Authentication Bypass

Improper authorization in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to manipulate the `id` or `username` parameters in `/admin/edit_user_account.php` to modify user accounts they do not own or administer. The flaw is rooted in missing access control checks on the User Account Update endpoint, enabling horizontal or vertical privilege escalation by forging parameter values. A public proof-of-concept exploit has been disclosed on GitHub, raising the practical exploitation risk above what the moderate CVSS score alone suggests.

Broken access control in Brave Popup Builder WordPress plugin (versions through 0.8.5) allows any authenticated low-privilege user - including Subscriber-level or WooCommerce Customer accounts - to read restricted popup content by supplying an arbitrary post ID in the URL. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR pattern where the server fails to validate whether the requesting user has rights to the resource identified by a user-supplied key. No active exploitation has been identified and EPSS sits at the 8th percentile, though the low barrier to exploitation (any authenticated user) means the attack surface on multi-tenant or membership-based WordPress sites is broader than the CVSS score alone suggests.

Missing capability check in WooCommerce Bookings WordPress plugin before 3.9.0 allows any authenticated user with Subscriber-level access or above to create draft bookable products via a vulnerable AJAX endpoint. The nonce check that would normally prevent unauthorized requests can be defeated by simply omitting the nonce token from the request - a particularly low-friction bypass. No public exploit has been identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects low observed exploitation interest.

Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config.ts` falls back to a hard-coded value for `BETTER_AUTH_SECRET` when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. No vendor patch exists; the maintainer had not responded to the disclosure issue at time of analysis, and publicly available exploit code is indicated by the CVSS 4.0 E:P flag.

Unauthenticated row disclosure in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows any remote, unauthenticated user to read arbitrary form row data by invoking the form.inlineedit controller, which performs no access checks before returning database rows. The flaw is purely an authorization omission (CWE-284) rather than a logic or cryptographic weakness, making it trivial to exploit against any Joomla installation with Fabrik active. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible nature (CVSS 4.0: AV:N/AC:L/PR:N) keeps real-world risk meaningful for sites that store sensitive user-submitted form data.

Unauthenticated comment deletion in Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) is possible because the DeleteComment endpoint performs no access control verification of any kind - a straightforward CWE-284 (Improper Access Control) failure. Any remote, unauthenticated party with network access to a Joomla installation running the affected extension can delete arbitrary comments by targeting their IDs. No active exploitation or public exploit code has been identified at time of analysis; the fix is available in version 4.7.2.

Unauthenticated comment tampering in the Fabrik extension for Joomla exposes all versions from 1.0.0 through 4.7.1 to arbitrary comment modification by any remote actor. The onUpdateComment endpoint performs no access control checks whatsoever - no session validation, no ownership verification - allowing any unauthenticated HTTP request to overwrite comment content in the database. No public exploit code has been identified at time of analysis, but the CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms this is trivially exploitable with no prerequisites beyond network access to a Joomla site running the affected extension.

Unauthenticated email disclosure in Fabrik (Joomla extension, versions 1.0.0-4.7.1) exposes any commenter's email address to remote, unauthenticated requesters via the onGetEmail endpoint, which performed no access control checks. The flaw stems from a complete absence of authorization logic on a data-retrieval endpoint, allowing trivial mass enumeration of personal contact data. No public exploit code or CISA KEV listing has been identified at time of analysis, though zero-barrier network access makes opportunistic harvesting straightforward.

Unauthenticated row reordering in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows any network-accessible attacker to arbitrarily manipulate record ordering in Fabrik lists without credentials. The order plugin processed reorder requests with no access control checks whatsoever, a CWE-284 failure reported by the Joomla security team. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV.

Unauthorized global theme modification in the GreenShift - Animation and Page Builder Blocks WordPress plugin (versions up to and including 12.8.9) is possible for any authenticated contributor-level user due to an insufficiently gated AJAX handler. The `gspb_update_global_wp_settings` function checks only for the `edit_posts` capability - a default contributor privilege - rather than requiring administrative rights, enabling site-wide defacement by overwriting theme color settings. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar makes this a realistic threat on any multi-author or open-registration WordPress deployment running the affected plugin.

Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship by exploiting a missing capability check on the `duplicate-post` REST endpoint. The `duplicate_post()` function in includes/api.php accepts a `selectedAuthorId` parameter without verifying the caller holds the `edit_others_posts` capability, allowing any Contributor-level account to attribute cloned posts to administrators or other privileged users. No public exploit code exists and the CVE is not listed in the CISA KEV catalog, but the low attack complexity and broad availability of Contributor roles on multi-author WordPress sites make this a realistic threat to site integrity.

PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous password pushes by exploiting a nil-equality logic flaw in the ownership authorization check. Any party who possesses a push's secret URL can permanently destroy that push - bypassing the creator's explicit `deletable_by_viewer=false` setting and any passphrase protection - because Ruby evaluates `nil == nil` as true, causing the ownership gate to pass spuriously for anonymously created pushes. No public exploit code has been identified at time of analysis, and the issue is fixed in v2.9.6.

Incomplete path blocklist in SiYuan's MCP file tool (versions before v3.8.0) allows authenticated administrators to read workspace files that the HTTP API is designed to protect, including plaintext publish-mode passwords from data/.siyuan/publishAccess.json. The flaw stems from a mismatch between the HTTP API's access restrictions and the MCP tool's narrower blocklist, classified as CWE-863 (Incorrect Authorization). No public exploit is identified at time of analysis; exploitation is bounded by the requirement for pre-existing administrator credentials.

Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-level users to create duplicate posts with `future` (scheduled, auto-publishing) or `private` status, circumventing editorial review workflows that site administrators rely upon. The REST API endpoint's permission callback checks only the plugin's custom `duplicate_posts` capability while ignoring WordPress core status-gating capabilities such as `publish_posts`, and also disregards administrator-configured post-type duplication restrictions. No public exploit code has been identified and no CISA KEV listing exists, but the low attack complexity and network-accessible REST endpoint make this trivially abusable by any established contributor on a target site.

Password-protected gallery categories in JoomGallery versions prior to 4.3.1 are fully accessible to unauthenticated remote attackers by switching the request format to JSON via the `format=json` URL parameter. The HTML view correctly enforces the password gate, but the JSON view controller lacks any equivalent access control check, exposing protected image metadata and content without requiring credentials. No public exploit has been identified at time of analysis, though the bypass is trivially replicable directly from the vulnerability description.

Webhook signature bypass in the Conekta Payment Gateway WordPress plugin (all versions before 6.2.2) allows unauthenticated remote attackers to fraudulently mark arbitrary WooCommerce orders as paid without any actual payment. The plugin neither validates that incoming webhook notifications originate from Conekta nor verifies that the payment amount or order binding matches the targeted order. No public exploit code or CISA KEV listing exists at time of analysis, but the attack path requires no authentication, no user interaction, and no special configuration, making it trivially automatable against any exposed merchant site.

Tutor LMS WordPress plugin (all versions before 4.0.6) exposes private course content to any authenticated instructor via a missing per-object ownership check - a CWE-639 Insecure Direct Object Reference flaw. Any user holding the instructor role can read private course content authored by other instructors by referencing their course object IDs directly. No active exploitation has been confirmed (not in CISA KEV), EPSS sits at the 4th percentile (0.14%), and the vendor-released patch is available in version 4.0.6.

Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.

Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.

Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.

Unauthenticated deletion of the iTop `.readonly` write-protection file is possible in Combodo iTop prior to version 3.2.3, allowing any remote attacker to remove a critical filesystem-based access control mechanism. The `.readonly` file is created during the setup process specifically to block write operations on the iTop instance; its deletion effectively disables that safeguard without any credentials. No active exploitation has been confirmed (not in CISA KEV), but the low attack complexity and zero authentication requirement make this a straightforward attack against any exposed iTop instance. The issue is fixed in version 3.2.3 per the GitHub security advisory GHSA-2xh3-r27f-3pr5.

Unauthorized document access in Combodo iTop before version 3.2.3 allows any authenticated user to retrieve documents and attachments belonging to organizations or objects they lack permission to view. The root cause is a logic inversion in the PHP DownloadDocument method: a host-object rights check could silently pass due to incorrect boolean handling, bypassing the intended access control gate entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS PR:L vector confirms exploitation requires only a valid low-privileged account.

Object locking in Combodo iTop prior to version 3.2.3 can be triggered by any authenticated user regardless of assigned write permissions, enabling targeted denial-of-service against legitimate editors. The missing authorization check in the lock acquisition endpoint (ajax.render.php) allows low-privilege users to lock objects they have no right to modify, blocking users who do hold write permissions from editing those objects. No active exploitation has been confirmed and no public exploit code exists; vendor-released patch is available in version 3.2.3.

Missing authentication in Esri Portal for ArcGIS versions 11.1 through 12.0 permits a remote unauthenticated attacker to read a specific internal resource intended to be access-controlled. The flaw (CWE-306) means one or more endpoints fail to enforce authentication before returning protected content, though the exposed resource is explicitly scoped to non-user data. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 5.3 Medium rating reflects the bounded confidentiality-only impact.

