Chrome extension delivered via social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms mandatory user interaction limits opportunistic exploitation, and impact is constrained to integrity with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the social-engineering dependency.

Injection in Google Chrome's Tabs component (versions prior to 152.0.7977.65) enables remote attackers to partially bypass system access restrictions by directing a user to a specially crafted HTML page. The flaw is classified CWE-74 (Injection) and carries only a low integrity impact (I:L) with no confidentiality or availability consequences, consistent with Chromium's own 'Medium' severity rating. No public exploit code has been identified and EPSS probability is low at 0.38% (31st percentile), indicating limited real-world exploitation pressure despite the browser's ubiquitous deployment footprint.

Incorrect authorization in Chrome's WebProtect component exposes sensitive browser information to remote attackers via crafted HTML pages, affecting all Chrome versions prior to 152.0.7977.65. The flaw carries a CVSS 6.5 score with high confidentiality impact; an unauthenticated attacker requires only that a target user visit a malicious page, making social-engineering delivery viable. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.32% (24th percentile) indicates low current exploitation activity despite the broad attack surface.

ServiceWorker incorrect authorization in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web origin policy by inducing a victim to visit a crafted HTML page. The flaw (CWE-863) allows a ServiceWorker to access cross-origin resources it should be forbidden from reading, yielding a low confidentiality impact with no integrity or availability consequence. No public exploit or active exploitation has been identified; vendor-released patch 152.0.7977.65 is available.

Google Chrome's Preload subsystem prior to version 152.0.7977.65 contains a missing authorization flaw (CWE-862) that permits unauthenticated remote attackers to bypass the web origin policy. By delivering a crafted HTML page to a victim running an unpatched Chrome browser, an attacker can cause the Preload mechanism to speculatively fetch cross-origin resources without enforcing same-origin access controls, resulting in limited confidentiality exposure. No public exploit has been identified at time of analysis, and a vendor-released patch is available in Chrome 152.0.7977.65.

Web origin policy bypass in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already achieved renderer process compromise to read limited cross-origin data via a crafted HTML page. The vulnerability stems from CWE-863 (Incorrect Authorization) in Chrome's Input component, which fails to enforce origin boundaries correctly when processing renderer-supplied input. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.24% (15th percentile), consistent with low observed exploitation pressure.

Web origin policy bypass in Google Chrome for Windows (prior to 152.0.7977.65) stems from inadequate encryption strength in the browser's Notifications subsystem, exploitable via a crafted HTML page using social engineering. An unauthenticated remote attacker who tricks a user into visiting a malicious page can read limited cross-origin notification data, violating the same-origin boundary. No public exploit code has been identified and EPSS is extremely low (0.13%, 3rd percentile), consistent with the Chromium team's own Medium severity rating.

HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.

The Viz compositor component in Google Chrome prior to 152.0.7977.65 can be exploited by an attacker who has already achieved renderer process compromise to bypass Chrome's web origin policy via a crafted HTML page. This is a chained exploit primitive, not a standalone initial-access vector - it escalates an existing renderer foothold into cross-origin data access. EPSS sits at 0.29% (21st percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing real-world urgency below what raw CVSS metrics alone might suggest.

Incorrect reference resolution in Chrome's Loader component prior to version 152.0.7977.65 enables unauthenticated remote attackers to bypass the browser's web origin policy via crafted network traffic, with user interaction required. The flaw (CWE-706) allows misattribution of resource origins, potentially exposing cross-origin data; CVSS rates impact as limited confidentiality loss only. With an EPSS of 0.30% at the 22nd percentile and no CISA KEV listing, exploitation appears theoretical at this time rather than actively occurring, though origin policy bypass is a meaningful primitive for targeted attacks.

Web origin policy bypass in Google Chrome's Variations component (the Finch A/B testing and feature-flag delivery system) affects all Chrome versions prior to 152.0.7977.65. A remote attacker can deliver crafted network traffic to a user running a vulnerable browser version, potentially circumventing same-origin protections and reading cross-origin data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.22% (12th percentile) signals low current exploitation activity.

Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) permits a remote attacker who has already compromised the renderer process to circumvent same-origin policy enforcement via a crafted HTML page, yielding limited cross-origin data disclosure. The flaw arises from improper input validation (CWE-20) in the network stack and functions as a second-stage amplifier within an exploit chain rather than a standalone initial-access vector. EPSS is very low at 0.28% (20th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.

Race condition in Google Chrome's Permissions component on Android allows a remote attacker, through social engineering, to bypass the web origin policy and access limited cross-origin data. Affected are all Chrome for Android versions prior to 152.0.7977.65. Exploitation requires user interaction with a crafted HTML page; no public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.26% (18th percentile) reflects low observed exploitation probability.

Incorrect authorization in the Downloads component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system-level file access restrictions through a crafted HTML page delivered via social engineering. The flaw (CWE-863) requires user interaction to trigger, limiting opportunistic mass exploitation; however, Chrome's ubiquitous install base makes even low-probability attack paths operationally significant. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits low at 0.32% (24th percentile).

Incorrect authorization in the Navigation subsystem of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy by luring a victim to a crafted HTML page. The flaw, classified under CWE-863 (Incorrect Authorization), allows partial cross-origin data reads (limited confidentiality impact per CVSS C:L). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.29% (21st percentile) reflects a currently low real-world exploitation probability. Vendor-released patch 152.0.7977.65 is available.

Chrome's Network component prior to version 152.0.7977.65 contains an improper input validation flaw that allows a pre-positioned attacker - one who has already compromised the renderer process - to bypass system access restrictions via a crafted HTML page. All Google Chrome desktop releases below 152.0.7977.65 on Windows, macOS, and Linux are affected. With a CVSS score of 6.8, an EPSS of 0.24%, no CISA KEV listing, and no public exploit identified at time of analysis, the threat is real but confined to sophisticated chained-attack scenarios.

Remote same-origin policy bypass in Google Chrome prior to 152.0.7977.65 exploits a use-after-free condition (CWE-672) in the Network component, allowing an attacker who has already achieved renderer process compromise to escape origin boundaries via a crafted HTML page. The vulnerability carries a CVSS 4.3 and EPSS of 0.66% (49th percentile), consistent with its role as a second-stage exploit chain component rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Web Workers race condition in Google Chrome prior to 152.0.7977.65 enables Same-Origin Policy bypass for attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) allows a timing attack between origin validation and Worker data access, permitting cross-origin data reads from within a compromised renderer. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.19% (9th percentile) reflects the chained-exploit prerequisite that substantially limits real-world attacker reach.

Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already achieved renderer process compromise to make unauthorized cross-origin network requests via a crafted HTML page. The incorrect authorization check (CWE-863) in Chrome's Network component fails to enforce origin boundaries when the renderer is compromised, exposing limited confidentiality data from foreign origins. No public exploit has been identified, EPSS probability stands at a low 0.23%, and the vulnerability is not listed in CISA KEV - consistent with the high attack complexity imposed by the renderer-compromise prerequisite.

Chrome's QUIC protocol implementation prior to version 152.0.7977.65 permits remote attackers to bypass the browser's web origin policy by directing a user to a crafted HTML page. The flaw is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), meaning an attacker can influence a reference within the QUIC layer to access cross-origin resources that should be restricted. Impact is limited to partial confidentiality loss; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Web origin policy bypass in Google Chrome before 152.0.7977.65 exploits improper input validation (CWE-20) in the browser's Input component, allowing a remote attacker who has already compromised the renderer process to circumvent same-origin protections via a crafted HTML page combined with social engineering. The confidentiality impact is limited (CVSS C:L) with no integrity or availability consequence, and the Chromium team rates this Medium severity. No public exploit code exists and EPSS at 0.24% (15th percentile) reflects the low opportunistic exploitation probability given the chained pre-conditions required.

Web origin policy bypass in Google Chrome's network layer prior to version 152.0.7977.65 allows a remote attacker to circumvent the browser's same-origin enforcement by luring a user to a crafted HTML page. The flaw stems from incorrect authorization logic (CWE-863) in Chrome's networking stack, resulting in limited confidentiality exposure (C:L) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low observed exploitation probability at time of analysis.

