CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2025-12042"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-08T04:15:43Z",
    "severity": "MODERATE"
  },
  "details": "The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an export of all booking data.",
  "id": "GHSA-4q76-wc8j-pm27",
  "modified": "2025-11-08T06:30:26Z",
  "published": "2025-11-08T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12042"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3389366%40course-booking-system\u0026new=3389366%40course-booking-system\u0026sfp_email=\u0026sfph_mail=#file86"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38b2b477-5b8a-42c2-b346-57707d9a34a5?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-45852"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-16T10:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Projectworlds Hospital Management System v1.0. Unauthorized malicious attackers can add patients without restriction via add_patient.php.",
  "id": "GHSA-4q7c-37x4-482q",
  "modified": "2022-03-23T00:00:34Z",
  "published": "2022-03-17T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45852"
    },
    {
      "type": "WEB",
      "url": "https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-56061"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-31T14:15:24Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in Webful Creations Computer Repair Shop allows Privilege Escalation.This issue affects Computer Repair Shop: from n/a through 3.8119.",
  "id": "GHSA-4q7h-c39w-2pw2",
  "modified": "2026-04-01T18:32:54Z",
  "published": "2024-12-31T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56061"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-3-8119-account-takeover-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7381"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-05T11:15:13Z",
    "severity": "MODERATE"
  },
  "details": "The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.",
  "id": "GHSA-4q7x-mgpp-gv6h",
  "modified": "2026-04-08T18:33:36Z",
  "published": "2024-09-05T12:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7381"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/cf-geoplugin/tags/8.6.9/inc/classes/Shortcodes.php#L1932"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3149577/cf-geoplugin/trunk/inc/classes/Shortcodes.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed7b13a-eec3-4035-8815-15228fb05af1?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-38690"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-01T15:15:30Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.3.",
  "id": "GHSA-4q96-h8mr-4mvm",
  "modified": "2024-11-01T15:31:57Z",
  "published": "2024-11-01T15:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38690"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/ipanorama-360-virtual-tour-builder-lite/wordpress-ipanorama-360-plugin-1-8-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-24352"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-14T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site\u0027s redirects.",
  "id": "GHSA-4q9c-h5m8-8ffp",
  "modified": "2022-07-29T00:00:43Z",
  "published": "2022-05-24T19:05:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24352"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/d770f1fa-7652-465a-833c-b7178146847d"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-32730"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:37:02Z",
    "severity": "MODERATE"
  },
  "details": "SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role \u0027Learner\u0027 could gain access to other user\u0027s data in manager which will lead to a high impact to the confidentiality of the application.\n\n",
  "id": "GHSA-4qcf-w92c-26h6",
  "modified": "2024-05-14T18:30:47Z",
  "published": "2024-05-14T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32730"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3441944"
    },
    {
      "type": "WEB",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:13:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.\n\n## Steps to Reproduce\n\n### 1. Start Budibase\n\n```bash\ndocker run -d --name budibase-poc -p 10000:80 \\\n  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \\\n  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \\\n  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \\\n  -e BB_ADMIN_USER_EMAIL=admin@test.com \\\n  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \\\n  budibase/budibase:latest\n\nuntil curl -sf http://localhost:10000/health; do sleep 5; done\n```\n\n### 2. Login as admin, create a user group, create a BASIC user\n\n```bash\n# Login as admin\ncurl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"admin@test.com\",\"password\":\"TestPassword123!\"}\u0027\n\n# Create a user group (requires license with user groups feature, or use Budibase Cloud)\n# On self-hosted without license, groups may not be available\n# If available:\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"name\":\"Secret Admin Group\",\"color\":\"#ff0000\",\"icon\":\"AdminPanelSettingsIcon\",\"roles\":{\"app_abc123\":\"ADMIN\"}}\u0027\n\n# Create a BASIC user (no builder, no admin)\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"email\":\"basic@test.com\",\"password\":\"BasicPass123!\",\"roles\":{},\"admin\":{\"global\":false},\"builder\":{\"global\":false}}\u0027\n```\n\n### 3. Login as BASIC user and enumerate all groups (the vulnerability)\n\n```bash\n# Login as BASIC user\ncurl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"basic@test.com\",\"password\":\"BasicPass123!\"}\u0027\n\n# List ALL groups (should return 403, but returns 200 with full data)\ncurl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups\n```\n\n**Expected:** 403 Forbidden (consistent with `GET /api/global/groups/:id` which requires `builderOrAdmin`)\n\n**Actual:** 200 OK with full group data including role mappings, member lists, and builder flags.\n\n### Standalone verification (code review)\n\n```bash\n# In the budibase source tree:\ngrep -A2 \u0027global/groups\"\u0027 packages/worker/src/api/routes/global/groups.ts\n```\n\nOutput shows the list endpoint has NO auth middleware:\n```\n  .get(\"/api/global/groups\",            # \u003c-- NO auth.builderOrAdmin\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n```\n\nCompare with the single-group endpoint directly below:\n```\n  .get(\"/api/global/groups/:groupId\",   # \u003c-- HAS auth.builderOrAdmin\n    auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.getById\n```\n\n## Root Cause\n\nFile: `packages/worker/src/api/routes/global/groups.ts`, lines 40-44\n\nThe list endpoint is the ONLY group endpoint without RBAC:\n\n| Endpoint | Auth Middleware |\n|----------|---------------|\n| `POST /api/global/groups` | `auth.adminOnly` |\n| `DELETE /api/global/groups/:id/:rev` | `auth.adminOnly` |\n| `GET /api/global/groups/:id` | `auth.builderOrAdmin` |\n| `GET /api/global/groups/:id/users` | `auth.builderOrAdmin` |\n| **`GET /api/global/groups`** | **NONE** |\n\n## Impact\n\nA BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.\n\n## Suggested Fix\n\n```diff\n  router.get(\"/api/global/groups\",\n+   auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n  )\n```",
  "id": "GHSA-4qcj-m5wp-jmf4",
  "modified": "2026-07-24T21:13:07Z",
  "published": "2026-07-24T21:13:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-35051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T15:15:15Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.",
  "id": "GHSA-4qg3-w6pq-6h3p",
  "modified": "2026-04-28T21:35:23Z",
  "published": "2024-12-13T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35051"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/contact-forms/vulnerability/wordpress-contact-forms-by-cimatti-plugin-1-5-7-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-6720"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-19T06:15:24Z",
    "severity": "MODERATE"
  },
  "details": "The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files.",
  "id": "GHSA-4qgj-c63p-26g3",
  "modified": "2025-07-19T06:30:57Z",
  "published": "2025-07-19T06:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6720"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/mrkv-vchasno-kasa/trunk/classes/mrkv-setup.php#L245"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3328827%40mrkv-vchasno-kasa\u0026new=3328827%40mrkv-vchasno-kasa\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd03483a-f46c-4e17-8b58-df87b0ad7fa3?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}