CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2022-2155"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-12T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability exists in the affected versions of Lumada APM\u2019s User Asset Group feature due to a flaw in access control mechanism implementation on the \u201cLimited Engineer\u201d role, granting it access to the embedded Power BI reports feature. An attacker that manages to exploit the vulnerability on a customer\u2019s Lumada APM could access unauthorized information by gaining unauthorized access to any Power BI reports installed by the customer. Furthermore, the vulnerability enables an attacker to manipulate asset issue comments on assets, which should not be available to the attacker. Affected versions * Lumada APM on-premises version 6.0.0.0 - 6.4.0.* List of CPEs: * cpe:2.3:a:hitachienergy:lumada_apm:6.0.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.1.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.2.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.3.0.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:lumada_apm:6.4.0.0:*:*:*:*:*:*:*",
  "id": "GHSA-5497-8frw-qm4r",
  "modified": "2024-04-04T05:31:15Z",
  "published": "2023-07-06T19:24:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2155"
    },
    {
      "type": "WEB",
      "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000112\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.smallrye.config:smallrye-config"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-1729"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-06-01T18:38:31Z",
    "nvd_published_at": "2021-05-28T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in SmallRye\u0027s API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2",
  "id": "GHSA-54fx-gm74-q676",
  "modified": "2022-03-18T17:55:47Z",
  "published": "2022-03-18T17:55:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1729"
    },
    {
      "type": "WEB",
      "url": "https://github.com/smallrye/smallrye-config/commit/fb0def6f61c09a2a80c9145e4ec6521225cd0b99"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802444"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Permissions bypass in SmallRye"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-30T12:15:27Z",
    "severity": "MODERATE"
  },
  "details": "An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the \"FILE_ID\" of the endpoint \"/embedai/files/show/\u003cFILE_ID\u003e\".",
  "id": "GHSA-54x3-pqpj-qp4h",
  "modified": "2025-01-30T12:31:19Z",
  "published": "2025-01-30T12:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0742"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.2.24"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.2.22"
            },
            {
              "fixed": "2026.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T21:39:10Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nA client using shared gateway auth could attach an unpaired device identity and request elevated operator scopes (including `operator.admin`) before pairing approval, enabling privilege escalation.\n\n### Impact\nAttackers with valid shared gateway auth could self-assign higher operator scopes by presenting a self-signed, unpaired device identity.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `\u003e= 2026.2.22 \u003c= 2026.2.24`\n- Latest published npm at triage time: `2026.2.24`\n- Planned patched release: `2026.2.25`\n\n### Remediation\nRequire pairing for operator device-identity sessions authenticated with shared token/password auth (except existing control-ui trusted-proxy/control-ui bypass policy paths).\n\n### Fix Commit(s)\n- `8d1481cb4a9d31bd617e52dc8c392c35689d9dea`\n\n### Release Process Note\n`patched_versions` is pre-set to the release (`\u003e= 2026.2.25`). Advisory published with npm release `2026.2.25`.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-553v-f69r-656j",
  "modified": "2026-03-03T21:39:10Z",
  "published": "2026-03-03T21:39:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-553v-f69r-656j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/8d1481cb4a9d31bd617e52dc8c392c35689d9dea"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0781"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-28T17:15:25Z",
    "severity": "HIGH"
  },
  "details": "An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.",
  "id": "GHSA-555q-7wq3-w6ch",
  "modified": "2025-01-30T00:31:03Z",
  "published": "2025-01-28T18:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0781"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/flightgear/flightgear/-/commit/ad37afce28083fad7f79467b3ffdead753584358"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/flightgear/flightgear/-/issues/3025"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/flightgear/simgear/-/commit/5bb023647114267141a7610e8f1ca7d6f4f5a5a8"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00028.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00029.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-25010"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-28T16:15:34Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user\u00a0role which incorrectly has the ability to access all Kibana Spaces.",
  "id": "GHSA-5567-c6hm-cgjh",
  "modified": "2025-08-28T18:30:38Z",
  "published": "2025-08-28T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25010"
    },
    {
      "type": "WEB",
      "url": "https://discuss.elastic.co/t/kibana-9-0-6-9-1-3-security-update-esa-2025-13/381426"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-1086"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-29T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead to integrity and confidentiality loss or information disclosure. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior to 8.7).",
  "id": "GHSA-556j-5chh-24cp",
  "modified": "2022-05-24T17:49:13Z",
  "published": "2022-05-24T17:49:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1086"
    },
    {
      "type": "WEB",
      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5172"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.83.38"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hatchet-dev/hatchet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.83.39"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42572"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T21:59:05Z",