Download quota manipulation in J2Store versions 1.0.0 through 4.1.5 for Joomla allows authenticated users to increment download limit counters on digital product orders they do not own, undermining purchased access controls for other customers. The flaw is an Insecure Direct Object Reference (IDOR) in the download counter endpoint, which accepts a user-supplied order record identifier without verifying ownership against the authenticated session's order token; the same endpoint also lacks CSRF token validation, widening the attack surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Cross-customer order replication in J2Store (Joomla extension by j2commerce.com, versions 1.0.0-3.3.20, 4.0.0-4.0.20, and 4.1.0-4.1.5) allows an authenticated attacker to supply an arbitrary order_id and copy another customer's cart contents and shipping address data directly into the attacker's own session. The root cause is absent ownership validation on the order copy function - CSRF tokens are checked, preventing cross-site request forgery, but the back-end never verifies that the order_id belongs to the requesting user. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Improper authorization (broken access control) in Dromara RuoYi-Vue-Plus versions 5.6.0 through 5.6.2 allows authenticated low-privilege users to interact with protected Workflow module endpoints - FlwInstanceController, FlwDefinitionController, FlwCategoryController, FlwSpelController, and TestLeaveController - without the required authorization level. The vulnerability is remotely exploitable with no user interaction needed beyond holding a low-privilege account. No public exploit has been independently confirmed at time of analysis, though a researcher-submitted GitHub issue references the flaw; no active exploitation is recorded in CISA KEV.

Tenant data boundary failure in Roskus Prospero Flow CRM 4.9.1-5.14.0 allows authenticated users holding transaction and accounting creation permissions to read another co-tenant company's bank account name, institution name, and card last four digits by supplying a foreign bank_account_id or bank_card_id in POST /transaction/save. The root cause (CWE-639, IDOR) is the complete absence of company-ownership validation on user-controlled integer foreign keys before they are persisted and rendered - the controller correctly scoped the new transaction's company_id but applied no such scoping to associated reference IDs. No active exploitation or public POC has been identified at time of analysis; a vendor fix is available upstream via GitHub commit 5fd1fe8 and PR #261.

Passster WordPress plugin versions before 4.3.9 exposes globally password-protected post and page content to unauthenticated remote attackers via a flawed REST API path-matching bypass. The plugin's allowlist logic for public endpoints uses unanchored substring comparison against the full request URI rather than matching against the resolved WordPress route, meaning any attacker can craft a URI that embeds the whitelisted path segment anywhere within it to sidestep the protection gate entirely. A publicly available proof-of-concept exploit exists per WPScan, and the EPSS-relevant CVSS vector (PR:N, AC:L) confirms exploitation requires no authentication or special configuration beyond the plugin being installed with global password protection active.

Remote unauthenticated attackers can bypass mutual TLS client certificate verification on relay endpoints in Checkmk versions prior to 2.5.0p10 by supplying a fixed placeholder identity value in the request URL. Exploitation results in limited integrity and availability impact against the agent receiver relay channel, with no confidentiality exposure. Only Cloud, Ultimate, and Ultimate MT editions are affected, as relay endpoints are not exposed in other editions; no public exploit has been identified at time of analysis.

Missing authorization in Apache CloudStack's listHostTags API allows domain administrators to enumerate host tags across all domains in a multi-tenant deployment, violating tenant isolation boundaries established by the domain hierarchy. Affected versions span 4.12.0.0 through 4.22.1.0 across two release trains, with vendor-released patches in 4.20.3.1 and 4.22.1.1 confirmed by the Apache security advisory. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is meaningful in shared, multi-tenant CloudStack environments where cross-domain host tag visibility undermines infrastructure confidentiality guarantees between tenants.

Improper access control in Apache CloudStack's annotation APIs (addAnnotation and listAnnotation) allows any authenticated user to read and write annotations on entities they do not own. The APIs perform an ownership check when an entity UUID is supplied but fail to enforce the result of that check, reducing authorization to a formality that any authenticated user can bypass. No public exploit has been identified at time of analysis; no EPSS or CISA KEV data is available, but the bug affects all CloudStack deployments from 4.15.0.0 onward until the patched releases.

Missing authentication for a critical function in IKAS Technology Inc. Rush (versions through 21082026) permits unauthenticated remote attackers to forge the apparent source of data submitted to the system. Disclosed by Turkey's national CERT (USOM) under advisory TR-26-0883, this CWE-306 flaw carries a CVSS 5.3 Medium rating with network-level reach and no authentication barrier. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.

Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.

Financial ledger manipulation in the Dokan WooCommerce Multivendor Marketplace WordPress plugin (before 5.0.14) allows authenticated vendors to fraudulently clear commission debts by submitting arbitrary client-supplied payment amounts to the reverse-withdrawal endpoint without server-side balance validation. Any registered vendor on an affected marketplace can exploit this to zero out real outstanding commissions owed to the marketplace operator, constituting financial fraud against the site owner. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV, though the low attack complexity and accessible vendor registration on most marketplaces make this a meaningful business risk.

