CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2018-0336"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-07T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privileges to the Administrator level. The vulnerability is due to insufficient authorization enforcement on batch processing. An attacker could exploit this vulnerability by uploading a batch file and having the batch file processed by the system. A successful exploit could allow the attacker to escalate privileges to the Administrator level. Cisco Bug IDs: CSCvd86578.",
  "id": "GHSA-2cmf-8qcc-8v59",
  "modified": "2022-05-13T01:35:23Z",
  "published": "2022-05-13T01:35:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0336"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-escalation"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/104429"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041083"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-17707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-31T14:29:00Z",
    "severity": "HIGH"
  },
  "details": "Due to missing authorization checks, any authenticated user is able to list, upload, or delete attachments to password safe entries in Pleasant Password Server before 7.8.3. To perform those actions on an entry, the user needs to know the corresponding \"CredentialId\" value, which uniquely identifies a password safe entry. Since \"CredentialId\" values are implemented as GUIDs, they are hard to guess. However, if for example an entry\u0027s owner grants read-only access to a malicious user, the value gets exposed to the malicious user. The same holds true for temporary grants.",
  "id": "GHSA-2cmj-fj8p-q47f",
  "modified": "2022-05-13T01:44:27Z",
  "published": "2022-05-13T01:44:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17707"
    },
    {
      "type": "WEB",
      "url": "https://www.profundis-labs.com/advisories/CVE-2017-17707.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-8432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-24T02:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The Appointment \u0026 Event Booking Calendar Plugin \u2013 Webba Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_appearance() function in all versions up to, and including, 5.0.48. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the booking form\u0027s CSS.",
  "id": "GHSA-2crp-c7w4-2c48",
  "modified": "2024-09-24T03:30:43Z",
  "published": "2024-09-24T03:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8432"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/webba-booking-lite/tags/5.0.48/includes/class-wbk-request-manager.php#L1986"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3152926/webba-booking-lite/trunk/includes/class-wbk-request-manager.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/23b33b77-2e72-4959-bdce-646e968f2a73?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-39108"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-14T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.",
  "id": "GHSA-2crw-c3p5-4j2g",
  "modified": "2022-10-18T19:00:31Z",
  "published": "2022-10-15T12:01:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39108"
    },
    {
      "type": "WEB",
      "url": "https://www.unisoc.com/en_us/secy/announcementDetail/1575654905820020738"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-4351"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-89"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-16T10:15:09Z",
    "severity": "HIGH"
  },
  "details": "The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the \u0027authenticate\u0027 function in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain control of an existing administrator account.",
  "id": "GHSA-2cvr-cjfw-9xmv",
  "modified": "2024-05-16T12:30:21Z",
  "published": "2024-05-16T12:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4351"
    },
    {
      "type": "WEB",
      "url": "https://www.themeum.com/product/tutor-lms"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59859583-49e5-4a80-8659-b9ca7ddc089d?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-49270"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-06T13:15:43Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Mario Peshev WP-CRM System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-CRM System: from n/a through 3.4.2.",
  "id": "GHSA-2cw4-3jwf-xx2h",
  "modified": "2026-04-01T18:35:22Z",
  "published": "2025-06-06T15:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49270"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wp-crm-system/vulnerability/wordpress-wp-crm-system-3-4-2-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-47628"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-07T15:16:15Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in quomodosoft QS Dark Mode allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QS Dark Mode: from n/a through 3.0.",
  "id": "GHSA-2f39-5mgp-fmmr",
  "modified": "2026-04-01T18:35:04Z",
  "published": "2025-05-07T15:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47628"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/qs-dark-mode/vulnerability/wordpress-qs-dark-mode-3-0-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-25409"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-11T15:15:00Z",
    "severity": "LOW"
  },
  "details": "Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically configuring device.",
  "id": "GHSA-2f3f-cc79-6mfg",
  "modified": "2022-07-31T00:00:57Z",
  "published": "2022-05-24T19:05:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25409"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2021\u0026month=6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "2.1.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24768"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-24T00:18:54Z",
