Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

14839 vulnerabilities reference this CWE, most recent first.

GHSA-597F-XH85-QC2H

Vulnerability from github – Published: 2024-03-20 15:32 – Updated: 2024-03-20 15:32
VLAI
Details

The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_save_permalink' function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-2538"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-20T06:15:12Z",
    "severity": "MODERATE"
  },
  "details": "The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027ajax_save_permalink\u0027 function in all versions up to, and including, 2.4.3.1. This makes it possible for authenticated attackers, with author access and above, to modify the permalinks of arbitrary posts.",
  "id": "GHSA-597f-xh85-qc2h",
  "modified": "2024-03-20T15:32:47Z",
  "published": "2024-03-20T15:32:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2538"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Xib3rR4dAr/b1eec00e844932c6f2f30a63024b404e"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3052848#file35"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/70cd028d-122d-4e3c-ac09-150dec07a2cd?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-598G-H2VC-H5VG

Vulnerability from github – Published: 2026-06-08 23:09 – Updated: 2026-06-08 23:09
VLAI
Summary
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
Details

The /api/v1/* route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer."

The Web UI gates state-changing routes through loadAccessibleCA (internal/web/cas.go); CA-management endpoints in internal/api/cas.go ALSO have proper canAccessCA gates. The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints. Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access — instant privilege escalation in the worst case.

Affected

All released versions prior to v0.3.4.

Exploit chain

A) Mint admin API key from any operator key (instant privilege escalation)

internal/api/operators.go:118 — handleCreateOperatorAPIKey does no admin check and no actor/target-operator ownership check. Any operator key can call it for any operator (including admins) and receive a fresh bearer.

curl -X POST -H "Authorization: Bearer <low-priv-key>" \
  https://server/api/v1/operators/<admin-id>/api-keys \
  -H 'Content-Type: application/json' -d '{"name":"oops"}'
# Returns: {"key":"<32-byte admin bearer>","entry":{...}}

Reuse the returned key for subsequent requests → full admin.

B) Cross-operator host takeover via reenroll

internal/api/hosts.go:321,330 → mintEnrollmentTokenForHost. Looks up host by URL param, mints a single-use enrollment token, returns it. No ownership check.

curl -X POST -H "Authorization: Bearer <low-priv-key>" \
  https://server/api/v1/hosts/<victim-host-id>/reenroll
# Returns: {"enrollment_token":"<uuid>",...}

Caller POSTs /api/v1/enroll with their own X25519 + Ed25519 keypairs. enroll.go:175 overwrites signing_pub_pem; SaveCertificateAndEnrollHost overwrites the cert. Legitimate agent's next signed poll fails bad_signature. Attacker now owns the victim's Nebula identity.

C) Cross-tenant CRUD on hosts, networks, firewall

The same gap applies across: - /api/v1/hosts* — create, list, get, update, delete, block, unblock - /api/v1/networks* — create, list, get - /api/v1/networks/{id}/firewall — get, PUT - /api/v1/hosts/{id}/mobile-bundle (already filed as public issue #119)

All trust bearer-auth alone. Any operator can read or mutate any other operator's resources.

Affected operator-management handlers (in addition to A)

Beyond handleCreateOperatorAPIKey (covered by A), internal/api/operators.go is missing admin gates on: - handleListOperators (line 66) — operator roster info disclosure - handleDisableOperator (line 79) — DoS / sabotage - handleEnableOperator (line 94) — re-enable disabled operators - handleRevokeOperatorAPIKey (line 157) — invalidate any operator's API keys - handleListOperatorAPIKeys (line 173) — API-key metadata disclosure

handleCreateOperator (line 26) IS properly gated (actorIsAdmin at line 27).

NOT affected (verified)

internal/api/cas.go properly gates every CA endpoint via canAccessCA (calls at lines 70, 176, 216) and admin shortcuts at lines 39, 82. An earlier description draft mistakenly listed /api/v1/cas/{id}/rotate as affected — that endpoint is properly protected. CAs are not in this gap.

Impact

  • Any non-admin operator → admin via one curl (A).
  • Any non-admin operator → ownership of any victim's hosts with cert + identity transfer (B).
  • Mass cross-tenant CRUD including firewall-rule mutation (C).
  • Any operator → disable/enable other operators, revoke their API keys, enumerate the operator roster.

CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — 9.6.

Suggested fix

Shared helpers in a new internal/api/authz.go, mirroring the Web layer's loadAccessibleCA:

func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) bool
func (s *Server) requireOperatorAccess(w http.ResponseWriter, r *http.Request, operatorID string) bool
func (s *Server) requireHostAccess(w http.ResponseWriter, r *http.Request, hostID string) (*models.Host, bool)
func (s *Server) requireNetworkAccess(w http.ResponseWriter, r *http.Request, networkID string) (*models.Network, bool)

Each loads the resource, resolves its CA via *.CAID, accepts if actorIsAdmin(ctx) OR actor owns the CA. Reject 403 forbidden; audit-log api.<resource>.forbidden with the reason.

The operator-management endpoints take requireAdmin instead (operator ownership doesn't map to CA ownership).

Apply at the top of every host-, network-, firewall-, mobile-bundle-touching API handler, plus the 5 operator endpoints listed above. The legacy config-key path retains admin (preserves backward compatibility); the broader legacy-fallback question is tracked separately as issue #121.

Test matrix

  • admin → all operations permitted
  • owning non-admin → operations on owned hosts/networks permitted
  • non-owner non-admin → 403 + audit entry
  • legacy config-key → preserved (admin)
  • unauthenticated → existing 401 from middleware

Coordinated context

Subsumes public issue #119 (mobile-bundle authz). Issue #121 (actor.go:40 legacy-admin fallback) is a separate concern tracked independently.