Session fixation in the Welcart e-Commerce WordPress plugin (all versions before 2.12.1) allows an unauthenticated remote attacker to pre-set a shop member's session identifier via a user-supplied request parameter, then silently hijack the authenticated session once the victim logs in through an attacker-crafted request. Because the plugin neither generates a fresh session ID on authentication nor rejects externally supplied session tokens, the attacker's chosen token becomes the victim's authenticated session. A publicly available POC exists via WPScan, and no KEV listing is present, though the combination of no required attacker privileges and a low-complexity exploit path elevates practical risk for any live Welcart storefront.

Missing authorization on the Tamara Checkout WordPress plugin's public payment cancel/fail return URLs allows any unauthenticated remote attacker to cancel or fail arbitrary WooCommerce orders store-wide simply by enumerating sequential numeric order IDs. The plugin through version 1.9.9.20 performs no verification of the WooCommerce order key, a WordPress nonce, or any user capability before acting on the supplied ID, making mass order disruption trivial to automate. A publicly available exploit has been documented by WPScan; no KEV listing is present but the low-friction attack surface warrants prompt remediation.

Unauthenticated information disclosure in the NewPath WildApricotPress Add-on WordPress plugin (all versions through 1.0.0) exposes member-only contact fields - email addresses and phone numbers - to any anonymous internet visitor via a REST API route that omits access control enforcement. Site administrators who configure those fields as members-only visibility receive no protection because the REST endpoint bypasses the plugin's own privacy logic. A publicly available exploit exists per WPScan, and no vendor-released patch has been identified at time of analysis.

Local named-pipe privilege escalation in Yamaha VOCALOID6 exposes privileged Editor functions to any co-resident process running under the same local user account, requiring no additional authentication. The flaw (CWE-306, Missing Authentication for Critical Function) stems from the VOCALOID6 Editor's local named pipe lacking access controls, allowing a low-privileged process owned by the same OS user to communicate with it directly. No public exploit or CISA KEV listing is identified at time of analysis; the EPSS signal is unavailable, but the CVSS score of 3.3 and local-only attack vector constrain real-world impact to same-account, same-machine scenarios.

Hard-coded credentials embedded in VOCALOID6 by Yamaha Corporation allow an attacker to impersonate a legitimate VOCALOID6 Editor client and authenticate to Yamaha's backend activation and content delivery servers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is network-exploitable without authentication or user interaction, as the credentials are distributed within publicly available client software. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the advisory was coordinated through JPCERT/CC (JVNVU90210212).

Improper access control in Apple watchOS prior to 26.4 allows a person with physical possession of a locked Apple Watch to view the device owner's contacts without authentication. The flaw, classified as CWE-284 (Improper Access Control), stems from insufficient permissions checking on a code path accessible from the lock screen. Apple has confirmed the fix in watchOS 26.4; no active exploitation has been identified per CISA SSVC assessment.

Insecure direct object reference in TREK collaborative travel planner before 3.1.3 allows any authenticated user with file-edit permission on any accessible trip to disclose reservation titles from private trips they do not own. By supplying attacker-controlled reservation_id, place_id, or assignment_id values to three file management API endpoints, the server joins the foreign reservation record in subsequent FILE_SELECT or getFileLinks() database queries and returns reservation_title in the response, crossing private trip boundaries. No public exploit code has been identified at time of analysis; vendor-released patch is confirmed in version 3.1.3.

Share-link token theft in TREK versions 3.0.0 through 3.0.x allows any ordinary authenticated user to exfiltrate private journey data belonging to other users. By iterating sequential journey IDs against the unguarded GET /api/journeys/:id/share-link endpoint, an attacker retrieves valid share tokens for journeys they do not own; those tokens then grant unauthenticated read access to the victim's travel entries, captions, GPS locations, moods, gallery photos, photo file paths, and asset identifiers via the public endpoint GET /api/public/journey/:token. No public exploit code or CISA KEV listing exists at time of analysis; the NVD CVSS scores this 6.5 medium, but the high confidentiality impact on personal travel data warrants prompt patching on any multi-tenant TREK deployment.

Cross-meeting presentation deletion in BigBlueButton prior to 3.0.29 allows an authenticated presenter in one meeting to permanently delete presentations belonging to a different concurrent meeting by supplying an arbitrary presentationId through the /api/graphql endpoint. The affected Scala handler RemovePresentationPubMsgHdlr issued database deletes scoped only by presentationId, with no verification that the target presentation belonged to the caller's meeting. No public exploit or CISA KEV listing has been identified at time of analysis, but exploitation requires only a valid presenter session and knowledge of a foreign presentationId, making it a realistic cross-tenant sabotage vector in multi-meeting deployments.

