Authentication Bypass

Database credential disclosure in Eptura Archibus lets a low-privilege authenticated user retrieve usernames and passwords by submitting a DWR request that names a specific workflow rule; when chained with the companion authentication-bypass flaw, the same primitive enables unauthenticated database reads. The vendor has released a fix referenced by Rapid7, but exploitation requires network reachability to an exposed DWR interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the high confidentiality impact and chainability make this a genuine priority for exposed Archibus deployments.

An authentication bypass in Eptura Archibus lets remote attackers execute workflow rules without any credentials by abusing the product's DWR (Direct Web Remoting) endpoint: a request is crafted so that the unauthenticated isPasswordUppercase method is invoked first and a workflow-rule execution method is chained as the subsequent call in the same request. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, 8.6) reflects a network-reachable, unauthenticated, no-interaction attack with high confidentiality impact and limited integrity impact, plus a scope change because the authentication weakness in the DWR layer lets the attacker reach workflow-rule functionality. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the primary practical constraint is whether the DWR interface is reachable from the attacker's network position.

Unauthenticated remote code execution in MLJAR Mercury deployments running the default tokenless configuration allows any network-reachable client to create a Jupyter kernel and send execute_request messages containing arbitrary Python, resulting in code execution as the Mercury server process user. Mercury versions through 3.2.5 are affected and 3.2.6 is the fixed release; deployments that require a token or password via MERCURY_TOKEN or --token are not exploitable through this path. The issue is assessed at CVSS 9.8, publicly available exploit code exists, but no active exploitation is confirmed (not in CISA KEV).

Unauthenticated remote command execution is possible in MLJAR Mercury 3.0.0 through 3.2.3 because a missing comma in the BLOCKED_PATTERNS list merges the /lab and /api/terminals regular expressions into a single pattern, so requests to /api/terminals no longer match the anonymous-endpoint blocklist and are proxied straight to Jupyter Server's terminal API. An attacker with network access to a Mercury instance that serves dashboards to anonymous users can therefore open an interactive operating-system shell and run commands with the privileges of the Mercury process (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C). All severity signals agree - network reachability with no credentials or user interaction, scope change into the underlying Jupyter Server, and high confidentiality/integrity/availability impact - and the only limiting factor is that the instance must be reachable and running an affected version; no public exploit code or confirmed active exploitation was identified at time of analysis.

Authenticated expression injection in Camunda 7 (7.24.0 through 7.24.13 and 7.23.0 through 7.23.16) lets a user who can reach the ad-hoc task-query API bypass the enableExpressionsInAdhocQueries restriction and execute arbitrary OS commands as the engine service account. The validator does not inspect sub-query expression maps in TaskQueryDto.orQueries, so a crafted JUEL expression can trigger Java reflection and Runtime.exec. Publicly available exploit code exists; the vendor has released fixed versions 7.24.14 and 7.23.17, and CISA KEV status is not indicated.

Missing authorization checks in Camunda 7's engine-rest task sub-resources allow any authenticated user to read, download, or permanently delete task comments and attachments without holding any permission grant on the target task. Versions 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16 are affected; the attacker only needs a valid session and the target comment or attachment object ID. Publicly available exploit code exists and the issue is rated 8.6 under CVSS 4.0, making this a genuine priority for deployments that expose engine-rest.

Missing authorization in CheckCle through 1.6.0 leaves the bundled PocketBase collections publicly accessible, allowing unauthenticated remote attackers to read, modify, and delete monitoring records and extract secrets such as server_token and alert_configurations values. Because the flaw is present in the default shipped schema, any instance with a reachable API endpoint is exposed out of the box; successful abuse can disable alerting, alter status pages, or erase monitoring data. No public exploit was identified at time of analysis, but the default-configuration exposure and high impact justify urgent patching.

Insecure direct object reference in Krayin CRM before 2.2.7 allows an authenticated user with a restricted, per-user data scope to read quotes belonging to other users by querying the quotes search and lead-products endpoints, which fail to apply the per-user scope filter in QuoteController. Successful abuse discloses quote addresses, totals, contact details, and product pricing for any user or lead in the instance. The flaw requires a valid low-privileged account (CVSS v4.0 7.1 as published; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), is read-only with no integrity or availability impact, and has no public exploit identified at time of analysis. Vendor-released patch: 2.2.7.

Missing authorization in RisingWave before 3.1.0 allows any authenticated low-privilege SQL user with CREATE privilege on a schema to create posix_fs sources or fs sinks that point at arbitrary server filesystem paths, enabling theft of credentials and keys and creation of files with the RisingWave process's privileges. The vendor CVSS 4.0 score is 7.1 (High); the prerequisite is only a valid SQL account with schema CREATE, and no user interaction or special victim-side configuration is needed in affected releases. RisingWave 3.1.0 fixes this by gating local filesystem connectors behind frontend.unsafe_enable_local_fs_connector, which defaults to false in release builds; no public exploit code or active exploitation is identified in the supplied intelligence.

Apache Camel's camel-oauth route guards fail open: when authentication cannot be completed, the OAuthBearerTokenProcessor and OAuthCodeFlow processors set an error status and body but never stop the exchange, so the request falls through and continues into the protected part of the route as if the caller had authenticated. Camel 4.11.0 through 4.18.4 and 4.19.0 through 4.22.0 are affected wherever camel-oauth is used to protect an HTTP-reachable endpoint, and exploitation needs no credentials, user interaction, or special configuration - simply omitting the Authorization header, sending a non-Bearer header, presenting an invalid token, or arriving without an authorization code is enough (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, 8.2). The gap is a confidentiality problem first and foremost, exposing whatever the protected route returns, with limited integrity impact; no public exploit identified at time of analysis, and the vendor-released patch is 4.23.0, with backports in 4.18.5 and 4.22.1.

MISP before 2.5.48 discloses proposal (shadow attribute) records to authenticated users whose sharing group is attached to the target attribute or object, because the visibility logic accepted any matching sharing group without confirming that the attribute was actually distributed at sharing-group level. The exposure is read-only - an attacker learns proposed attribute changes they should not see - and requires a valid MISP account plus an existing sharing-group overlap with the targeted data; a separate defect also blocked the owning organisation from viewing proposals on its own org-only attributes. No public exploit identified at time of analysis, and the vendor has released a patch in 2.5.48 (commit 9c5af321f).

Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 allows remote attackers to self-enroll into the mesh and invoke arbitrary tools across every connected MCP backend node. The control plane exposes GET /info publicly, auto-enrolls any valid OIDC token holder via POST /register without claim filtering or ban checks, and ships a default policy binding sam:system:authenticated to wildcard services and targets, so a token holder can obtain a mesh credential with full read, write, and execution access. No public exploit code or active exploitation is confirmed at time of analysis, though the CVSS vector is PR:N and practical risk depends on whether the configured OIDC provider lets an attacker self-obtain a valid token; upgrading to 0.1.0-alpha.9 enforces fail-closed defaults, explicit policy-binding requirements on enrollment, and ban checks.

