CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14837 vulnerabilities reference this CWE, most recent first.
GHSA-X26H-G6HW-673V
Vulnerability from github – Published: 2025-01-07 09:30 – Updated: 2025-01-07 09:30The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.
{
"affected": [],
"aliases": [
"CVE-2024-11725"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T07:15:26Z",
"severity": "HIGH"
},
"details": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please note this requires the woocommerce-warranty plugin to be installed in order to be exploited.",
"id": "GHSA-x26h-g6hw-673v",
"modified": "2025-01-07T09:30:46Z",
"published": "2025-01-07T09:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11725"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/sms-alert/trunk/helper/return-warranty.php#L74"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3198056/sms-alert/trunk/helper/return-warranty.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3197777%40sms-alert\u0026new=3197777%40sms-alert\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3199795%40sms-alert\u0026new=3199795%40sms-alert\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3207391%40sms-alert\u0026new=3207391%40sms-alert\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33517dba-78ac-4391-a55e-d1f13801b212?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X26Q-P92R-M6HP
Vulnerability from github – Published: 2026-04-08 21:32 – Updated: 2026-04-08 21:32The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eafl_reset_settings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's settings.
{
"affected": [],
"aliases": [
"CVE-2024-5864"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-28T04:15:05Z",
"severity": "MODERATE"
},
"details": "The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eafl_reset_settings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin\u0027s settings.",
"id": "GHSA-x26q-p92r-m6hp",
"modified": "2026-04-08T21:32:50Z",
"published": "2026-04-08T21:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5864"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3106718/easy-affiliate-links/trunk/includes/admin/class-eafl-tools-manager.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a4c656-8df8-44ce-884f-dd502d17f594?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X27G-5M69-MJ3V
Vulnerability from github – Published: 2025-09-26 09:31 – Updated: 2026-04-01 18:36Missing Authorization vulnerability in Jeff Farthing Theme My Login allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Theme My Login: from n/a through 7.1.12.
{
"affected": [],
"aliases": [
"CVE-2025-60098"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-26T09:15:35Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Jeff Farthing Theme My Login allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Theme My Login: from n/a through 7.1.12.",
"id": "GHSA-x27g-5m69-mj3v",
"modified": "2026-04-01T18:36:21Z",
"published": "2025-09-26T09:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60098"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/theme-my-login/vulnerability/wordpress-theme-my-login-plugin-7-1-12-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-X27W-589X-FRM2
Vulnerability from github – Published: 2026-07-20 23:25 – Updated: 2026-07-20 23:25Summary
When ISR is enabled, the serverless entrypoint lets an unauthenticated request
decide which route the origin renders. The internal _isr function reads the
x_astro_path query parameter and rewrites the request path to it without any
authentication. Edge level access controls only ever see the /_isr path, so
they do not apply to the route that actually gets rendered. This is the same
confused deputy problem as CVE-2026-33768, reachable again through the ISR path.
Impact
This affects apps that use @astrojs/vercel with isr: true and protect routes
at the edge. Two common setups are affected:
- Path rules or firewall deny rules configured on Vercel (for example blocking
/admin). - Split deployments (
edgeMiddleware: true) where authorization lives in Astro middleware, since that middleware runs at the edge and not in the origin.
An attacker reads any GET rendered route by requesting
/_isr?x_astro_path=/the/protected/path. No credentials are required. The
protected content is produced by a fresh origin render, so the attack does not
depend on the response being cached first.
Details
packages/integrations/vercel/src/serverless/entrypoint.ts picks the real path
like this:
if (hasValidMiddlewareSecret) {
realPath = request.headers.get(ASTRO_PATH_HEADER); // secret checked
} else if (request.headers.get('x-vercel-isr') === '1') {
realPath = url.searchParams.get(ASTRO_PATH_PARAM); // no secret checked
}
The header path is gated by the per build secret and is fine. The ISR branch is not. Two facts make it reachable by anyone:
- The
_isrfunction is publicly addressable. - Vercel sets
x-vercel-isr: 1on requests to it, including direct external requests, so the attacker does not even need to send that header.