Incorrect authorization in Google Chrome Core prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass the web origin policy by combining that foothold with social engineering via a crafted HTML page. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser's Core incorrectly validates authorization checks across origins under this specific post-compromise condition. No public exploit or CISA KEV listing is present, and the EPSS score of 0.34% (26th percentile) reflects limited real-world exploitation probability at this time.

Missing authorization in the WebAppInstalls component of Google Chrome for Android (prior to 152.0.7977.65) enables an attacker who has already achieved renderer process compromise to extract sensitive information by issuing crafted IPC requests that bypass browser-process authorization checks. This is a chained exploit primitive rather than a standalone attack - it elevates a pre-existing renderer compromise into an unauthorized data disclosure. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.38% at the 30th percentile reflects the high practical barrier imposed by the required renderer prerequisite.

Sensor API information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to read sensitive device sensor data by loading a crafted HTML page. The flaw (CWE-862, Missing Authorization) does not provide initial access on its own - it is a post-exploitation primitive that extends the capability of a pre-existing renderer compromise. No public exploit code has been identified at time of analysis, and EPSS stands at 0.26% (17th percentile), reflecting low current exploitation probability.

Incorrect authorization in Chrome's FileSystem API (CWE-863) allows a remote attacker to bypass system access restrictions through a crafted HTML page delivered via social engineering, achieving high-integrity impact on versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery with mandatory user interaction and no confidentiality exposure - only unauthorized writes or modification of normally restricted filesystem locations. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.38% (31st percentile), consistent with the social-engineering friction required. A vendor patch is available in stable channel 152.0.7977.65.

Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. A vendor patch was released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists, and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation pressure.

Incorrect authorization in the Chrome Extensions subsystem (CWE-863) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by delivering a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. Chromium rated this High severity despite the NVD CVSS base score of 4.3, because the same-origin policy bypass has meaningful privacy implications even though it requires a pre-compromised renderer as a prerequisite. No public exploit code has been identified and EPSS stands at 0.34% (26th percentile), consistent with no active exploitation confirmed at time of analysis.

Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.

Incorrect authorization in Google Chrome's Extensions subsystem (all versions before 152.0.7977.65) allows an attacker who has already compromised the renderer process to bypass the web origin policy and reach privileged browser pages via a crafted HTML page. This is a chained, second-stage vulnerability - a prior renderer compromise is required - substantially narrowing the realistic attacker pool despite the network-accessible vector. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS probability of 0.24% at the 15th percentile is consistent with this chained attack profile.

Incorrect authorization in Google Chrome's Transactions Platform (versions prior to 152.0.7977.65) permits a remote attacker who has already achieved renderer process compromise to bypass the browser's web origin policy via a crafted HTML page. The flaw is classified CWE-863 and carries a vendor severity of High, though the CVSS base score of 4.3 reflects the limited confidentiality-only impact and required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.24% (15th percentile) indicates low observed exploitation probability.

Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.

Incorrect authorization in the Paint component of Google Chrome before version 152.0.7977.65 enables remote unauthenticated attackers to potentially bypass the Same-Origin Policy via a crafted HTML page, resulting in limited cross-origin data exposure. Exploitation requires user interaction - the victim must navigate to the attacker-controlled page - and impact is confined to partial confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and the low EPSS score of 0.24% (15th percentile) corroborates low observed exploitation activity; a vendor patch was released in the Chrome 152 stable channel.

Missing authorization in Google Chrome's Passwords component prior to version 152.0.7977.65 allows a remote attacker, who has already compromised the renderer process, to bypass web origin policy and access stored password data for other origins via a crafted HTML page combined with social engineering. The attack requires two chained prerequisites - renderer compromise and user interaction - which significantly constrains real-world exploitability despite the network-facing attack vector. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at a very low 0.24% (15th percentile). A vendor patch is available.

URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.