Compression bomb detection bypass in Tor before 0.4.9.9 enables remote unauthenticated attackers to deliver resource-exhausting payloads that evade the node's per-stream decompression safeguards. By concatenating multiple gzip or zlib sub-streams - each individually sized just below Tor's detection threshold - an attacker circumvents the aggregate bomb check entirely, potentially degrading availability of Tor nodes or relays. Tracked as TROVE-2026-022; no public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 5.3 Medium score reflects the limited but real availability impact.

Unauthorized XPC Mach service access in NoSleep 1.5.1 on macOS allows a local low-privileged attacker to send arbitrary dictionary messages - including attacker-controlled `command` and `NSBundlePath` values - to a privileged daemon without authorization. The root cause is CWE-862 (Missing Authorization), meaning the XPC service performs no caller identity check before processing requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Unauthorized cross-tenant record reassignment in Laravel Backpack CRUD's HasMany and MorphMany relationship-saving logic allows authenticated low-privileged admin users to corrupt data across ownership or tenancy boundaries. The `attachManyRelation` flow processes submitted primary keys and applies attach, detach, null, or delete operations on related records without verifying that those records belong to the current parent model or fall within developer-defined relation scopes, a classic IDOR pattern classified as CWE-862. Affected versions are composer/backpack/crud 6.0.0-6.8.14 and 7.0.0-7.0.46; no public exploit code exists and CISA KEV listing has not been established, but the issue is confirmed by internal PHPUnit testing against Backpack's fixture suite.

Authenticated IDOR in the Winter CMS backend FileUpload widget (versions through 1.2.12) allows any backend user - including those with no role beyond default My Account access - to manipulate attachment metadata and sort ordering across the entire application by submitting an attacker-controlled file_id POST parameter. Because the system_files table uses sequential integer primary keys, any authenticated attacker can enumerate and target arbitrary System\Models\File records belonging to unrelated users or models, overwriting title, description, and sort_order, and potentially triggering onRemoveAttachment against unrelated records through the same unscoped lookup. No public exploit has been identified at time of analysis, and no CISA KEV entry exists.

Laravel Backpack CRUD versions prior to 6.8.14 (6.x branch) and 7.0.38 (7.x branch) allow any authenticated user to change the account's login email address without supplying their current password, enabling persistent account takeover that survives session termination. The asymmetry is stark: the password-change endpoint in the same controller enforces a Hash::check against the stored password, but the account-info update path passes the request directly to mass-assignment without an ownership challenge. No public exploit or CISA KEV listing has been identified, but the attack chain is low-complexity for anyone who can obtain a transient authenticated session.

Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. An attacker with visibility or control over the network path between the gateway and an external DDNS provider can intercept credentials and potentially hijack DDNS management - enabling unauthorized DNS record manipulation for the affected deployment. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.

Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.

Bypass of rDNS-based security controls in BunkerWeb prior to 1.6.13 allows unauthenticated remote attackers who control a PTR record to spoof trusted reverse DNS suffixes, circumventing the blacklist, greylist, and antibot modules. The root cause (CWE-350) is the failure to perform forward-confirmed reverse DNS (FCrDNS) validation - affected modules checked only that the PTR hostname suffix matched a trusted pattern without verifying the hostname resolves back to the client IP. No public exploit or CISA KEV listing has been identified; vendor-released patch version 1.6.13 is available.

Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.

Missing authorization on the toggle_like and mark_as_seen endpoints in Frappe Framework 16.31.0 and earlier allows authenticated users to interact with documents and notes they lack read access to. Any valid session holder can call these whitelisted endpoints with arbitrary doctype and document name parameters, confirming resource existence and modifying _liked_by metadata or note-seen state without a permission check. No public exploit has been identified at time of analysis, but an upstream fix exists in pull request #39760 with no released patched version confirmed.

Content exfiltration in django CMS prior to 5.0.9 allows any authenticated staff user holding only page-add permission to read the full plugin content of any page - including restricted, cross-site, and secret pages - by supplying an arbitrary source ID to the page duplication endpoint. The missing object-level authorization check means the only gate (PageAdmin.has_add_permission) verifies only that the user may create pages in general, never that they may access the specific source being copied. Because AddPageForm.save() calls source.copy(..., permissions=False), the resulting duplicate strips view restrictions and becomes readable by anonymous visitors, compounding the confidentiality breach. A detailed proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV.

Missing object-level authorization in django CMS's `render_object_structure` endpoint exposes CMS structure metadata of non-PageContent objects to low-privileged staff users. Any active staff account (is_staff=True) can request the `/admin/cms/placeholder/object/<content_type_id>/structure/<object_id>/` endpoint for frontend-editable objects using PlaceholderRelationField, receiving placeholder slot names, plugin trees, plugin identifiers and labels, and object existence - without holding `cms.use_structure` or any model-level view or change permission. No active exploitation confirmed (not in CISA KEV); a working proof-of-concept using the framework's own FancyPoll test model is documented in GHSA-8qj2-c6q4-f399. EPSS data was not provided, but the staff-gated, read-only nature and requirement for ID enumeration limit real-world impact.