Unauthenticated remote libp2p peers can bypass Biscuit capability policy enforcement in Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 and 0.1.0-alpha.2 through the /libp2p-http ingress server, invoking arbitrary registered backend services including command/stdio-backed MCP servers, A2A, and inference endpoints. The defect is a missing-authentication and missing-authorization flaw in StartIngressServer (cmd/sam-node/node.go): unlike the MCP stream handler, the ingress path routes requests to backend handlers without verifying a Biscuit token or mesh enrollment. CVSS 4.0 scores this 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H); no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released a fixed version.

Privilege escalation in ProjectSend 2.0.0 through 2.6.x allows a holder of a restricted API token to reset its own owner's password and disable the owner's two-factor authentication, then log in interactively with the owner's full role permissions. The weakness is an incorrect authorization decision in the users API: a token scoped only to manage_users and edit_users can issue PATCH /api/v1/users/{user} against the token owner's account even though the web interface requires the current password for such self-service credential changes. Exploitation requires an already-provisioned, privileged-but-restricted API token (authenticated, PR:H); no public exploit code or confirmed active exploitation was identified at the time of analysis, and version 2.7.0 contains the fix.

Missing authentication in Vanus 0.8.0 through 0.9.0 allows unauthenticated remote attackers to publish forged CloudEvents into any eventbus through the gateway's CloudEvents HTTP receiver. Attackers can target /namespaces/{ns}/eventbus/{name}/events or the legacy /gateway/{name} path, bypassing token authentication and authPublish checks, so injected events are stored and delivered to subscription sinks. No public exploit code was identified at time of analysis, and the impact is bounded to event-stream integrity rather than data disclosure or denial of service.

Authorization bypass in the Electronic Signature Add-on for Fluent Forms (signature-fluent-contract-forms-add-on) through version 2.0.5 allows remote attackers to read other users' signature and contract records by substituting a user-controlled object identifier in a plugin endpoint. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, base 7.5) describes network-reachable, low-complexity access with high confidentiality impact but no integrity or availability impact; the PR:N/UI:N values indicate no authentication or interaction is claimed to be required, though that assumption should be verified against the plugin's access model. This is a CWE-639 IDOR-style flaw; no public exploit was identified at time of analysis.

Information disclosure in Admidio 5.0.11 through 5.0.15 allows authenticated users to read every inventory item record and keeper name even when the inventory module is administratively disabled. Any valid login is sufficient, including ordinary members or self-registered accounts where open registration is enabled, because modules/inventory/inventory_data.php does not re-check inventory_module_enabled before returning the DataTables JSON feed. No public exploit code has been identified at time of analysis, and the vendor has released Admidio 5.0.16 to correct the access-control gap.

Authenticated members can overwrite other users' forum topic titles and first posts in Admidio 5.0.0 through 5.0.15 because ForumService::saveTopic() fails to verify that the supplied topic_uuid belongs to the requester. The flaw is an insecure direct object reference (CWE-639) reachable over the network with low privileges (PR:L) and no user interaction; impact is integrity-only, with no confidentiality or availability effect per the assessed CVSS 3.1 vector. No public exploit was identified at time of analysis, and the vendor addressed the missing ownership check in 5.0.16; this is a genuine but moderate-priority authorization flaw, not a critical one.

phpMyFAQ 4.0.0 through 4.1.8 allows unauthenticated remote attackers to take over arbitrary user accounts through its WebAuthn/passkey registration flow. The registration endpoint attaches a new passkey to a staged username without requiring an existing session or validating the WebAuthn challenge, so a forged fmt=none attestation can register an attacker-controlled credential; subsequent passkey login bypasses password and TOTP checks. No public exploit code was identified at time of analysis, and affected instances should be upgraded to 4.1.9 or later.

phpMyFAQ releases before 4.1.9, and 4.2.0-alpha builds before 4.2.0-beta, expose attachments belonging to restricted FAQ records through attachment.php, which verifies only that the caller may download attachments in general rather than that the caller may see the FAQ record owning the requested file. Any authenticated account holding the dlattachment right can enumerate attachment IDs and retrieve confidential files, and anonymous visitors can do the same when the administrator has enabled the non-default allowDownloadsForGuests option. The reporter rates it 7.1 under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VC:H), while the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H with confidentiality-only impact and no effect on integrity or availability; no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta allows authenticated users holding the global edit_faq permission to modify restricted FAQ entries through the PUT /api/v3.1/faq/update endpoint without object-level access checks. An attacker with such an account can change content, bypass moderation, and alter publication state for FAQs they cannot view; the risk is conditional on broad edit_faq grants and REST API exposure. The issue is rated CVSS 8.7 (v4.0) and no public exploit identified at time of analysis.

phpMyFAQ versions 3.2.0 through 4.1.8 and the 4.2.0-alpha pre-release line before 4.2.0-beta expose an insecure direct object reference in the admin API endpoint GET /admin/api/user/data/{userId}, allowing a delegated administrator with user-management rights to read another user's full faquserdata row, including a live TOTP secret. The flaw is privilege-gated rather than anonymously exploitable: an attacker must already hold an authenticated backend account with delegated user-management permissions, but can then undermine two-factor authentication for a targeted privileged account by generating valid TOTP codes. No public exploit identified at time of analysis; the primary risk is to installations that delegate user administration to non-SuperAdmin accounts.

Account takeover in phpMyFAQ's Keycloak single sign-on integration allows a holder of a Keycloak identity whose preferred_username collides with, or whose unverified email matches, an existing local phpMyFAQ account to bind that local account to their own Keycloak subject and inherit its privileges, including superadmin. Only pre-release builds from 4.2.0-alpha up to but not including 4.2.0-beta are affected, and exploitation additionally requires Keycloak to be explicitly configured as an identity provider with the /auth/keycloak/authorize flow and implicit account linking active, so the realistic attack surface is limited to non-default test and staging deployments (CVSS 4.0 base 7.7; PR:L, AC:H, AT:P per the assessed vector). No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.

An authorization bypass in phpMyFAQ 4.2.0-alpha (fixed in 4.2.0-beta) lets category-restricted editors in 'medium permission mode' manage attachments belonging to FAQs outside their assigned categories by supplying arbitrary record_id or attachment IDs to the upload and delete endpoints. An attacker who already holds a legitimate but limited editor account can therefore upload, tamper with, or delete files on unauthorized FAQs, affecting attachment integrity and, to a lesser extent, availability, with no confidentiality exposure. The flaw requires authenticated editor credentials (PR:L) and is not reachable by anonymous users; no public exploit code has been identified at time of analysis.