Severity
9.9 (Critical)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/juev/nebula-mesh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47724"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-08T23:09:02Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "The `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: *\"API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer.\"*\n\nThe Web UI gates state-changing routes through `loadAccessibleCA` (`internal/web/cas.go`); CA-management endpoints in `internal/api/cas.go` ALSO have proper `canAccessCA` gates. **The gap is on the host, network, firewall, mobile-bundle, and most operator endpoints.** Combined with the per-operator CA model from ADR 0002, this gives any non-admin operator API key broad cross-tenant access \u2014 instant privilege escalation in the worst case.\n\n## Affected\nAll released versions prior to v0.3.4.\n\n## Exploit chain\n\n### A) Mint admin API key from any operator key (instant privilege escalation)\n`internal/api/operators.go:118` \u2014 `handleCreateOperatorAPIKey` does no admin check and no actor/target-operator ownership check. Any operator key can call it for any operator (including admins) and receive a fresh bearer.\n\n```\ncurl -X POST -H \"Authorization: Bearer \u003clow-priv-key\u003e\" \\\n  https://server/api/v1/operators/\u003cadmin-id\u003e/api-keys \\\n  -H \u0027Content-Type: application/json\u0027 -d \u0027{\"name\":\"oops\"}\u0027\n# Returns: {\"key\":\"\u003c32-byte admin bearer\u003e\",\"entry\":{...}}\n```\n\nReuse the returned key for subsequent requests \u2192 full admin.\n\n### B) Cross-operator host takeover via reenroll\n`internal/api/hosts.go:321,330` \u2192 `mintEnrollmentTokenForHost`. Looks up host by URL param, mints a single-use enrollment token, returns it. No ownership check.\n\n```\ncurl -X POST -H \"Authorization: Bearer \u003clow-priv-key\u003e\" \\\n  https://server/api/v1/hosts/\u003cvictim-host-id\u003e/reenroll\n# Returns: {\"enrollment_token\":\"\u003cuuid\u003e\",...}\n```\n\nCaller POSTs `/api/v1/enroll` with their own X25519 + Ed25519 keypairs. `enroll.go:175` overwrites `signing_pub_pem`; `SaveCertificateAndEnrollHost` overwrites the cert. Legitimate agent\u0027s next signed poll fails `bad_signature`. Attacker now owns the victim\u0027s Nebula identity.\n\n### C) Cross-tenant CRUD on hosts, networks, firewall\nThe same gap applies across:\n- `/api/v1/hosts*` \u2014 create, list, get, update, delete, block, unblock\n- `/api/v1/networks*` \u2014 create, list, get\n- `/api/v1/networks/{id}/firewall` \u2014 get, PUT\n- `/api/v1/hosts/{id}/mobile-bundle` (already filed as public issue #119)\n\nAll trust bearer-auth alone. Any operator can read or mutate any other operator\u0027s resources.\n\n## Affected operator-management handlers (in addition to A)\nBeyond `handleCreateOperatorAPIKey` (covered by A), `internal/api/operators.go` is missing admin gates on:\n- `handleListOperators` (line 66) \u2014 operator roster info disclosure\n- `handleDisableOperator` (line 79) \u2014 DoS / sabotage\n- `handleEnableOperator` (line 94) \u2014 re-enable disabled operators\n- `handleRevokeOperatorAPIKey` (line 157) \u2014 invalidate any operator\u0027s API keys\n- `handleListOperatorAPIKeys` (line 173) \u2014 API-key metadata disclosure\n\n`handleCreateOperator` (line 26) IS properly gated (`actorIsAdmin` at line 27).\n\n## NOT affected (verified)\n`internal/api/cas.go` properly gates every CA endpoint via `canAccessCA` (calls at lines 70, 176, 216) and admin shortcuts at lines 39, 82. An earlier description draft mistakenly listed `/api/v1/cas/{id}/rotate` as affected \u2014 that endpoint is properly protected. CAs are not in this gap.\n\n## Impact\n- Any non-admin operator \u2192 admin via one curl (A).\n- Any non-admin operator \u2192 ownership of any victim\u0027s hosts with cert + identity transfer (B).\n- Mass cross-tenant CRUD including firewall-rule mutation (C).\n- Any operator \u2192 disable/enable other operators, revoke their API keys, enumerate the operator roster.\n\nCVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H \u2014 9.6.\n\n## Suggested fix\nShared helpers in a new `internal/api/authz.go`, mirroring the Web layer\u0027s `loadAccessibleCA`:\n\n```go\nfunc (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) bool\nfunc (s *Server) requireOperatorAccess(w http.ResponseWriter, r *http.Request, operatorID string) bool\nfunc (s *Server) requireHostAccess(w http.ResponseWriter, r *http.Request, hostID string) (*models.Host, bool)\nfunc (s *Server) requireNetworkAccess(w http.ResponseWriter, r *http.Request, networkID string) (*models.Network, bool)\n```\n\nEach loads the resource, resolves its CA via `*.CAID`, accepts if `actorIsAdmin(ctx)` OR actor owns the CA. Reject `403 forbidden`; audit-log `api.\u003cresource\u003e.forbidden` with the reason.\n\nThe operator-management endpoints take `requireAdmin` instead (operator ownership doesn\u0027t map to CA ownership).\n\nApply at the top of every host-, network-, firewall-, mobile-bundle-touching API handler, plus the 5 operator endpoints listed above. The legacy config-key path retains admin (preserves backward compatibility); the broader legacy-fallback question is tracked separately as issue #121.\n\n## Test matrix\n- admin \u2192 all operations permitted\n- owning non-admin \u2192 operations on owned hosts/networks permitted\n- non-owner non-admin \u2192 403 + audit entry\n- legacy config-key \u2192 preserved (admin)\n- unauthenticated \u2192 existing 401 from middleware\n\n## Coordinated context\nSubsumes public issue #119 (mobile-bundle authz). Issue #121 (actor.go:40 legacy-admin fallback) is a separate concern tracked independently.",
  "id": "GHSA-598g-h2vc-h5vg",
  "modified": "2026-06-08T23:09:02Z",
  "published": "2026-06-08T23:09:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/juev/nebula-mesh/security/advisories/GHSA-598g-h2vc-h5vg"
    },
    {
      "type": "WEB",
      "url": "https://github.com/forgekeep/nebula-mesh/commit/9d8bcd7667ecd0c2975cc71fb35a02fe131f76f2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/juev/nebula-mesh"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation"
}

GHSA-5993-WWPG-M92C

Vulnerability from github – Published: 2021-11-23 17:56 – Updated: 2023-12-05 22:47
VLAI
Summary
Apache Ozone user impersonation due to non-validation of Ozone S3 tokens
Details