Unauthorized content disclosure in django CMS prior to 5.0.8 allows authenticated staff users to exfiltrate plugin content - including secret text, link names, and URLs - from restricted pages and placeholders they are not authorized to access. The vulnerability resides in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py), where the clipboard copy paths validate only the destination (the user's own clipboard) while accepting attacker-controlled source_placeholder_id and source_plugin_id parameters without any source-side authorization check. No active exploitation is confirmed by CISA KEV, but the technical advisory, patch diff, and regression tests are publicly available via GitHub security advisory GHSA-4xfr-4p46-gc6p.

Unauthorized page-content disclosure in django CMS prior to 5.0.8 allows any staff account to retrieve the plugin structure of view-restricted pages by requesting the render_object_structure endpoint, which omits the user_can_view_page() authorization check enforced by the edit and preview endpoints. Exposed data includes plugin short descriptions - link names, target URLs, and text snippets - constituting genuine content disclosure, not merely structural metadata. No public exploit has been identified at time of analysis; exploitation is constrained to authenticated staff users on sites with per-page view restrictions explicitly configured.

Improper authorization in elunez eladmin versions 2.0 through 2.7 allows low-privileged remote attackers to invoke restricted controller functions - EmailController, AliPayController, GeneratorController, and GenConfigController - without adequate permission enforcement. A publicly available proof-of-concept exploit (GitHub issue #903) lowers the barrier to abuse, and no vendor patch has been issued; the project maintainer has not responded to the disclosure filed via VulDB. No public exploit identified as confirmed actively exploited (not in CISA KEV at time of analysis).

Information disclosure in OpenProject 17.5.1 and earlier allows authenticated non-admin project members to read hidden admin-only custom field comment text by directly requesting the inplace-edit dialog endpoint with a raw custom_field_ identifier. The dialog resolves the field without enforcing the admin_only visibility scope, exposing stored comment content in read-only mode; the custom field value itself and all write operations remain inaccessible. No active exploitation is confirmed and no public exploit has been identified; a vendor patch is available in version 17.6.0.

Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a crafted USB device that triggers instantiation of otherwise restricted USB device types, circumventing the unit's udev-based authorization controls. Firmware version 3.02.00 of the XAV-9500ES is confirmed affected per EUVD-2026-63430. The CVSS 3.0 score of 2.4 reflects the strict physical access requirement and low integrity-only impact; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Improper authorization in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to perform unauthorized grade operations against arbitrary student records by manipulating the student_id parameter in the add_grade function at /index.php. This is a horizontal privilege escalation flaw - an authenticated user (e.g., a student) can affect records they do not own, compromising both confidentiality and integrity of academic grade data. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis, and the CVSS 4.0 score of 5.3 reflects medium severity with limited but real impact.

Insecure Direct Object Reference in ATutor 2.2.4 allows any authenticated user - including students with the lowest privilege level - to permanently delete profile pictures belonging to any other user, including instructors and administrators, by supplying an arbitrary member_id in a POST request to the profile album endpoint. The product is end-of-life with no patch forthcoming, making this a permanent unresolved exposure for any remaining deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, though the exploitation barrier is minimal given only a valid student account is required.

Path traversal in ATutor's error log viewer grants authenticated administrators read access to arbitrary files outside the intended logs directory, up to the web server process's permission boundary. Only version 2.2.4 has been confirmed vulnerable by CERT.pl, though other versions may also be affected. No patch will be issued - the product is end-of-life - making migration or decommissioning the only durable remediation.

ATutor 2.2.4, an end-of-life open-source e-learning platform, allows any low-privileged authenticated user enrolled in a course to bypass authorization controls on the test and question import backend endpoints, enabling unauthorized content manipulation within the course. By directly targeting import endpoints that lack proper authorization checks, a student-level account can import tests and questions they should have no permission to manage. No patch is available and none will be issued, as the product is no longer actively maintained.

Path traversal in ATutor 2.2.4 enables an authenticated low-privilege user to read files belonging to other course directories when the AT_FORCE_GET_FILE configuration option is active, leaking file contents and exposing filesystem structure. The product is end-of-life with no vendor-released patch, making remediation dependent entirely on compensating controls or decommissioning. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Authentication bypass in ATutor 2.2.4 allows unauthenticated remote attackers to impersonate any user, including administrators, by forging auto-login tokens without knowing the target account's password. The auto-login code path contains a token validation check whose required inputs remain uninitialized in certain execution branches, meaning an attacker who can determine a user's identifier and registration timestamp can generate a token the application accepts as legitimate. ATutor is end-of-life with no patch forthcoming; no public exploit has been identified at time of analysis, but the open-source codebase makes the token construction logic fully inspectable.