SCTP state cookie forgery in mediasoup (npm 3.20.0-3.20.5, Rust crate 0.22.0-0.22.4) permits an on-path attacker to establish unauthorized SCTP associations and inject DataChannel messages as a trusted peer, violating RFC 9260 Section 5.1.3. The root cause is that cookie validation relies entirely on two hardcoded magic constants ('msworker' and 0xAD81) rather than a per-instance HMAC secret - all remaining cookie fields are attacker-controlled, and COOKIE-ECHO packets bypass verification-tag and CRC32c checks by design. No public exploit has been identified at time of analysis; real-world risk is bounded by the narrow attack surface: only PlainTransport and PipeTransport with SCTP enabled and without DTLS/SRTP are vulnerable, while the far more common WebRtcTransport path is explicitly unaffected.

UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator password, undermining firmware-level access controls. The CVSS vector (AV:L/PR:H/S:C/I:H) confirms local high-privilege access is required, but a successful exploit extends beyond the OS security boundary - a scope change that elevates the real-world impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk contained to insider-threat and physical-access scenarios.

Unauthorized repository read in JFrog Artifactory's Composer repository handling exposes package metadata to authenticated users who lack explicit read permissions on the affected repository. The flaw stems from a missing authorization check (CWE-862) during Composer metadata requests, meaning repository-level access controls can be silently bypassed. No active exploitation has been confirmed and no public exploit code is known, but the confidentiality impact is rated High by JFrog, and affected deployments should upgrade to the fixed Artifactory release.

Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV.

Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.

Origin header validation bypass in PraisonAI's MCP HTTP Stream transport allows a malicious webpage to invoke unauthenticated MCP tool calls against a locally-running server by exploiting a Python `startswith()` prefix match that accepts `http://localhost.evil.example` as a trusted localhost origin. Affected are all pip/praisonai installations prior to version 4.6.58 running the MCP HTTP Stream server under the CLI-default configuration (no API key). A functional proof-of-concept is included in the GitHub security advisory demonstrating local file read via `praisonai.files.create` and arbitrary state writes via `praisonai.todo.add`; no public exploit identified at time of analysis beyond this researcher-provided PoC.

Insecure direct object reference in Kibana's AI Assistant feature allows an authenticated low-privileged user to access or modify another user's AI conversation by supplying that conversation's identifier in API requests. Affected versions are addressed in the Elastic security update ESA-2026-51, covering Kibana 8.16.3 and 8.17.2. No public exploit code or active exploitation has been identified at time of analysis; the AC:H rating reflects the hard-to-guess nature of the conversation identifier as a meaningful practical barrier.

Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthenticated attackers to bypass share token validation in the `validateShareTokenForAsset` function, potentially exposing journey photos without a valid share token. The CVSS 4.0 score of 6.3 reflects high attack complexity that constrains practical exploitation despite requiring no authentication or user interaction. No public exploit code exists and this vulnerability is absent from the CISA KEV catalog; vendor-released patch v3.1.0 is available and strongly recommended for all self-hosted instances.

Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OIDC login flow by exploiting flawed user-lookup logic in the `findOrCreateUser` function of `server/src/services/oidcService.ts`. Successful exploitation - rated high attack complexity - could allow an attacker to authenticate as an arbitrary user without valid credentials. No public exploit or CISA KEV listing exists; however, the vendor's v3.1.0 release notes describe this as a 'critical authentication bypass' among 18 privately-reported vulnerabilities, and updating is strongly recommended for all self-hosted instances.

Privileged information disclosure in YOOtheme Pro for Joomla (versions 1.0.0 through 5.0.41) allows authenticated users holding only com_template editing permissions to read metadata about arbitrary Joomla modules - access that normally requires the separate com_modules permission. The root cause is CWE-284 (Improper Access Control): the extension's template editor fails to verify whether the requesting user holds the appropriate module-management permission before returning module data. No public exploit identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the high privilege requirement and limited confidentiality impact.

Log endpoint access control in Ech0 before 4.4.3 is broken for any authenticated non-admin user, exposing real-time and historical server logs via three unguarded API endpoints. The router registers GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs under middleware that validates JWT signatures but never checks role or scope - a pattern inconsistent with every other admin-restricted route in the codebase. Disclosed log data includes internal file paths, error stack traces, Go module names, and structured application state fields that facilitate reconnaissance for follow-on attacks; no public exploit is identified at time of analysis.

Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count field of any post by repeatedly calling PUT /api/echo/like/:id without credentials or rate limiting. The endpoint is explicitly registered on the public router group, bypassing all JWT authentication middleware, and the service layer performs no identity check or per-user binding before executing the database increment. A proof-of-concept is publicly documented in GHSA advisory GHSA-rgj7-vg8v-j4wr; no active exploitation is confirmed via CISA KEV.

Authorization bypass in the My Agile Privacy® CMP, Cookie Consent & Privacy Tools WordPress plugin (all versions through 3.3.6) allows unauthenticated remote attackers to overwrite plugin settings controlling cookie shield activation, consent mode JavaScript behavior, and error handling configuration. The root cause is a missing authorization check (CWE-862) on plugin action handlers, confirmed by Wordfence with source-code references pointing to three distinct vulnerable functions in the frontend class. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, though the low-complexity, zero-authentication attack surface makes opportunistic abuse realistic at scale.

Authorization bypass in the Newsletters plugin for WordPress (all versions up to and including 4.17) allows authenticated attackers holding at minimum author-level access to send mass emails to any WordPress user role - including administrators - by forging the newsletters_mailinglistsroles POST field during ordinary post submission. The forged role slug is passed unchecked directly to WordPress's get_users() function, enabling the attacker to weaponize the site's own trusted outbound email channel for phishing campaigns targeting privileged accounts. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and common provisioning of author accounts on multi-contributor sites make exploitation realistic.

Consent bypass in Red Hat Build of Keycloak's keycloak-services component allows an authenticated attacker holding valid client credentials and a trusted identity provider assertion to obtain OAuth2 access tokens for user accounts at consent-gated clients without the user's knowledge or approval. The JWT Bearer authorization grant flow (RFC 7523) omits the consent validation step that is correctly enforced in other grant types - classified as CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the high confidentiality impact and network-accessible token endpoint warrant prompt remediation in any Keycloak deployment leveraging federated JWT Bearer grants.

Authentication bypass in liketrek TREK up to v3.0.22 allows a remote attacker with valid credentials to circumvent two-factor authentication by manipulating the mfa_token parameter in the Pre-2FA handler of the loginUser function (authService.ts). The CVSS 4.0 vector (PR:L) confirms low-privilege credentials are a prerequisite, meaning the bypass targets users who have valid username/password combinations but should still be blocked by a second factor. The vendor's own release notes for v3.1.0 describe this as a 'critical authentication bypass' - one of 18 privately reported security issues - and strongly recommend immediate upgrade for all self-hosted instances. No public exploit code or CISA KEV listing has been identified at time of analysis.

Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash isolation filter and frontend user access controls, allowing retrieval of Solr-indexed documents outside normal authorization constraints. An unauthenticated visitor who obtains or guesses a valid Solr document ID can access content restricted to specific sites or authenticated frontend users by querying the detail-view endpoint directly, circumventing the access controls enforced on the regular search path. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that exploitation depends on obtaining valid document IDs.

Unauthorized database field disclosure in the TYPO3 "Modules" extension allows any authenticated low-privileged backend user to read arbitrary database field values - including backend and frontend user password hashes - by supplying user-controlled table, field, and record parameters to an unprotected AJAX inline editing endpoint. The authorization check protecting which fields a given user may view or modify is entirely absent from this endpoint, meaning any backend session holder with module access can query sensitive records regardless of their configured permissions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only a valid TYPO3 backend login, making it a meaningful insider privilege-escalation risk in multi-user installations.

Unauthorized event disclosure in the TYPO3 "Event Management and Registration" extension allows unauthenticated remote users to view hidden or time-restricted events by supplying a demand-override query parameter that the extension fails to validate against its own enable-field restrictions. The vulnerability (CWE-862, Missing Authorization) is exploitable against any deployment where the `disableOverrideDemand` plugin setting is not explicitly activated - making non-hardened installs vulnerable by default. No public exploit code has been identified at time of analysis, and CVSS 4.0 scores this at 6.3 Medium with low confidentiality impact and no integrity or availability consequence.

Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.

Missing authorization in Checkmk's background job subsystem allows any authenticated user to view the status and output of background jobs by knowing the job ID, potentially exposing data from jobs initiated by other users or higher-privileged roles. Affected releases span the entire 2.2.0 branch and versions below 2.5.0p12, 2.4.0p36, and 2.3.0p50. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; real-world impact is bounded to information disclosure within authenticated sessions.

Insecure Direct Object Reference in Fluent Boards Pro WordPress plugin (all versions through 2.0.11) enables authenticated attackers with Subscriber-level access to perform unauthorized actions by supplying arbitrary user-controlled object keys that the plugin accepts without ownership validation. The CVSS 4.3 Medium rating reflects network accessibility offset by the authentication prerequisite and limited integrity-only impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Unauthorized action execution in Fluent Support Pro plugin for WordPress (all versions through 2.3.1) is possible for any authenticated subscriber-level user due to a missing capability check on a plugin function. The missing check (CWE-862) means WordPress's built-in role/capability enforcement is bypassed, allowing low-privileged users to invoke functionality reserved for higher-privilege roles. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (any registered user) makes it accessible to a broad attacker pool on sites with open user registration.

Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.

Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.

Authorization bypass in the Events Manager WordPress plugin (versions up to and including 7.4.0) exposes restricted event metadata to unauthenticated remote attackers. The plugin fails to verify user authorization before returning event and location data, allowing any internet user to retrieve titles, dates, descriptions, and location details that administrators have explicitly restricted as draft, pending, trashed, or private. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a patched version (7.4.1) is confirmed available via the WordPress plugin repository changeset.

Authorization bypass in the BetterLinks WordPress plugin (all versions ≤ 3.1.0) permits any authenticated subscriber-level user to create arbitrary short URLs with attacker-controlled slugs and redirect destinations, enabling phishing campaigns that abuse the victim site's trusted domain and SEO manipulation. Exploitation is conditional on the Fluent Boards companion plugin being simultaneously installed and active, and is facilitated by the plugin leaking the betterlinks_admin_nonce to all authenticated users on every frontend page via wp_localize_script. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the dual-plugin dependency and the requirement for a valid WordPress account.

Quiz result data exposure in the WP Courses LMS WordPress plugin lets any authenticated user read other users' quiz answers and scores by enumerating sequential resultID integers via the wpcq_get_quiz_result AJAX action. All plugin versions through 3.2.29 are affected; the only access gate - a frontend-exposed WordPress nonce - functions as an anti-CSRF token, not an authorization check, and is freely available to every logged-in user, providing no meaningful barrier. No public exploit code and no CISA KEV listing exist at time of analysis, but the trivial exploitation path and privacy implications of exposed assessment data make this a near-term remediation priority for any platform hosting sensitive educational content.

Broken access control in AutomatorWP WordPress plugin (versions ≤ 5.8.3) allows authenticated subscriber-level users to perform privileged operations without authorization. Subscribers - the lowest authenticated role in WordPress - can invoke plugin functionality reserved for editors or administrators, resulting in high integrity impact against affected sites. No public exploit code or active exploitation has been identified at time of analysis; CVSS scores this at 6.5 Medium, reflecting meaningful but constrained impact bounded by the requirement for a valid account.

Broken access control in the Style Kits WordPress plugin (versions ≤ 2.6.5) allows subscriber-level authenticated users to perform privileged actions due to missing authorization checks (CWE-862). The integrity impact is rated High by the vendor CVSS, meaning a low-privilege WordPress account holder can manipulate site content or plugin settings beyond their intended role. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, but the low attack complexity and purely network-based vector make this straightforward to abuse on any affected site with open user registration.

Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted requests to the post-ticket-reply endpoint without valid session credentials. The flaw exists in FormController::post_ticket_reply (CWE-306), allowing manipulation of helpdesk communications and injection of fraudulent responses into active support tickets. A proof-of-concept exploit has been publicly published via a GitHub issue, though no vendor patch is available as the maintainers have not yet responded to the disclosure.