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.hadoop:hadoop-ozone-ozone-manager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39236"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-11-22T19:05:30Z",
    "nvd_published_at": "2021-11-19T10:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.",
  "id": "GHSA-5993-wwpg-m92c",
  "modified": "2023-12-05T22:47:46Z",
  "published": "2021-11-23T17:56:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39236"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/ozone/pull/1871"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/ozone/commit/60e078729e18ef1be276f35659957ac553d266f7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/ozone"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/HDDS-4763"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/q0lhspolnwfbsw33w98b7b1923n1np4d"
    },
    {
      "type": "WEB",
      "url": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C0fd74baa-88a0-39a2-8f3a-b982acb25d5a%40apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/11/19/7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Ozone user impersonation due to non-validation of Ozone S3 tokens"
}

GHSA-599F-HXXF-HGX8

Vulnerability from github – Published: 2023-03-24 21:30 – Updated: 2023-03-29 15:30
VLAI
Details

In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-261193935

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-21002"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-24T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-261193935",
  "id": "GHSA-599f-hxxf-hgx8",
  "modified": "2023-03-29T15:30:16Z",
  "published": "2023-03-24T21:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21002"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2023-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-599V-W48H-RJRM

Vulnerability from github – Published: 2022-09-16 17:39 – Updated: 2022-09-16 17:39
VLAI
Summary
XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor
Details

Impact

Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects. Sensitive configuration fields like passwords for LDAP or SMTP servers could be accessed. By exploiting an additional vulnerability, this issue can even be exploited on private wikis at least for string properties.

Patches

The issue is patched in version 13.10.4 and 14.2. Password properties are no longer displayed and rights are checked for other properties.

Workarounds

The template file suggest.vm can be replaced by a patched version without upgrading or restarting XWiki unless it has been overridden, in which case the overridden template should be patched, too. This might need adjustments for older versions, though.

References

  • https://jira.xwiki.org/browse/XWIKI-18849

For more information

If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at security mailing-list

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-web-templates"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3"
            },
            {
              "fixed": "13.10.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.xwiki.platform:xwiki-platform-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0"
            },
            {
              "fixed": "14.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-359",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T17:39:46Z",
    "nvd_published_at": "2022-09-08T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThrough the suggestion feature, string and list properties of objects the user shouldn\u0027t have access to can be accessed. This includes private personal information like email addresses and salted password hashes of registered users but also other information stored in properties of objects. Sensitive configuration fields like passwords for LDAP or SMTP servers could be accessed. By exploiting an additional vulnerability, this issue can even be exploited on [private wikis](https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Access%20Rights/#HPrivateWiki) at least for string properties.\n\n### Patches\nThe issue is patched in version 13.10.4 and 14.2. Password properties are no longer displayed and rights are checked for other properties.\n\n### Workarounds\nThe template file `suggest.vm` can be replaced by a patched version without upgrading or restarting XWiki unless it has been [overridden](https://extensions.xwiki.org/xwiki/bin/view/Extension/Skin%20Application#HHowtooverrideatemplate), in which case the overridden template should be patched, too. This might need adjustments for older versions, though.\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-18849\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org)\n* Email us at [security mailing-list](mailto:security@xwiki.com)\n",
  "id": "GHSA-599v-w48h-rjrm",
  "modified": "2022-09-16T17:39:46Z",
  "published": "2022-09-16T17:39:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36091"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/xwiki/xwiki-platform"
    },
    {
      "type": "WEB",
      "url": "https://jira.xwiki.org/browse/XWIKI-18849"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "XWiki Platform Web Templates vulnerable to Missing Authorization, Exposure of Private Personal Information to Unauthorized Actor"
}

GHSA-59CG-FJ2Q-33C4

Vulnerability from github – Published: 2026-07-24 18:31 – Updated: 2026-07-24 18:31
VLAI
Details

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user's session queue, causing the background drainer to forward malicious messages to the victim's running AI agent with the victim's credentials and permissions.