So GET /_isr?x_astro_path=/admin sets the internal path to /admin and renders
it. The edge saw only /_isr, which is allowed, so any path based rule on
/admin never fires. In split deployments the edge middleware also runs against
/_isr, and the origin does not run middleware at all, so middleware based auth
is skipped as well.
How this regressed
CVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which
required the secret for every path override and removed the query parameter
source. Commit aa266364fe (PR #16079, "Fix ISR path rewrite to prevent 404")
brought the query parameter back, guarded only by the x-vercel-isr header. That
header is not a security boundary, so the fix was effectively undone for ISR
routes starting in 10.0.3.
Worth noting the contrast: the original report treated Edge Middleware as the
mitigation and scoped the issue to deployments without it. Here, for split
deployments, Edge Middleware is bypassed too, since the attacker reaches /_isr
directly and the middleware only sees /_isr while the origin runs none.
Proof of concept
- Create an Astro app with
output: 'server'and adaptervercel({ isr: true }). - Add a page at
/adminthat returns sensitive content. - Deny
/adminat the edge, for example a Vercel path rule that returns 403, or a middleware auth check in a split (edgeMiddleware: true) build. - Request
/admin. It is blocked (403). - Request
/_isr?x_astro_path=/admin. It returns 200 with the admin content. The response headerX-Vercel-Cache: MISSconfirms it was rendered fresh, not served from an existing cache entry.
What is not affected
- Classic (non split) middleware. It runs inside the origin against the rewritten path, so it still applies to the target route.
- State changing requests. Vercel serves ISR functions for GET only, and returns 403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768 does not reproduce here. Impact is limited to reading (confidentiality).
- Whole deployment protection (Vercel SSO or password), which also covers
/_isr.
Severity
Unauthenticated read of any GET rendered route that is protected only at the edge. No integrity or availability impact because the vector is GET only.
Suggested fix
One option would be to require the secret again for path overrides, the way
PR #15959 did, so the ISR branch stops trusting the client supplied x_astro_path.
The 404 that PR #16079 was fixing would then need another approach that does not
rely on client input.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@astrojs/vercel"
},
"ranges": [
{
"events": [
{
"introduced": "10.0.3"
},
{
"fixed": "11.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-441",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-20T23:25:07Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\nWhen ISR is enabled, the serverless entrypoint lets an unauthenticated request\ndecide which route the origin renders. The internal `_isr` function reads the\n`x_astro_path` query parameter and rewrites the request path to it without any\nauthentication. Edge level access controls only ever see the `/_isr` path, so\nthey do not apply to the route that actually gets rendered. This is the same\nconfused deputy problem as CVE-2026-33768, reachable again through the ISR path.\n\n## Impact\nThis affects apps that use `@astrojs/vercel` with `isr: true` and protect routes\nat the edge. Two common setups are affected:\n\n1. Path rules or firewall deny rules configured on Vercel (for example blocking\n `/admin`).\n2. Split deployments (`edgeMiddleware: true`) where authorization lives in Astro\n middleware, since that middleware runs at the edge and not in the origin.\n\nAn attacker reads any GET rendered route by requesting\n`/_isr?x_astro_path=/the/protected/path`. No credentials are required. The\nprotected content is produced by a fresh origin render, so the attack does not\ndepend on the response being cached first.\n\n## Details\n`packages/integrations/vercel/src/serverless/entrypoint.ts` picks the real path\nlike this:\n\n```js\nif (hasValidMiddlewareSecret) {\n realPath = request.headers.get(ASTRO_PATH_HEADER); // secret checked\n} else if (request.headers.get(\u0027x-vercel-isr\u0027) === \u00271\u0027) {\n realPath = url.searchParams.get(ASTRO_PATH_PARAM); // no secret checked\n}\n```\n\nThe header path is gated by the per build secret and is fine. The ISR branch is\nnot. Two facts make it reachable by anyone:\n\n1. The `_isr` function is publicly addressable.\n2. Vercel sets `x-vercel-isr: 1` on requests to it, including direct external\n requests, so the attacker does not even need to send that header.\n\nSo `GET /_isr?x_astro_path=/admin` sets the internal path to `/admin` and renders\nit. The edge saw only `/_isr`, which is allowed, so any path based rule on\n`/admin` never fires. In split deployments the edge middleware also runs against\n`/_isr`, and the origin does not run middleware at all, so middleware based auth\nis skipped as well.