Account takeover in phpMyFAQ (3.2.0 to before 4.0.0, and 4.0.2 to before 4.2.0-beta) lets an authenticated attacker who controls an identity in the configured Microsoft Entra ID tenant hijack an existing local account, including super-admin, by presenting a preferred_username that exactly matches that account. The flaw exists because the Entra ID login handler links users by the mutable preferred_username claim and AuthEntraId::create() ignores the duplicate-login exception, continuing with the pre-existing local account instead of failing closed. Exploitation is conditional - the instance must have Entra ID SSO enabled and the attacker must already possess valid tenant access (PR:L) plus an exact username match - and no public exploit code has been identified at time of analysis.

phpMyFAQ instances using Keycloak or Entra ID OIDC SSO can issue a fully authenticated session without enforcing TOTP for accounts that have 2FA enabled, including administrator accounts. The flaw affects 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta and requires a valid or phished IdP identity already linked to the target account; no public exploit was identified at time of analysis. It is a genuine CWE-287 authentication bypass rated CVSS 8.6, but exploitation is gated by that linked-identity prerequisite rather than being a mass unauthenticated attack.

WP Booking System through 2.1.0.3 can disclose stored booking-notification email bodies to an authenticated Subscriber-level user because the plugin fails to verify authorization before returning log data keyed by booking_id and email_log_id. The exposed content includes customer PII such as names, email addresses, phone numbers, messages, and booking dates, but the flaw is read-only and does not permit data modification or code execution. The published vector claims PR:N, while the independent assessment corrects this to PR:L (a low-privilege account is required, trivial on sites with open registration); no public exploit identified at time of analysis.

LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered email address or phone number to bypass OTP authentication by racing the attempts counter and brute-forcing the 6-digit code, potentially taking over that customer's account, bookings, and personal data. Exploitation requires the site to use LatePoint's OTP/passwordless login flow and the attacker to win a concurrency race while guessing the code; no public exploit identified at time of analysis.

Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.

A previously paired Moonlight client that still holds its private key can bypass Sunshine's 'Disable' control and regain GameStream access by presenting an alternate certificate derived from its stored paired certificate. Affected builds (2026.329.165800 through pre-2026.906.222525) validated only that the presented certificate chained to a stored paired-client anchor and compared certificate text without canonicalizing equivalent PEM encodings, so the server never confirmed the connection came from the exact enabled paired identity. This is CWE-863 (Incorrect Authorization) and carries CVSS 3.1 base 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L); the vector's PR:L aligns with the requirement for a previously paired client identity, no public exploit code was identified at time of analysis, and removing (rather than merely disabling) the paired client severs the trust relationship.

Missing authorization checks in ERPNext versions prior to 15.121.0 and 16.34.0 let any authenticated user with a low-privilege role invoke state-changing whitelisted endpoints - such as Ledger Merge, Process Period Closing Voucher start/pause/cancel, Repost Payment Ledger, Delivery Note sales return, payment order, and bulk transaction processing - without the write, submit, cancel, or role permissions those operations should require, allowing tampering with financial and transactional records beyond the user's assigned role. The flaw is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so exploitation requires a valid low-privileged account but no admin rights, no user interaction, and no non-default configuration; integrity impact is high while confidentiality is unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the attack surface is standard functionality present in every affected deployment, so multi-user or internet-exposed instances should treat this as high priority. Vendor-released patch: 15.121.0 and 16.34.0.

Argument injection in the Claude Agent SDK for Python (claude-agent-sdk) before 0.2.121 allows remote attackers to achieve arbitrary command execution when an embedding application passes untrusted input into the SDK's `resume` option. Because `--resume` is declared by the Claude CLI with an optional value, a session identifier beginning with `-` is parsed as a separate CLI flag rather than the option's value, letting an attacker inject `--mcp-config` and register a stdio MCP server that executes arbitrary commands at CLI startup while bypassing the SDK's permission controls. The assessed CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates no authentication is required but exploitation is high-complexity and conditional on the host application forwarding attacker-controlled data as the session ID; a vendor patch is available as version 0.2.121, and no public exploit code was identified at time of analysis.

Broken object-level authorization in Tandoor Recipes before 2.6.12 lets an authenticated member of the same Space, holding read and write API scope, read and silently alter another member's private recipe instructions and ingredients by supplying those private step or ingredient identifiers to the Step/Ingredient API. The affected sub-resource ViewSets (StepViewSet, IngredientViewSet) filter only on active Space and apply role-level CustomIsUser checks instead of the private-recipe owner/sharing predicate, so a co-tenant is accepted without recipe-level authorization. No public exploit code has been identified at time of analysis, and the flaw requires legitimate write-scoped credentials in the victim's Space; it is fixed in version 2.6.12.

An authenticated member of a shared Space in Tandoor Recipes prior to 2.6.10 can reach another member's private recipes - including reading private recipe files, sending those file bytes to the configured AI provider, and generating external or public share links - by supplying the victim's recipe identifier to the api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, or api/share-link/ endpoints, because those flows retrieve Recipe objects without invoking the private-recipe owner/sharing check (CustomRecipePermission). The prerequisite is an account already inside the same shared Space (Space sharing must be enabled) plus knowledge or enumeration of the target recipe ID, so single-user or non-shared deployments are not exposed; scoring is CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) with confidentiality as the dominant impact and no public exploit identified at time of analysis. The issue is fixed in 2.6.10.

Missing authorization in LingGuo-Drama through commit 8a6924a allows any authenticated self-registered user to fully manage all accounts via the /admin/v1/admins API. The API trusts any valid AuthAdminJWT without verifying the caller's authority level, enabling attackers to read every account's bcrypt hash, reset the bootstrap administrator's password, raise their own authority_id, and delete accounts. This is a genuine, high-priority access-control flaw (CVSS 8.7) with no public exploit identified at time of analysis; exploitation requires only that self-registration is enabled and the service is network-accessible.

Broken access control in LingGuo-Drama at and through commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed lets any self-registered, low-privilege user read, overwrite, reassign, or delete other users' short-drama projects by iterating numeric IDs against the admin API endpoints GET, PUT, and DELETE /admin/v1/projects/:id. The root cause is CWE-639: the projects.Get helper omits an owner check, so the object identifier supplied by the caller is trusted without verifying that the authenticated principal owns the referenced project. Exploitation requires an authenticated account (CVSS PR:L, obtainable through self-registration where enabled) and network reach to the admin API; no public exploit identified at time of analysis, and there is no KEV entry or EPSS signal to suggest active exploitation in the wild.