Missing Authorization in myCred's New User Approve WordPress plugin through version 3.2.8 permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized integrity modifications - most likely manipulation of user registration approval states. Reported by Patchstack and assigned a CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the flaw is exploitable without credentials or user interaction against any WordPress site running the affected plugin. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Incorrect authorization in Checkmk's frozen BI (Business Intelligence) aggregation feature exposes host and service names to authenticated users whose visibility should be restricted. Specifically, users with intentionally scoped permissions can infer the existence and names of hosts and services outside their authorized scope by querying frozen BI aggregations. Affects all 2.2.0 versions and versions prior to 2.3.0p47, 2.4.0p29, and 2.5.0p2. No public exploit code exists and no active exploitation is confirmed; CVSS 4.0 score of 2.3 reflects the constrained, low-impact nature of this information disclosure.

Broken Access Control in the Homlisti WordPress real estate theme (versions ≤ 3.1.2) allows authenticated subscribers to perform unauthorized write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H, AC:L) confirms low-privileged network-accessible exploitation with high integrity impact and no complexity barrier once a subscriber account is held. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.

Broken access control in the Altair WordPress theme (ThemeGoods) through version 5.2.2 permits unauthenticated remote attackers to invoke restricted functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any internet-reachable WordPress installation running the affected theme is exposed. Impact is bounded to partial integrity and availability degradation (C:N/I:L/A:L); no public exploit code and no CISA KEV listing have been identified at time of analysis.

Credential exfiltration in n8n's GraphQL node allows authenticated workflow authors to bypass per-credential allowed-domains enforcement. When the node's Authentication parameter is set to expression mode and two credentials of different types are attached, the platform enforces the domain restriction of only the first credential while silently forwarding secret material from the second to any destination - including attacker-controlled endpoints. No public exploit has been identified at time of analysis, but the CVSS 4.0 subsequent-system confidentiality impact is rated High, reflecting the downstream value of an exfiltrated credential that may carry permissions well beyond the n8n instance.

Cross-project credential reference injection in n8n before 2.34.1 allows low-privileged attackers holding a valid MCP Bearer API key to bypass authorization controls in the create_workflow_from_code MCP tool and embed references to credentials belonging to other projects into workflows they should not control. The bypass is conditional on the credential authentication type being set to 'expression', at which point n8n fails to enforce project-scoped authorization on credential objects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 5.3 reflects a realistic, low-complexity network attack by authenticated users.

Unauthenticated access to form submissions is possible in the Convert Forms extension for Joomla across all versions from 1.0.0 up to but not including 5.2.5, due to missing server-side access control on the front-end Submissions view. Any unauthenticated internet visitor can enumerate and retrieve form submission data without credentials, exposing whatever personally identifiable or business-sensitive information site visitors have submitted through forms built with this extension. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack surface makes this trivially exploitable by any actor who can reach the site.

Unauthorized tag modification in YOOtheme Zoo for Joomla (all versions below 4.1.65) is fully exploitable by unauthenticated network attackers due to a missing ACL enforcement on the comment controller endpoint. Any remote party can send crafted requests to arbitrarily modify content tags without presenting credentials. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified; however, the attack complexity is trivially low given the complete absence of access controls on the affected endpoint.

Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.

Unauthorized file upload in the AI Agent by SiteGround WordPress plugin (all versions through 1.2.7) allows attackers to inject arbitrary images into the WordPress media library by exploiting a missing upload_files capability check in the plugin's REST API endpoint. The endpoint's nonce (sg_ai_studio_gutenberg_nonce) is broadcast to all users with block editor access - including Contributors - making the absent capability check the sole enforcement barrier. No public exploit has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited integrity impact with no confidentiality or availability consequence.

Unauthenticated information disclosure in The Library Corporation LS2 Admin (versions 5.7 through 5.8.0) exposes sensitive administrative export endpoints - including location configuration data - to any remote attacker without credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), confirmed by a CVSS vector of AV:N/AC:L/PR:N/UI:N and the 'Authentication Bypass' tag. A GitHub gist reference may document the technique publicly, though confirmed active exploitation is absent from CISA KEV and EPSS sits at a low 0.17% (6th percentile).

Missing authorization in Splunk AI Toolkit below version 6.0.1 allows any authenticated low-privilege user to delete the experiment history belonging to another user via the REST API. The root cause is a sequencing flaw: the Toolkit executes the deletion operation before verifying whether the requesting user holds permission to delete the target experiment, violating the principle of check-before-act. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.0.1.