\n\n## How this regressed\nCVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which\nrequired the secret for every path override and removed the query parameter\nsource. Commit aa266364fe (PR #16079, \"Fix ISR path rewrite to prevent 404\")\nbrought the query parameter back, guarded only by the `x-vercel-isr` header. That\nheader is not a security boundary, so the fix was effectively undone for ISR\nroutes starting in 10.0.3.\n\nWorth noting the contrast: the original report treated Edge Middleware as the\nmitigation and scoped the issue to deployments without it. Here, for split\ndeployments, Edge Middleware is bypassed too, since the attacker reaches `/_isr`\ndirectly and the middleware only sees `/_isr` while the origin runs none.\n\n## Proof of concept\n1. Create an Astro app with `output: \u0027server\u0027` and adapter\n `vercel({ isr: true })`.\n2. Add a page at `/admin` that returns sensitive content.\n3. Deny `/admin` at the edge, for example a Vercel path rule that returns 403, or\n a middleware auth check in a split (`edgeMiddleware: true`) build.\n4. Request `/admin`. It is blocked (403).\n5. Request `/_isr?x_astro_path=/admin`. It returns 200 with the admin content.\n The response header `X-Vercel-Cache: MISS` confirms it was rendered fresh, not\n served from an existing cache entry.\n\n## What is not affected\n1. Classic (non split) middleware. It runs inside the origin against the rewritten\n path, so it still applies to the target route.\n2. State changing requests. Vercel serves ISR functions for GET only, and returns\n 403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768\n does not reproduce here. Impact is limited to reading (confidentiality).\n3. Whole deployment protection (Vercel SSO or password), which also covers `/_isr`.\n\n## Severity\nUnauthenticated read of any GET rendered route that is protected only at the edge.\nNo integrity or availability impact because the vector is GET only.\n\n## Suggested fix\nOne option would be to require the secret again for path overrides, the way\nPR #15959 did, so the ISR branch stops trusting the client supplied `x_astro_path`.\nThe 404 that PR #16079 was fixing would then need another approach that does not\nrely on client input.",
"id": "GHSA-x27w-589x-frm2",
"modified": "2026-07-20T23:25:07Z",
"published": "2026-07-20T23:25:07Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/pull/16079"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/pull/17370"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/commit/aa266364fe9e105317b66e218fe04567307fb57f"
},
{
"type": "PACKAGE",
"url": "https://github.com/withastro/astro"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V4"
}
],
"summary": "Astro: Unauthenticated path override in the @astrojs/vercel ISR function"
}
GHSA-X289-C764-465J
Vulnerability from github – Published: 2025-04-01 15:31 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in zookatron MyBookProgress by Stormhill Media allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MyBookProgress by Stormhill Media: from n/a through 1.0.8.
{
"affected": [],
"aliases": [
"CVE-2025-31887"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T15:16:31Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in zookatron MyBookProgress by Stormhill Media allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MyBookProgress by Stormhill Media: from n/a through 1.0.8.",
"id": "GHSA-x289-c764-465j",
"modified": "2026-04-01T18:34:24Z",
"published": "2025-04-01T15:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31887"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/mybookprogress/vulnerability/wordpress-mybookprogress-plugin-1-0-8-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X28G-5XX3-XCPG
Vulnerability from github – Published: 2025-01-24 18:31 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through 5.1.
{
"affected": [],
"aliases": [
"CVE-2025-24625"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-24T18:15:37Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through 5.1.",
"id": "GHSA-x28g-5xx3-xcpg",
"modified": "2026-04-28T21:35:31Z",
"published": "2025-01-24T18:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24625"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/taxonomy-discounts-woocommerce/vulnerability/wordpress-taxonomy-term-and-role-based-discounts-for-woocommerce-plugin-5-1-cross-site-request-forgery-csrf-to-settings-change-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-X28P-92QG-M6C6
Vulnerability from github – Published: 2024-06-14 03:31 – Updated: 2024-06-14 03:31Missing Authorization vulnerability in WriterSystem WooCommerce Easy Duplicate Product.This issue affects WooCommerce Easy Duplicate Product: from n/a through 0.3.0.7.