Unauthenticated remote attackers can retrieve full payment records from Roncoo-pay by exploiting a missing authorization check in the F2FPayController.orderQuery endpoint. The vulnerability (CWE-306) allows access to any merchant's transaction data if the attacker can guess or enumerate a valid transaction number, which follows a predictable format ('7' prefix plus a snowflake ID). No public exploit code is known at this time, and exploitation requires network access to the web gateway and successful guessing of a transaction number, making it a complexity-limited information-disclosure issue.

Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.

Unauthenticated attackers can export all users' chat logs from 99AI 4.3.0 and earlier by sending a POST request to the /api/chatLog/exportExcel endpoint, which lacks any authentication guard (CWE-306). The vulnerability allows remote retrieval of xlsx files containing usernames, emails, prompts, and AI answers without credentials or user interaction, and affects any network-reachable instance with no special configuration. No public exploit code has been identified at time of analysis, but the exposure is high-risk because it leaks sensitive conversation data.

Missing authentication in LangChat lets unauthenticated remote attackers reach the application's REST controllers, because a default deployment up to commit 2a6285a never registers a Sa-Token interceptor. Calling endpoints such as /api/v1/auth/users returns user records containing plaintext passwords, and the same absent authorization check lets an attacker read LLM provider API keys, create super-admin accounts, and modify or delete stored data. The independent assessment scores this 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) with no special conditions beyond network reachability; the technical detail is publicly documented, but no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.

An insecure direct object reference (IDOR) in ChatOllama (sugarforever/chat-ollama) through commit 96c3ce5 lets remote attackers read other users' private knowledge bases by supplying sequential integer identifiers. According to the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with no integrity or availability impact, base 8.7), the exposure is a network-reachable, low-complexity, read-only disclosure that requires no privileges or user interaction, although defenders should confirm whether their deployment actually enforces authentication in front of the API. Affected endpoints are GET /api/knowledgebases/{id} and the knowledgebaseId parameter of POST /api/models/chat; the impact is limited to metadata and retrieved document content of other tenants, with no write or denial-of-service component. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary risk driver is the predictable, non-tenant-scoped ID space rather than a remotely weaponized exploit.

Missing authentication in the OtterMind Nubase storage-object API (versions through 0.1.4) lets remote attackers download and delete objects held in private buckets without supplying an apikey or JWT. The UnifiedMultiTenancyFilter treats the route /storage/v1/object/{bucketId}/{path} as public for every HTTP method, so any request reaching that endpoint bypasses tenant authorization entirely; per the independent assessment the impact is a high-confidentiality, low-integrity/availability compromise (CVSS:3.1 8.3-equiv, AV:N/AC:H/PR:N/UI:N/C:H/I:L/A:L), gated only by the attacker's prior knowledge of a valid tenant subdomain, bucket id and object path. No public exploit code or CISA KEV entry was identified at time of analysis, and no vendor-released patch is confirmed.

HUIZHI ChargeOS cloud through version 3.0.9 fails to bind the caller-supplied userId parameter in the hcp-mp PayController.xcxRecharge endpoint to the identity of the authenticated member making the request, so any low-privilege member or mini-program account (PR:L per the CVSS vector) can arbitrarily credit or reduce any other member's wallet balance without any payment and consume charging services for free. The issue is a CWE-639 authorization bypass through a user-controlled key, scored 7.1 by the reporter and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, meaning network reachable, no user interaction, and pure integrity impact on wallet balances with no confidentiality or availability effect. No public exploit identified at time of analysis, although a public technical writeup of the IDOR and the affected Java source are both linked in the references, and no vendor-released patch has been identified, so any internet-exposed instance at or below 3.0.9 whose member API is reachable and where a member account can be obtained should be treated as at risk.

HUIZHI ChargeOS cloud deployments through version 3.0.9 expose other members' wallet balances, credit, profile and charging-order records to any authenticated member account, because the hcp-mp MeController and OrderController trust client-supplied userId, openId and orderNumber parameters instead of deriving identity from the session. The CVSS 4.0 base score is 7.1 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a genuine but bounded confidentiality-only risk: a low-privileged authenticated user (any registered member, no admin role) can enumerate sequential member IDs against endpoints such as /me/getMemberBalanceByUserId and /order/orderDetail to read arbitrary members' data, with no modification or denial-of-service capability. There is no CISA KEV confirmation of active exploitation and no public exploit code identified at time of analysis, although a public technical writeup of the flaw and the vulnerable source files are referenced; exploitability is gated on first obtaining one valid member credential.

Authentication bypass in the DataBuff ai-apm-web module through version 0.1.10 lets unauthenticated remote attackers forge administrative JWT session tokens because the application ships and consumes a hardcoded HMAC signing secret ('dev-secret') in JwtTokenService. An attacker who knows that default key can mint a token claiming the admin role with a future expiry and gain full administrative access to protected /webapi routes, most critically the Doris SQL query API, yielding high confidentiality, integrity, and availability impact (vendor score 9.3; independently assessed CVSS:3.1 base 9.8 with PR:N, no privileges or user interaction required). Exploitation is conditional on the deployment retaining the shipped default secret: any instance that has replaced it with a unique strong value is not exploitable through this path. This CVE is not listed in CISA KEV and no public exploit code was identified at time of analysis, though a third-party technical write-up describing the flaw is publicly referenced; note that classic HS256/JWT signing bypasses are trivial to script once the key is known, so the absence of a packaged exploit should not be treated as meaningful protection.

Authentication bypass in WIMOOR through commit ec86736 allows remote attackers to impersonate any tenant and privilege level by forging an unsigned X-USERINFO header, enabling read and modification of other tenants' orders, finance data, and Amazon seller authorizations. Exploitation requires direct network access to backend service ports, bypassing the API gateway that normally signs the header; deployments where backend ports are segmented/firewalled are not exploitable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) captures this high-severity impact but gated by network positioning, and no public exploit has been identified at time of analysis.

Authentication bypass in Simple Admin Core through v1.8.7 lets unauthenticated remote attackers forge a valid super-administrator JWT by signing it with the hard-coded Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) shipped in api/etc/core.yaml, then set roleId 001 to obtain full administrative control over users, roles, menus, API authorities, configuration and token issuance. Exploitation requires only network reach to the core API (default port 9100) against a deployment that still runs the vendor's default secret - no credentials and no user interaction - and the CVSS 4.0 base score is 9.3, corroborated by the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (unauthenticated, network-exploitable, full confidentiality/integrity/availability impact). No public exploit identified at time of analysis, although a public technical writeup detailing the bypass exists, and deployments that rotated AccessSecret to a private value before deployment are not exploitable via forged signatures.