Privilege escalation in HashiCorp Vault allows authenticated low-privileged users to traverse outside their authorized secret paths by injecting forward-slash characters into identity values referenced by templated ACL policy paths. Both Vault Community and Enterprise editions from version 0.11.0 through 2.0.3 are affected across all platforms. No public exploit code or active exploitation is confirmed at time of analysis; however, the high confidentiality and integrity impact make this a priority for any organization using identity-based templated ACL policies.

Issuer-validation bypass in joserfc (Python JOSE library) prior to version 1.7.3 allows an attacker to craft a JWT with an array-valued `iss` claim - e.g., `["expected-issuer"]` - that passes the JWTClaimsRegistry equality check via Python membership matching (`in` operator on a list) rather than strict string equality. The same flaw affects `sub` claim validation. No public exploit has been identified at time of analysis, but the commit diff confirms the root cause and fix; EPSS data was not provided in the input.

Insecure Direct Object Reference in Sakai's profile2 REST API allows any authenticated user to permanently delete the profile image of any other user - including administrators - by supplying an arbitrary userId in the DELETE /api/users/{userId}/profile/image path parameter. The controller validates session existence but performs no ownership comparison, and the service layer passes the attacker-controlled userId directly to the DAO, which deletes the profile_images_t database row unconditionally. A related gap in the pronunciation recording delete endpoint (DELETE /api/users/{userId}/profile/pronunciation) omits session validation entirely, enabling unauthenticated deletion. No public exploit or CISA KEV listing exists at time of analysis, though the attack is trivially scriptable.

Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.

Stored cross-site scripting in the contacts component of NethServer's WebTop groupware module allows an authenticated attacker to inject persistent JavaScript into shared address book fields, which executes silently in any victim's browser upon viewing the poisoned contact record. All WebTop installations on version 1.5.6 and earlier are at risk; successful exploitation can cascade into session hijacking, credential theft, and unauthorized access across all integrated groupware services including email and file storage. No public exploit has been identified at time of analysis, though the stored XSS class requires minimal technical sophistication once an attacker holds a low-privilege account.

Broken access control in BookStack's Image Gallery API before v26.05.4 allows authenticated API users holding image-update or image-delete permissions to manipulate any other user's profile avatar without requiring user-management privileges. The API controller accepts arbitrary image IDs and skips the content-type and gallery restrictions enforced by the web controller; when the target avatar's uploaded_to field references a page the attacker can already access, the authorization check incorrectly passes. Affected operations include renaming, replacing, or deleting the victim's avatar; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling.

Insufficient access control granularity in HCL Hive's Keycloak IAM instance exposes protected resources to unauthenticated or unauthorized network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without credentials or user interaction against the IAM layer, resulting in unauthorized read access to confidential resources. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor knowledge base article (KB0131731) has been published.

Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.

Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.

Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) permits unauthenticated remote attackers to invoke restricted plugin functionality and read limited application data without any credentials. Rooted in CWE-862 (Missing Authorization), the flaw arises from absent capability checks on one or more plugin endpoints - a structural weakness common in WooCommerce extensions that register AJAX handlers or REST routes without verifying caller permissions. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at the time of analysis.

Broken access control in the RepairBuddy WordPress plugin (versions up to and including 4.1223) allows unauthenticated remote attackers to perform unauthorized actions against affected WordPress installations. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute privileged operations without verifying the requesting user's identity or capability. The integrity impact (I:L) suggests unauthorized modification of repair shop records or plugin settings is possible, though confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at time of analysis.

Unrestricted file upload in itsourcecode Online Pharmacy System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo argument to the user registration endpoint (all_users/register.php), exploiting the PHP move_uploaded_file function without adequate file type or content validation. The CWE-284 root cause (Improper Access Control) combined with a public registration surface means no authentication barrier exists before reaching the vulnerable code path. A publicly available exploit has been confirmed (E:P in the supplied CVSS 4.0 vector; corroborated by VulDB submission and a published GitHub PoC), making this immediately weaponizable; no active CISA KEV listing has been identified at time of analysis.