{
"affected": [],
"aliases": [
"CVE-2023-51523"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-14T02:15:09Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WriterSystem WooCommerce Easy Duplicate Product.This issue affects WooCommerce Easy Duplicate Product: from n/a through 0.3.0.7.",
"id": "GHSA-x28p-92qg-m6c6",
"modified": "2024-06-14T03:31:19Z",
"published": "2024-06-14T03:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51523"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/woo-easy-duplicate-product/wordpress-woocommerce-easy-duplicate-product-plugin-0-3-0-7-broken-access-control-csrf-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X2CM-HG9C-MF5W
Vulnerability from github – Published: 2026-03-26 21:44 – Updated: 2026-04-10 19:42Summary
Leaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected: < 2026.3.22
- Fixed: >= 2026.3.22
- Latest released tag checked:
v2026.3.23-2(630f1479c44f78484dfa21bb407cbe6f171dac87) - Latest published npm version checked:
2026.3.23-2
Fix Commit(s)
7679eb375294941b02214c234aff3948796969d0
Release Status
The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.
Code-Level Confirmation
- src/auto-reply/reply/commands-subagents/action-send.ts now threads controller context through the send path.
- src/agents/subagent-control.ts now blocks send attempts unless the requester owns the target and has controlScope="children".
OpenClaw thanks @space08 for reporting.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35662"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-26T21:44:41Z",
"nvd_published_at": "2026-04-10T17:17:07Z",
"severity": "MODERATE"
},
"details": "## Summary\nLeaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: \u003c 2026.3.22\n- Fixed: \u003e= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `7679eb375294941b02214c234aff3948796969d0`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/auto-reply/reply/commands-subagents/action-send.ts now threads controller context through the send path.\n- src/agents/subagent-control.ts now blocks send attempts unless the requester owns the target and has controlScope=\"children\".\n\nOpenClaw thanks @space08 for reporting.",
"id": "GHSA-x2cm-hg9c-mf5w",
"modified": "2026-04-10T19:42:27Z",
"published": "2026-03-26T21:44:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-x2cm-hg9c-mf5w"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35662"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/7679eb375294941b02214c234aff3948796969d0"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-missing-controlscope-enforcement-in-send-action"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions"
}
GHSA-X2F4-46J7-4VR6
Vulnerability from github – Published: 2025-01-27 15:30 – Updated: 2026-04-01 18:33Missing Authorization vulnerability in Houzez.co Houzez. This issue affects Houzez: from n/a through 3.4.0.
{
"affected": [],
"aliases": [
"CVE-2025-24747"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-27T15:15:17Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Houzez.co Houzez. This issue affects Houzez: from n/a through 3.4.0.",
"id": "GHSA-x2f4-46j7-4vr6",
"modified": "2026-04-01T18:33:30Z",
"published": "2025-01-27T15:30:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24747"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-3-4-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X2F8-G477-73FR
Vulnerability from github – Published: 2025-11-21 09:30 – Updated: 2026-04-08 21:33The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saveDeployedContract' function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option tokenico_deployed_contracts, poisoning the smart contract addresses displayed.
{
"affected": [],
"aliases": [
"CVE-2025-11773"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-21T08:15:50Z",
"severity": "MODERATE"
},
"details": "The Cryptocurrency (Token), Launchpad (Presale), ICO \u0026 IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027saveDeployedContract\u0027 function in all versions up to, and including, 2.4.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the WordPress option `tokenico_deployed_contracts`, poisoning the smart contract addresses displayed.",
"id": "GHSA-x2f8-g477-73fr",
"modified": "2026-04-08T21:33:08Z",
"published": "2025-11-21T09:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11773"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop/tags/2.4.6/app/RestAPI.php#L108"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop\u0026new=3449189%40tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e02597b1-eea6-4fdd-baeb-527201d1c61f?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.