Cross-tenant authorization bypass in Magistrala through 1.0.0 allows any authenticated member of a workspace to view, issue, and revoke device certificates belonging to other tenants by supplying foreign serial numbers or entity/device IDs to the certs service (RevokeBySerial, RevokeAll, ViewCert, ListCerts, IssueCert). A successful attacker can disconnect other tenants' devices, disclose their certificates, and mint CA-signed certificates for arbitrary device IDs, giving high integrity and availability impact with limited confidentiality exposure (assessed CVSS:3.1 base 7.2, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H). Exploitation is not pre-authentication, and no public exploit was identified at time of analysis; the practical risk is greatest on multi-tenant deployments that actively use the certificate service.

EFAK 5.0.0 through 5.1.0 exposes stored LLM provider API keys to any authenticated user holding the lowest-privilege ROLE_USER account, because the /api/model-config/page and /api/model-config/{id} REST endpoints are not covered by the admin authorization gate implemented in WebSecurityConfig. A successful query returns the provider keys unmasked, letting a low-privilege account reuse those credentials against external LLM providers, run up charges on the victim's account, or pivot into provider-side resources. Exploitation requires a valid non-anonymous account (PR:L per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N vector) and a deployment that actually stores LLM provider keys, so multi-user or multi-tenant installations with self-provisioned accounts carry the highest risk while single-admin deployments without configured keys are effectively unexposed; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.

Privilege escalation in EFAK (Eagle for Apache Kafka) through 5.1.0 lets any authenticated low-privilege user grant themselves ROLE_ADMIN, create new administrator accounts, or delete existing users by sending POST, PUT, or DELETE requests to the /api/users endpoints, which are handled by UserController but never restricted to administrators by WebSecurityConfig. Exploitation is not pre-authentication and requires a valid low-privilege EFAK account (CVSS PR:L), but there is no user-interaction requirement and standard configurations are affected; no public exploit identified at time of analysis. Success yields full administrative control over the Kafka clusters that EFAK manages, with high confidentiality, integrity, and availability impact, and urgency rises sharply in deployments allowing self-registration or shared low-privilege logins.

Cross-team authorization bypass in APIPark through 1.9.7-beta allows an authenticated team manager to read, modify, and delete services and applications belonging to other teams by supplying their own team identifier in the 'team' query parameter to /api/v1/service/info and /api/v1/app. Exploitation requires a valid team-manager account on an instance configured with multiple teams; the attacker first enumerates foreign service and app IDs via /api/v1/simple/services and /api/v1/simple/apps, and no user interaction or non-default settings are needed. The vendor CVSS 4.0 base score is 7.2 (High) with low confidentiality and high integrity/availability impact on other teams' resources, and no public exploit identified at time of analysis, though a public technical writeup documenting the bypass exists.

Unauthenticated account takeover in IceCMS through 4.1.5 allows remote attackers to modify, disable, or delete any account, including administrators, by sending PUT requests to /User/updateUser and setting a new password and role for an arbitrary userId. The root cause is that the /User/** path is excluded from the Shiro JWT authentication filter, so no valid session, token, or credentials are required when the backend user-management endpoints are reachable. It is critical severity (CVSS 9.3; independently assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit identified at time of analysis.

Cube-studio instances through version 2026.09.01 let any authenticated, low-privileged user act on other tenants' notebooks and inference services by supplying another user's object id to lifecycle endpoints (stop, reset, clear, redeploy) in view_notebook.py, view_inferenceserving.py and view_serving.py, allowing pod deletion and taking production inference endpoints offline. The CVSS 4.0 score of 7.1 (PR:L, VI:L, VA:H, VC:N) and CWE-639 classification describe a bounded cross-tenant authorization flaw in the data-infra/cube-studio product rather than a confidentiality breach. No public exploit code or active exploitation has been confirmed (no public exploit identified at time of analysis), though a public technical writeup describing the IDOR exists.

Authenticated users in multi-tenant Risesoft Digital-Infrastructure deployments through 9.6.11 can export another tenant's personnel directory through the log module DownloadController endpoints exportLoginXLS and exportNotLoginXLS. The flaw is a missing-authorization/IDOR issue: a low-privilege account changes the tenantId parameter to a target tenant's value and receives XLSX files containing names, login names, organization paths, mobile numbers, and email addresses. This is a confidentiality-only cross-tenant data exposure rated CVSS 4.0 7.1 (HIGH); no public exploit was identified at time of analysis, and single-tenant deployments are not affected.

Unauthenticated configuration takeover of ChronoFrame 1.0.0 and earlier lets any attacker who can reach the HTTP service POST to the setup-wizard API and repoint instance storage to an attacker-controlled S3 or OpenList backend while overwriting site and map settings. The flaw covers every release through 1.0.0 (CPE cpe:2.3:a:hoshinosuzumi:chronoframe:*:*:*:*:*:*:*:*) and remains exploitable on instances where initial setup is already complete, because the /api/wizard/ handlers enforce neither authentication nor a setup-complete check. No public exploit identified at time of analysis and no CISA KEV entry, though a public technical writeup describes the attack path; the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates this high priority for any network-exposed deployment.

Authenticated users of Rocboss paopao-ce through 0.6.0-alpha.3 can obtain signed download URLs for other users' private, friend-only, and following-only media by requesting arbitrary content IDs from the /v1/attachment endpoint. Because post_content IDs are sequential, an ordinary registered low-privileged account (no administrative role required) is enough to enumerate IDs and harvest images, videos, and attachments belonging to other users, giving a high confidentiality impact with no write or availability effect. This is a genuine but bounded data-confidentiality issue rather than a critical infrastructure threat; no public exploit code was identified at time of analysis, although a public technical write-up describing the cross-user IDOR is referenced.

Unauthenticated stored-file disclosure in SurveyKing before 1.13.0 lets remote attackers download arbitrary attachments by calling GET /api/public/preview/{attachmentId}, bypassing the shared, owner, and project authorization checks that FileServiceImpl.loadFile is supposed to enforce. No authentication (PR:N), user interaction, or non-default configuration is required - the endpoint is public by design - but there is no file-listing capability, so success depends on knowing or deriving a valid snowflake attachment ID, which is time-ordered and only partially predictable (reflected in the assessed AC:H/AT:P). The result is a genuine but conditionally gated confidentiality risk rather than a mass-exploitation emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though a vendor patch exists and the exposure is high-severity (CVSS 4.0 8.2; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Unauthenticated configuration write in Misaka Danmu Server 2.8.9 and earlier allows remote attackers to bypass authentication entirely and gain administrative access by abusing the unprotected POST /api/ui/config-history/rollback endpoint. An attacker can write arbitrary configuration keys, such as setting ipWhitelist to their own /32 address, modifying trustedProxies, or altering webhookApiKey, which then grants access to every protected endpoint as the administrator. The flaw carries a critical severity rating (CVSS 4.0 base score 9.3; independent assessment confirms a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires only network reachability of the web API - no authentication, user interaction, or non-default configuration is needed. No public exploit identified at time of analysis.