Hard-coded and predictable credentials in Splunk AI Toolkit versions below 6.0.0 expose connected container services to unauthorized access by any low-privileged Splunk user. The toolkit generates or stores credentials for its container integrations using predictable or fixed default values, which are retrievable through the AI Toolkit Connections tab without requiring elevated Splunk roles. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but a vendor patch (6.0.0) is available per advisory SVD-2026-0808, reported by Cisco.

FireAMP connector versions below 2.1.15 for Splunk SOAR allow authenticated playbook editors to bypass Safe Mode restrictions by invoking the add listitem action, which the connector manifest incorrectly classifies as read-only despite it performing write operations on file lists. Exploitation requires a high-privilege role (playbook edit/create/run), limiting the attack surface to trusted internal SOAR users. No public exploit code exists and this vulnerability has not been identified in CISA KEV, consistent with its low CVSS score of 2.7.

Splunk SOAR versions below 8.6.0 expose tenant names and identifiers to authenticated users whose roles restrict them to a subset of tenants, due to a REST API authorization enforcement gap. In multi-tenant deployments, a low-privileged user can enumerate out-of-scope tenant metadata - names and identifiers - without triggering any access control check. No active exploitation or public exploit code has been identified; the CVSS score of 4.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequence.

Splunk SOAR versions below 8.6.0 expose a missing authorization flaw in the Playbook History feature that allows authenticated users holding the `playbooks:view` permission to read metadata about playbook repositories they are not explicitly authorized to access. The Playbook History endpoint omits repository-level permission checks before returning revision metadata, enabling unauthorized information disclosure within role-segregated SOAR deployments. No active exploitation has been confirmed - there is no CISA KEV listing and no public exploit code has been identified - and the CVSS base score of 2.7 reflects the high-privilege prerequisite and narrow confidentiality-only impact scope.

Unauthorized information disclosure in Splunk SOAR (On-premises) below version 8.6.0 exposes system health and cluster telemetry to any authenticated user, including those with no assigned role, via the /rest/health REST endpoint. The root cause is a missing authorization check (CWE-862) that validates session authentication but omits role-membership verification before returning restricted operational data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified; vendor patch is available in version 8.6.0 per advisory SVD-2026-0804.

Search Head Cluster member control endpoints in Splunk Enterprise fail to enforce HTTP method-based authorization, allowing a user holding the high-privilege `list_search_head_clustering` capability to send read-typed HTTP requests that alter cluster state and cause a denial of service. Four release branches are affected - 9.4.x, 10.0.x, 10.2.x, and 10.4.x - with fixed versions available from Splunk (SVD-2026-0801). No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; exploitation is constrained to authenticated insiders or post-compromise attackers holding a high-privilege Splunk role.

Remote code execution in Splunk Enterprise 10.4.x allows a high-privilege user with search head cluster (SHC) management rights to write files to arbitrary locations accessible by the Splunk service account via the SHC member bundle REST API. The API fails to enforce authorization boundaries and does not validate bundle paths before accepting content, enabling path-traversal-style writes that can deliver and trigger malicious payloads. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the RCE primitive makes this a meaningful risk in environments running Splunk 10.4 or 10.4.1 where high-privilege insider or compromised-account scenarios are plausible.

Splunk Enterprise contains a stored SPL injection flaw in the Table Editor that allows a lower-privileged 'power' role user to plant risky Search Processing Language commands inside a shared dataset, which then execute silently under an 'admin' user's elevated permissions when that admin opens the dataset's Initial Data step. Affected versions span four release lines: below 10.4.2, 10.2.6, 10.0.9, and 9.4.14. A successful attack exposes all data accessible to the admin and allows modification of Splunk lookup files. No public exploit has been identified at time of analysis, and CISA KEV does not list this vulnerability as actively exploited.

Splunk Enterprise's Table Editor dataset feature permits a 'power' role user to inject attacker-controlled Search Processing Language (SPL) into a shared dataset, which silently executes with admin-level permissions when an administrator opens the dataset. Affected deployments span four version branches: 9.4 prior to 9.4.14, 10.0 prior to 10.0.9, 10.2 prior to 10.2.6, and 10.4 prior to 10.4.2. Because the Table Editor omits SPL safeguards for risky commands during the initial data preparation phase (CWE-863), a successfully phished admin can unwittingly expose all search-head-accessible data and allow limited data modification. No public exploit is identified at time of analysis, and the vulnerability does not appear in CISA's KEV catalog.

Unauthenticated token-signing key reload in Splunk Enterprise 10.4.x (below 10.4.2) exposes a REST API endpoint that lacks the required `change_authentication` capability check, permitting any network-reachable caller to force a key reload cycle without credentials. The flaw is classified under CWE-862 (Missing Authorization) and was reported by Cisco; a vendor patch is available at 10.4.2. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low-complexity, unauthenticated network vector makes opportunistic probing straightforward once the endpoint is known.