    "nvd_published_at": "2026-05-14T18:16:47Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nA missing authorization directive on the `GET /api/v1/stable/dags/tasks` endpoint caused Hatchet\u0027s tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant\u0027s UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG.\n\nThis issue has been patched in **v0.83.39**. Hatchet Cloud has been patched and requires no action from users. Self-hosted users should upgrade.\n\n## Impact\n\n**Who is affected.** Multi-tenant Hatchet instances reachable by an attacker who can obtain an account on that instance. On Hatchet Cloud, account creation is open by default. On self-hosted instances, the API must be reachable by the attacker and the hostname known; instances deployed inside a VPC or with signup restricted are not exposed to arbitrary external actors.\n\n**Prerequisites for exploitation.** An attacker needed:\n\n1. An account on the target Hatchet instance.\n2. The victim tenant\u0027s UUID.\n3. At least one DAG UUID (`external_id`) belonging to that tenant.\n\nThe two UUIDs are not treated as secrets \u2014 they appear in URLs, API responses, audit logs, invitation flows, shared run links, and dashboard screenshots \u2014 but an attacker does need to learn them through some out-of-band channel before exploitation is possible.\n\n**What could be disclosed.** For each child task of a targeted DAG, the endpoint returned:\n\n- `display_name`, `action_id`, `step_id`\n- `workflow_id`, `workflow_version_id`, `workflow_run_id`, `task_external_id`\n- `tenant_id`, `retry_count`, `status`, timestamps\n- `additional_metadata` (JSON)\n\nThe `additional_metadata` field is the most sensitive: Hatchet workflows commonly use it to carry domain context such as user identifiers, customer IDs, feature flags, or correlation tokens. Its contents vary by deployment.\n\n**What was not disclosed.** The raw task `input` payload is not part of this endpoint\u0027s response shape and was not exposed through this issue. The scope is limited to task metadata, not task arguments or results.\n\n**Exploitation status.** We have no evidence that this vulnerability was exploited prior to the patch.\n\n## Root cause\n\nHatchet\u0027s multi-tenant authorization relies on an OpenAPI-driven middleware pipeline. Each authenticated operation declares `x-resources: [\"tenant\", ...]` in its spec. The `populator` middleware reads the declared resources, looks up the corresponding entities from request parameters, and stores them on the request context. The `authz` middleware then verifies that the authenticated user is a member of the tenant found on the context.\n\nThe `listTasksByDAGIds` operation accepted a `tenant` UUID as a query parameter, but its OpenAPI definition did not declare `x-resources: [\"tenant\"]`. As a result:\n\n1. The populator, which early-returns when no resources are declared, did not populate the tenant onto the request context.\n2. The authz middleware, which runs its membership check only when a tenant is present on the context, silently passed the request through.\n3. The handler read the tenant UUID directly from the query parameter and used it as the filter in the downstream OLAP query.\n\nThe SQL query itself correctly filters by `tenant_id`, so it returned only rows matching the supplied UUID \u2014 but the UUID came from the caller rather than from an authorization-validated context, so the filter bounded the response to the *attacker-named* tenant rather than to a tenant the caller was authorized to read.\n\nEvery other authenticated operation in the same path file (`tasks.yaml`) correctly declared `x-resources`. This endpoint was the only authenticated operation in the file that did not.\n\n## Patch\n\nThe fix adds the missing resource authz checks inline on the handler, enforcing valid tenant membership before the handler runs.\n\nShipped in **v0.83.39**.\n\n## Remediation\n\n**Hatchet Cloud.** No action required. The patch was deployed on April 23, 2026 within the same day it was reported.\n\n**Self-hosted \u2014 recommended.** Upgrade to **v0.83.39** or later.\n\n**Self-hosted \u2014 if you cannot upgrade immediately.** Either of the following reduces exposure until you can upgrade:\n\n- Restrict account creation by setting `SERVER_AUTH_RESTRICTED_EMAIL_DOMAINS` to an allowlist of domains you control. This prevents arbitrary users from registering an account on your instance, which removes the most common path to the prerequisite account.\n- Ensure the Hatchet API is not exposed to untrusted networks. We generally recommend running Hatchet inside a VPC and fronting the API with authenticated network controls; deployments configured this way were not reachable by arbitrary external attackers.\n\n## Timeline\n\nAll times April 23, 2026.\n\n- **14:05** \u2014 Reported to Hatchet.\n- **16:28** \u2014 Patch deployed to Hatchet Cloud and released as v0.83.39.\n- Public disclosure \u2014 this advisory.\n\n## Credit\n\nReported by @sajdakabir.\n\nHatchet thanks the reporter for responsibly disclosing this issue and for the clear, reproducible writeup.",
  "id": "GHSA-55gc-6fmc-fpx9",
  "modified": "2026-05-14T20:53:43Z",
  "published": "2026-05-06T21:59:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-55gc-6fmc-fpx9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42572"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hatchet-dev/hatchet"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-34218"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-31T14:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible",
  "id": "GHSA-55qq-x3mf-mhr9",
  "modified": "2024-04-04T04:25:45Z",
  "published": "2023-05-31T15:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34218"
    },
    {
      "type": "WEB",
      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-16773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-05T13:29:00Z",
    "severity": "HIGH"
  },
  "details": "Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission checks for directories in POSIX mode.",
  "id": "GHSA-564f-j4mm-773m",
  "modified": "2022-05-13T01:37:19Z",
  "published": "2022-05-13T01:37:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16773"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/en-global/support/security/Synology_SA_18_27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}