Unauthenticated attackers can obtain a valid JWT session for any account - including superusers - in FastapiAdmin through 3.0 by abusing auto-login endpoints that ship without authentication checks. The attack chain is straightforward: enumerate accounts via /api/v1/auth/auto-login/users, mint a superuser auto-login token, then exchange that token for a full JWT session granting complete administrative control of the application. Exploitation requires only network reachability to the admin API with no credentials, no user interaction, and no non-default configuration, and the referenced public writeup also notes a hardcoded JWT signing secret that further undercuts token-based defenses; no vendor-released patch was identified at time of analysis, and no public exploit code was confirmed.

Account takeover of Google-linked bbs-go users is possible because the /api/login/google_one_tap endpoint accepts any Google-signed ID token without ever validating its audience (aud) claim, so the login handler trusts tokens minted for OAuth clients other than the site's own. An attacker who operates their own Google OAuth client can get a victim to sign in at an attacker-controlled property, capture the resulting Google-signed ID token, and replay it against bbs-go to obtain an authenticated session tied to the victim's Google-linked account (CWE-287). The flaw affects bbs-go through version 4.4.6 on instances where Google One Tap login is enabled and the target account is Google-linked; no public exploit identified at time of analysis, although a public technical writeup of the audience-confusion technique is referenced, and exploitation requires victim interaction to obtain a valid token.

Authenticated non-admin users of sshportal's management shell can retrieve decrypted backend SSH private keys through the 'key show' command, allowing them to connect directly to managed hosts and bypass ACLs and session recording. The flaw affects sshportal through version 1.19.5 and requires only a valid non-admin account with management shell access; default deployments are impacted because predictable key names such as 'default' and 'host' are commonly present. No public exploit code or confirmed active exploitation was identified at time of analysis, but the CVSS 4.0 score is 8.3 (High) and our assessment rates it as a medium-to-high priority for shared multi-user bastion deployments.

Authentication bypass in OpenBMB StaffDeck through 0.5.6 lets unauthenticated attackers forge valid administrator session tokens by signing an HMAC-SHA256 token with the hard-coded default app_secret shipped in backend/app/config.py, targeting the seeded 'admin' user in the 'tenant_demo' tenant. Successful exploitation grants full tenant administration, including access to stored model and channel credentials; the assessed CVSS 3.1 score is 9.2 (Critical) with AV:N/PR:N/UI:N but AC:H/AT:P, because only deployments that have not rotated the default secret and that still retain the demo tenant and admin account are affected. No public exploit identified at time of analysis, and no CISA KEV entry or vendor-patched version was provided in the source data.

Authentication bypass in ZKEACMS through 4.4 allows unauthenticated remote attackers to forge their own admin-level REST API JSON Web Tokens, because the HMAC-SHA256 key used to validate bearer tokens is hard-coded in JwtBearerDefaults.cs and is therefore identical on every installation. An attacker who signs a token with the Name claim set to 'admin' can call ApiAuthorize endpoints to modify articles and products and to read submitted form data, producing high integrity impact with limited confidentiality exposure (vendor CVSS 4.0 score 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, i.e. unauthenticated and network-reachable). Neither CISA KEV nor a packaged exploit was reported in the provided intelligence, but the signing key is published in the project's public source repository and a public write-up describes the technique, so forgery is trivial for anyone who can reach the API; the main practical limiter is whether the REST API is exposed.

An authorization bypass in HestiaCP before 1.10.5 lets an authenticated administrator who is not the protected ROOT_USER impersonate that account through the built-in 'loginas' parameter and then submit write requests, such as a POST to /add/cron/, that the application erroneously executes because the read-only flag is never validated. The practical result is command execution as the protected administrator's system account, since crond runs the injected job, giving high confidentiality, integrity, and availability impact. Exploitation requires a valid admin-level account on an installation with more than one admin and a protected ROOT_USER to shield; the vector is CVSS 4.0 AV:N/AC:L/PR:H/UI:N (vendor 8.6) and the independent assessment concurs, with patch available. No public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated attackers can seize full administrative control of Webreaper Damselfly deployments through version 4.5.3 because the authorization attributes on the REST API controllers were shipped commented out, leaving every /api/* route reachable without credentials. An attacker can send PUT /api/users with an Admin role to create their own administrator account, or POST /api/users to reset any existing user's password, then use that access to read, modify, or destroy the entire photo library and its configuration. The flaw is rated CVSS 4.0 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H) and classified as CWE-306; no public exploit identified at time of analysis, although a public technical writeup of the missing authorization, the upstream GitHub issue, and a VulnCheck advisory are referenced.

Insecure direct object reference in DataCap (the MetaForge data platform) through 2025.1.1 allows any authenticated, low-privileged user to read other users' datasources, snippets and dashboards by iterating numeric auto-increment ids on the source, snippet and dashboard getById endpoints, with serialized datasource responses exposing host, port, username and cleartext passwords. Exploitation needs only a valid ordinary account and network reachability to those endpoints - no administrator role and no non-default configuration - so the realistic threat model is a malicious or compromised low-privilege tenant on a multi-user deployment, with high confidentiality impact but no integrity or availability impact. The provided score is 7.1 (independent CVSS 3.1 assessment: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N); no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, making this a credible mid-tier priority rather than a drop-everything emergency.

Unauthenticated JDBC URL injection in the AllData data-dts component through version 0.7.1 allows any remote attacker who can reach the /jobJdbcDatasource/test endpoint to force the server to open an arbitrary database connection by supplying attacker-controlled jdbcUrl and jdbcDriverClass values. By pointing that URL at an attacker-hosted MySQL server with allowLoadLocalInfile=true, an attacker can abuse MySQL's LOCAL INFILE handling to read files from the data-dts host, giving high confidentiality impact (VC:H, VI:N, VA:N per our assessment) with no authentication required (PR:N, CWE-306). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; risk is concentrated in deployments where data-dts is network-exposed, and disclosure is limited to files readable by the data-dts process account.