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-66027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-24T16:16:55Z",
    "severity": "HIGH"
  },
  "details": "Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues of all users, read or delete individual sessions, and inject arbitrary prompts into another user\u0027s session queue, causing the background drainer to forward malicious messages to the victim\u0027s running AI agent with the victim\u0027s credentials and permissions.",
  "id": "GHSA-59cg-fj2q-33c4",
  "modified": "2026-07-24T18:31:29Z",
  "published": "2026-07-24T18:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66027"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kortix-ai/suna/pull/4373"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kortix-ai/suna/commit/7536a7d47fc93abcb66e677fcc993b390c81296a"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geo-chen/oss/blob/main/suna.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kortix-ai/suna/releases/tag/v0.9.102"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/suna-broken-access-control-via-message-queue-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-59FW-MHQQ-48F3

Vulnerability from github – Published: 2026-02-17 12:31 – Updated: 2026-02-17 12:31
VLAI
Details

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-2608"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-17T12:16:15Z",
    "severity": "MODERATE"
  },
  "details": "The Kadence Blocks \u2014 Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.",
  "id": "GHSA-59fw-mhqq-48f3",
  "modified": "2026-02-17T12:31:08Z",
  "published": "2026-02-17T12:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2608"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=/kadence-blocks/tags/3.5.32\u0026new_path=/kadence-blocks/tags/3.6.0\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/wordpress/plugin/kadence-blocks/vulnerability/wordpress-gutenberg-blocks-with-ai-by-kadence-wp-plugin-3-5-32-incorrect-authorization-to-authenticated-contributor-post-publication-vulnerability"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05dd1686-76e3-498b-80b8-c4befc545fc8?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59HP-H3HQ-6GMV

Vulnerability from github – Published: 2026-05-02 09:31 – Updated: 2026-05-02 09:31
VLAI
Details

The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing authorization and nonce verification in the donate_action_status() AJAX handler, which is registered to be accessible to unauthenticated users via wp_ajax_nopriv. The function only validates that the schema parameter equals 'donate-ajax' and that the required POST parameters are present, but fails to verify user capabilities, nonce tokens, or donation ownership. This makes it possible for unauthenticated attackers to modify the status of any donation by providing its ID (which are sequential integers and easily enumerable), allowing them to mark donations as completed, pending, cancelled, or any arbitrary status, potentially triggering email notifications and related side effects.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-02T08:16:27Z",
    "severity": "MODERATE"
  },
  "details": "The FundPress \u2013 WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing authorization and nonce verification in the donate_action_status() AJAX handler, which is registered to be accessible to unauthenticated users via wp_ajax_nopriv. The function only validates that the schema parameter equals \u0027donate-ajax\u0027 and that the required POST parameters are present, but fails to verify user capabilities, nonce tokens, or donation ownership. This makes it possible for unauthenticated attackers to modify the status of any donation by providing its ID (which are sequential integers and easily enumerable), allowing them to mark donations as completed, pending, cancelled, or any arbitrary status, potentially triggering email notifications and related side effects.",
  "id": "GHSA-59hp-h3hq-6gmv",
  "modified": "2026-05-02T09:31:15Z",
  "published": "2026-05-02T09:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4650"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/fundpress/tags/2.0.8/inc/class-dn-ajax.php#L173"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/fundpress/tags/2.0.8/inc/class-dn-ajax.php#L179"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/fundpress/tags/2.0.8/inc/class-dn-donate.php#L189"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/fundpress/tags/2.0.9/inc/class-dn-ajax.php#L179"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/fundpress/trunk/inc/class-dn-ajax.php#L173"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/fundpress/trunk/inc/class-dn-ajax.php#L179"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/fundpress/trunk/inc/class-dn-donate.php#L189"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3502937%40fundpress\u0026new=3502937%40fundpress\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5db3c66f-0a9c-4233-923c-0965dec68c60?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59MM-3634-JCPW

Vulnerability from github – Published: 2024-12-09 15:31 – Updated: 2026-04-28 21:35
VLAI
Details

Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-25026"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-09T13:15:22Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.",
  "id": "GHSA-59mm-3634-jcpw",
  "modified": "2026-04-28T21:35:16Z",
  "published": "2024-12-09T15:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25026"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/paypal-brasil-para-woocommerce/vulnerability/wordpress-paypal-brasil-para-woocommerce-plugin-1-4-2-broken-access-control?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-59MW-82VH-F4Q5

Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31
VLAI
Details

Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Agency: from n/a through <= 1.5.5.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-32346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-13T19:54:46Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Agency: from n/a through \u003c= 1.5.5.",
  "id": "GHSA-59mw-82vh-f4q5",
  "modified": "2026-03-13T21:31:48Z",
  "published": "2026-03-13T21:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32346"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/travel-agency/vulnerability/wordpress-travel-agency-theme-1-5-5-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list