    "nvd_published_at": "2022-03-23T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\n#### Impacts for versions starting with v1.0.0\n\nAll unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.\n\nTo perform the following exploits, an authorized Argo CD user must have push access to an Application\u0027s source git or Helm repository or `sync` _and_ `override` access to an Application. Once a user has that access, different exploitation levels are possible depending on their other RBAC privileges:\n\n1. If that user has `update` access to the Application, they can modify any resource on the Application\u0027s destination cluster. If the destination cluster is or can be made to be the same as the cluster hosting Argo CD, the user can escalate their Argo CD permissions to admin-level.\n2. If the user has `delete` access to the Application, they can delete any resource on the Application\u0027s destination cluster. (This exploit is possible starting with v0.8.0.)\n3. If the user has `get` access to the Application, they can view any resource on the Application\u0027s destination cluster (except for the contents of Secrets) and list [actions](https://argo-cd.readthedocs.io/en/stable/operator-manual/resource_actions/) available for that resource. \n4. If the user has `get` access to the Application, they can view the logs of any Pods on the Application\u0027s destination cluster.\n5. If the user has `action/{some action or *}` access on the Application, they can run an action for any resource (which supports the allowed action(s)) on the Application\u0027s destination cluster. (Some actions are available in Argo CD by default, and others may be configured by an Argo CD admin.)\n\nSee the [Argo CD RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) for an explanation of the privileges available in Argo CD.\n\n##### Events exploit\n\nA related exploit is possible for a user with `get` access to an Application **even if they do not have access to the Application\u0027s source git or Helm repository or `sync` and `override` access to the Application**. The user can access any Event in the Application\u0027s destination cluster if they know the involved object\u0027s name, UID, and namespace.\n\n#### Impacts for versions starting with v0.8.0\n\nThe same bug exists starting with v0.8.0, but only the following exploits were possible before v1.0.0:\n* The `delete` exploit (#\u0026#x2060;2 above).\n* The logs exploit (#\u0026#x2060;4 above).\n* The Events exploit described above.\n\n#### Impacts for versions starting with v0.5.0\n\nThe same bug exists starting with v0.5.0 (when RBAC was implemented), but only the Events exploit described above was possible before v0.8.0.\n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.3.2\n* v2.2.8\n* v2.1.14\n\n**Versions 2.0.x and earlier users:** See the [changelog](https://github.com/argoproj/argo-cd/blob/master/CHANGELOG.md) for links to upgrade instructions for your version. It is imperative to upgrade quickly, but some limited mitigations are described in the next section.\n\n**argo-helm chart users:** Argo CD users deploying v2.3.x with [argo-helm](https://github.com/argoproj/argo-helm) can upgrade the chart to version 4.2.2. Argo CD 2.2 and 2.1 users can set the `global.image.tag` value to the latest in your current release series (`v2.2.8`, or `v2.1.14`).  Since charts for the 2.2 and 2.1 series are no longer maintained, you will need to either leave the value override in place or upgrade to the 4.x chart series (and therefore to Argo CD 2.3).\n\n### Workarounds\n\nThe only certain way to avoid the vulnerability is to upgrade.\n\n#### Mitigations\n\n* To avoid privilege escalation:\n  * Limit who has push access to Application source repositories or `sync` + `override` access to Applications.\n  * Limit which repositories are available in [projects](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/) where users have  `update` access to Applications.\n* To avoid unauthorized resource inspection/tampering:\n  * Limit who has `delete`, `get`, or `action` access to Applications.\n\nThese mitigations can help limit potential damage, but they are _not_ a substitute for upgrading. It is necessary to upgrade immediately.\n\n### References\n\n* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#)\n\n### For more information\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n",
  "id": "GHSA-2f5v-8r3f-8pww",
  "modified": "2022-03-24T00:18:54Z",
  "published": "2022-03-24T00:18:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2f5v-8r3f-8pww"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24768"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/commit/af03b291d4b7e9d3ce9a6580ae9c8141af0e05cf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj/argo-cd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/releases/tag/v2.1.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/releases/tag/v2.2.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/releases/tag/v2.3.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper access control allows admin privilege escalation in Argo CD"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-12593"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-09T14:16:26Z",
    "severity": "HIGH"
  },
  "details": "The implementation of an internal\u00a0and\u00a0undocumented\u00a0Dashboard\u00a0API endpoint\u00a0(POST /api/users/~/{user}/tokens)\u00a0forgot\u00a0to ensure an HTTP\u00a0request for creating an\u00a0API\u00a0Token for another\u00a0user had sufficient permission to do so.\n\n\n\n\n\nPrecondition for successful exploitation was a preexisting internal user (with more privileges than the attacker),\u00a0the attacker knowing\u00a0its login name and the attacker being able to authenticate to the Dashboard via OAuth/OIDC. The attacker\u00a0would then have\u00a0had\u00a0to forge a token creation\u00a0API\u00a0request\u00a0on behalf of the\u00a0other user and could have authenticated\u00a0and\u00a0finalized\u00a0the token creation\u00a0with their own\u00a0OAuth/OIDC\u00a0credentials. In the worst case, this would mean an attacker could\u00a0have\u00a0become Dashboard Administrator\u00a0and\u00a0been\u00a0able to\u00a0perform\u00a0all\u00a0administrative actions\u00a0if the preexisting internal user had administrative\u00a0privileges.\u00a0In combination with a separate weakness,\u00a0this could have\u00a0further\u00a0led\u00a0to code execution on the\u00a0host\u00a0system running the Dashboard with the privileges of the OS-User running the Dashboard\u00a0server.",
  "id": "GHSA-2f7g-h2w3-wgvx",
  "modified": "2026-07-09T15:32:32Z",
  "published": "2026-07-09T15:32:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12593"
    },
    {
      "type": "WEB",
      "url": "https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-12593"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}