Authenticated merchant-portal users on Jeepay through 3.2.9 can overwrite another merchant's payment channel configuration - signing keys, certificates and fee rates - through an insecure direct object reference in the POST pay-config endpoint handled by MchPayInterfaceConfigController.saveOrUpdate, allowing the attacker to break or redirect the victim merchant's payment processing. Exploitation requires only a valid merchant account holding the default ENT_MCH_PAY_CONFIG_ADD permission (granted by default, no non-default configuration) plus knowledge or enumeration of the victim merchant application's infoId, with no user interaction. The issue is a bounded multi-tenant isolation / malicious-insider risk that is most impactful on shared Jeepay deployments serving multiple independent merchants and largely irrelevant on single-tenant installations; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.

Authenticated account takeover in Huly Platform through 0.7.432: the mergeSpecifiedPersons account RPC lacks any authorization or workspace-role check, so any logged-in user - not just a workspace Maintainer - can merge arbitrary person records. An attacker who knows the victim's person UUID and an attacker-controlled person UUID can graft an attacker-owned, unverified but login-capable social id onto the victim person and then complete the takeover through the normal login or password-recovery flow. Vendor patch is available (upstream commit afe11faec1b56f278c0882355a69b08cff1eebd9); no public exploit identified at time of analysis, and real-world risk is bounded by the PR:L prerequisite plus the need to obtain two UUIDs, making instances with open self-service registration the highest-exposure targets.

Cross-workspace authorization bypass in Jpom through 2.11.12 (CWE-639, IDOR) lets any authenticated user who holds SSH file permissions in one workspace read, modify, or delete files on SSH hosts that belong to a different workspace. The flaw resides in SshFileController, where the caller-supplied SSH asset id is used to resolve the target host without verifying that the asset actually belongs to the caller's workspace, so the reachable endpoints (download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json, new_file_folder.json) operate on foreign assets. Exploitation requires a multi-workspace deployment with at least one SSH host asset outside the attacker's workspace and knowledge or enumeration of that host's asset id; no public exploit code is confirmed at time of analysis, though a public technical write-up (linked from the CVE record) explains the technique, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation. Assigned CVSS 4.0 base 8.6 (with our 3.1 assessment at AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact while the CVSS 4.0 vector shows no availability impact.

FreeRTOS-Kernel V11.3.0 and V11.3.1 contain an incorrect-authorization flaw (CWE-863) in the Memory Protection Unit port for the Arm Cortex-R82 (Armv8-R AArch64), allowing an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it via a buffer argument passed to an MPU system call. Exploitation is strictly local: the attacker must already be able to execute an unprivileged task on the device and invoke an MPU system call with an attacker-controlled buffer argument (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so remote/network reach and non-MPU or non-Cortex-R82 builds are unaffected. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the flaw is fully fixed in V11.3.2, which is the recommended upgrade target.

Cross-domain sender spoofing in Mailu allows a domain manager to authenticate as arbitrary senders on other domains hosted on the same instance. The flaw is an improper-authorization issue in which the Postfix sender-login lookup honors the allow_spoofing flag globally rather than scoping it to the requesting user's own domain, so a manager of one hosted domain can enable spoofing and pass DKIM/SPF authentication for domains they do not own. Exploitation requires an existing domain-manager (administrative) role (CVSS PR:H) on a multi-tenant deployment hosting more than one domain; there is no unauthenticated or end-user path, and no public exploit code was identified at time of analysis.

Mailu, an open-source mail server distributed as a set of Docker images, contains an authorization flaw that lets an authenticated domain manager reset the password of, or mint an API token for, a higher-privileged account that merely owns a mailbox in a domain they manage - including a global admin or a manager of another domain. Because the vulnerable endpoints are the user edit, password reset, and token creation flows, a successful attack grants full control of the victim account and all of its privileges, escalating a limited domain-manager role into global administrative control; the CVSS 3.1 vector is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid domain-manager credentials and the specific condition that a higher-privileged user owns a mailbox inside the attacker's managed domain, so single-tenant installs with no delegated domain managers are effectively not exposed; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Unauthenticated remote command execution inside containers managed by Dockhand (Finsys) affects all versions prior to 1.0.34: the WebSocket upgrade request for the in-browser terminal endpoint /api/containers/<id>/exec is served without any authentication check, so an attacker who can reach the instance and knows a running container ID can open a raw terminal session and run commands inside that container. No authentication is required (CVSS:3.1/PR:N, CWE-306), and the S:C/C:H/I:H/A:H scoring reflects realistic container-to-host escalation when the target container is privileged or exposes sensitive host mounts such as the Docker socket; exploitation is constrained in practice because the attacker must know or enumerate a specific container ID and the target must have an interactive shell. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the pre-auth nature and high EPSS-relevant profile make the issue high priority; a vendor-released patch exists in version 1.0.34.

Privilege escalation in the ELADMIN (eladmin-mp) role management module through version 2.7 lets an authenticated non-admin user whose role has been delegated the `roles:edit` permission rewrite the menu set attached to its own role by calling PUT /api/roles/menu, because the endpoint only compares the target role's level with the caller's minimum level and never verifies that the caller is not editing itself or that the submitted menu ids are legitimate. No user interaction is needed, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) reflects high confidentiality and integrity impact on the application's role and menu authorization model, since the attacker can expand its own access by granting arbitrary menu permissions. The sole prerequisite is possession of the delegated `roles:edit` permission, which is a genuine but limited barrier; no public exploit code or confirmed active exploitation was identified at the time of analysis.

Unauthenticated HL7 ADT^A40 patient-merge messages accepted by the dcm4chee-arc-light archive's default listener let a remote sender reassign studies and related workflow records from one patient identity to another. The CPE lists all versions of the product as affected, and the archive's unmerge operation does not reverse the reassignment, so the integrity damage is effectively persistent. No credentials, user interaction, or non-default settings are required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; vendor CVSS 4.0 8.7); the practical limiting factor is network reachability of the HL7/MLLP port, and no public exploit code or CISA KEV entry was identified at time of analysis.

Unauthenticated remote peers can query and download patient demographics and medical imagery from dcm4chee-arc-light archives left in their default configuration, because the DICOM listener accepts association requests from calling AE titles that were never registered. An attacker who can reach the archive's DICOM service (commonly TCP 11112) can use C-FIND and C-GET to enumerate and retrieve patient records, and C-STORE to file fabricated studies under an existing patient identity, corrupting the clinical record. Exploitation requires no credentials and no user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N); no public exploit code and no confirmed in-the-wild exploitation are identified at time of analysis, so the high severity is driven by the confidentiality and integrity impact on protected health information rather than by observed attacks.