Incorrect authorization in KAON PG5298A and PG5298B router firmware allows authenticated network-adjacent users to send crafted JSON-RPC requests that bypass GUI-enforced access controls, enabling arbitrary system file reads and command execution on the device. All firmware versions prior to 3.0.82 (PG5298A) and 4.0.82 (PG5298B) are affected, as confirmed by CERT-PL. No public exploit has been identified at time of analysis; vendor-released patches are available.

Missing authentication in NewSiteServer (NSS) by CyberTutor exposes an email-dispatch function to unauthenticated remote attackers, allowing them to send arbitrary emails to any recipient while impersonating the school. All versions of the product are affected per EUVD-2026-64705, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges and no user interaction from any network position. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low exploitation barrier makes this a realistic phishing and brand-abuse vector against school communities.

Missing per-object authorization on Ghostwriter's report template lint endpoints through version 7.2.6 exposes cross-tenant template metadata to any authenticated user. The RoleBasedAccessControlMixin.test_func method defaults to checking only request.user.is_active, and neither the lint-trigger endpoint nor the lint-result retrieval endpoint overrides this with ownership or client-scope validation. Any holder of a valid active account can lint an arbitrary template by supplying its primary key, overwriting that template's stored lint result and reading returned findings that enumerate variable names and template-engine errors - disclosing template structure across organizational boundaries. No public exploit confirmed at time of analysis, though a public researcher writeup exists.

Authorization bypass in Dolibarr ERP up to versions 18.0.10, 22.0.5, and 23.0.3 allows any low-privileged authenticated user to read or overwrite another user's private notes by manipulating the numeric `id` parameter in `/user/note.php`. The root cause (CWE-639 - Authorization Bypass Through User-Controlled Key) is a missing identity check before the permission evaluation: all requests were evaluated under the caller's self-write right rather than distinguishing whether the target user matched the caller. A proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation has been confirmed via CISA KEV. Patches are available in versions 23.0.4 and 24.0.0.

Missing authentication on the public invitation-code redemption endpoint in open-wearables (versions up to and including 0.6.2) allows any unauthenticated remote attacker to call the `redeem_invitation_code` function and redeem invitation codes without authorization. The flaw exists in `backend/app/api/routes/v1/user_invitation_code.py` and requires only network access with no credentials, no user interaction, and no special configuration. No patch is available at time of analysis; the maintainers have not responded to the responsible disclosure filed via GitHub issue #1274.

Improper authorization in Open5GS 2.8.0's AMF UEContextReleaseRequest path handler allows remote low-privileged attackers to trigger unauthorized UE context release operations in the 5G core network. The flaw, tagged as an authentication bypass (CWE-285), affects the Access and Mobility Management Function - a security-critical component governing device connectivity and session management in 5G deployments. A proof-of-concept exploit exists (E:P in CVSS 4.0 supplemental), and no CISA KEV listing was identified at time of analysis.

Authorization bypass via Insecure Direct Object Reference (IDOR) in the Boarder Management Module of code-projects Barangay Resident Profiling Management System 1.0 allows authenticated remote attackers to access or modify boarder records belonging to other users by manipulating the `ID` parameter in `/boarders.php`. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the exploitation barrier. The vulnerability is not listed in CISA KEV, so no confirmed active exploitation campaigns have been identified at time of analysis.

Authorization bypass in code-projects Barangay Resident Profiling Management System 1.0 exposes the /archived_records.php endpoint to insecure direct object reference (IDOR) exploitation, allowing low-privileged authenticated attackers to restore or delete archived resident records they do not own by manipulating the resident_id parameter. A public proof-of-concept exploit is available via GitHub, though the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact scoped to the vulnerable system with no lateral scope change.

Session cookie forgery in Apache::AppSamurai::Util through version 1.01 is possible because CreateSessionAuthKey derives its entire entropy from observable runtime state - wall-clock microseconds and the Apache worker process ID - rather than a cryptographically secure random source. An unauthenticated remote attacker who can bound the second in which a target session was created and enumerate the small PID space can construct candidate 64-character hex cookies and recover a valid session token through online brute-force, bypassing authentication for all resources protected by the module. No public exploit code has been identified and SSVC confirms no current exploitation, though the attack is mechanically feasible given the constrained key space.