Remote authentication bypass in EseeCloud devices lets an unauthenticated attacker log in to the device management/login interface using a credential hard-coded into the product, yielding full control of the device (CVSS 4.0 base 9.3; independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every condition for exploitation is attacker-friendly: no account, no user interaction, no non-default configuration, and no special network position beyond reachability of the management interface, so internet-exposed or cloud-reachable units are effectively open doors while NAT/firewall-isolated devices are shielded. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data at time of analysis, and no EPSS score was provided, but the credential is embedded in the firmware rather than guessed, so the barrier to abuse is low wherever the interface is reachable. The flaw was reported to CISA's ICS-CERT program and published as advisory ICSA-26-288-02 under the Authentication Bypass tag.

Unauthenticated remote attackers can irreversibly delete stored DICOM objects in dcm4chee-arc-light by invoking the storage status-change REST service and setting a location record that is still associated with existing DICOM instances to the TO_DELETE state, after which the PurgeStorageScheduler background job removes the referenced object from storage while the corresponding instance record remains in the database. This missing authorization flaw (CWE-862) is rated CVSS 8.8 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H, VC:N) and allows an attacker to corrupt the integrity and availability of the clinical archive without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).

Missing authorization checks in the Advanced Post Manager WordPress plugin through version 4.5.6 let an authenticated user invoke functionality that should be reserved for higher-privileged roles, weakening the site's access-control boundary. Exploitation requires a valid low-privileged session (CVSS PR:L), so realistic exposure exists mainly on sites with open registration or attacker-controlled accounts, and no public exploit code has been identified at time of analysis. The demonstrated impact is limited to integrity and availability (C:N/I:L/A:L per our assessment), which is why this reads as a moderate-priority issue rather than a top-tier emergency.

Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 lets a remote network attacker reach a backend cache API that lacks authentication and execute injected SQL against the underlying data store, carrying CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity and availability impact). Exploitation is primarily gated by exposure rather than by attacker capability: the vendor states the issue mainly threatens Kylin services directly reachable from the public internet, which it describes as uncommon, and in-house deployments kept on internal networks are largely unaffected. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile).

Unauthenticated retrieval of sensitive backend metadata is possible in Apache Kylin 4.x through 5.0.4 because the metadata dump API performs no authorization check and does not confine the requested path to an intended location. The CVSS vector (AV:N/AC:L/PR:N/UI:N) means any party who can reach that API over the network can invoke it without credentials or user interaction; per our assessment the confirmed impact is confidentiality only (C:H/I:N/A:N), even though the NVD-published score of 9.1 also claims integrity impact. Apache explicitly limits the practical risk to installations where the Kylin backend is directly exposed to the public internet - an uncommon posture - so standard internally segmented deployments are largely unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.19% (8th percentile), which reinforces that this is an exposure-dependent issue rather than a broadly exploited one.

Privilege escalation in Rdiffweb lets any authenticated user promote themselves to administrator by sending a crafted POST request to the /api/users/{username_or_id} user-management endpoint with the 'role' parameter altered to an administrative value. The flaw is a missing authorization check (CWE-862) on a state-changing API route, rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because it requires only a valid low-privilege account and no user interaction while yielding full confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exposure is greatest on instances that allow self-registration or loosely provision accounts, since any such account can be turned into full administrative control.

Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.

Unauthenticated account takeover in the WordPress plugin OTP Login & Register Woocommerce (versions before 2.7.3) is possible because the plugin counts one-time-password verification attempts against a value supplied by the client, which an attacker can freely change to reset the counter and brute-force the short numeric login code. Affected are WordPress sites running the plugin with its OTP-based login/registration flow enabled; publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been recorded, and the EPSS score is low at 0.15% (4th percentile). Successful brute-force yields full account takeover without knowing the victim's password, but the attack still requires enumerating a valid account identifier and issuing many requests, which is why the assessed severity is moderate (CVSS 7.4) rather than critical.

Apache Answer through 2.0.2 fails to enforce content-visibility controls in its reaction API, allowing remote unauthenticated attackers to read reaction metadata from restricted content and to add or remove their own reactions. The assessed impact is limited to reaction confidentiality and integrity-attackers cannot alter the protected content, manipulate other users' reactions, or affect availability-despite the input's 9.8 base score. No public exploit code has been identified at time of analysis, and the vendor recommends upgrading to 2.0.3.

Sensitive information exposure in Modula Image Gallery 3.0.11 and earlier allows unauthenticated remote attackers to read the plaintext Password Protect password and username for published galleries by requesting the core WordPress REST route /wp-json/wp/v2/modula-gallery/{id}. The plugin redacts the same modulaSettings values on its dedicated /wp-json/modula/v2/gallery/{id}/settings endpoint, but the custom post type's show_in_rest=true registration leaves the core route without equivalent redaction. No public exploit identified at time of analysis; exploitation requires the target site to have enabled Password Protect for a gallery, so practical exposure is narrower than the 7.5 CVSS score suggests.

Unauthenticated order enumeration and PII disclosure in the Klarna for WooCommerce (Klarna Payments for WooCommerce) WordPress plugin affects all versions up to and including 4.13.3, allowing any remote attacker to retrieve the secret order_key plus full billing and shipping personal data for any order in the store. Because the plugin fails to verify authorization (CWE-862) before emitting order details inline as the klarna_payments_params JavaScript variable on the order-pay endpoint, and WooCommerce order IDs are sequential integers, a full store-wide order dump can be obtained with ordinary sequential GET requests and no session, order_key, or credentials. The CVSS vector confirms the exposure is remote, unauthenticated, and requires no user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact only; exploitation is trivially automatable, though no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine high-priority information-disclosure flaw rather than an inflated high-CVSS score, since every signal aligns with easy mass abuse across any default storefront running an affected version.

An authorization bypass in the FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin (all versions up to and including 3.16.0.6) lets unauthenticated attackers pull billing PII - full name, street address, email address, and phone number - for any WooCommerce order on a site by simply iterating sequential order IDs. Exploitation requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5), and the sequential ID space makes automated bulk extraction practical, so a single vulnerable store can leak its entire customer billing dataset. The hard precondition is that a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must exist and be reachable - stores that do not use these shortcodes are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Wordfence-coordinated disclosure tracks it as a genuine medium-to-high priority data-exposure flaw rather than a drop-everything emergency.

Unauthenticated attackers can read other customers' stored billing and shipping address PII on WordPress sites running the FluentCart plugin through version 1.7.0, exploiting an insecure direct object reference in the plugin's public AJAX checkout endpoint. Because the attacker supplies both the order_id and the address ID being compared, the plugin's internal id-equality guard is trivially satisfied, and sequential AUTO_INCREMENT order/address IDs can be enumerated at the soft rate limit of five requests per sixty seconds to harvest street address, city, state, postcode, phone, company name, VAT number and legal registration ID. The issue is confidentiality-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with no write, modification or availability impact; it is not listed in CISA KEV and no public exploit code was identified at time of analysis.