CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
19710 vulnerabilities reference this CWE, most recent first.
GHSA-57R3-6FX2-P6RG
Vulnerability from github – Published: 2024-04-01 15:30 – Updated: 2025-04-15 21:31Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.5.
{
"affected": [],
"aliases": [
"CVE-2024-31099"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-01T14:15:07Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Averta Shortcodes and extra features for Phlox theme.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.15.5.",
"id": "GHSA-57r3-6fx2-p6rg",
"modified": "2025-04-15T21:31:26Z",
"published": "2024-04-01T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31099"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/auxin-elements/wordpress-phlox-core-elements-plugin-2-15-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-57R7-HGXM-J62G
Vulnerability from github – Published: 2026-01-17 03:30 – Updated: 2026-01-17 03:30The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'change_wallet_fund_request_status_callback' function in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to manipulate wallet withdrawal requests and arbitrarily increase their wallet balance or decrease other users' balances.
{
"affected": [],
"aliases": [
"CVE-2025-14450"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-17T03:16:03Z",
"severity": "MODERATE"
},
"details": "The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027change_wallet_fund_request_status_callback\u0027 function in all versions up to, and including, 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to manipulate wallet withdrawal requests and arbitrarily increase their wallet balance or decrease other users\u0027 balances.",
"id": "GHSA-57r7-hgxm-j62g",
"modified": "2026-01-17T03:30:24Z",
"published": "2026-01-17T03:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14450"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/tags/2.7.2/includes/class-wallet-system-ajaxhandler.php#L140"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wallet-system-for-woocommerce/trunk/includes/class-wallet-system-ajaxhandler.php#L140"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3435898%40wallet-system-for-woocommerce\u0026new=3435898%40wallet-system-for-woocommerce\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/466a5315-fc05-4b96-9dfd-17862fc406c5?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-57RF-CVCF-CGQ7
Vulnerability from github – Published: 2026-01-22 18:30 – Updated: 2026-01-29 00:31Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.
{
"affected": [],
"aliases": [
"CVE-2025-67967"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-22T17:16:06Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through \u003c= 1.3.3.",
"id": "GHSA-57rf-cvcf-cgq7",
"modified": "2026-01-29T00:31:10Z",
"published": "2026-01-22T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67967"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/lawyer-directory/vulnerability/wordpress-lawyer-directory-plugin-1-3-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-57RW-93XC-4HPV
Vulnerability from github – Published: 2022-12-20 21:30 – Updated: 2022-12-20 21:30In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege in wifi settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231583603
{
"affected": [],
"aliases": [
"CVE-2022-20529"
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-16T16:15:00Z",
"severity": "LOW"
},
"details": "In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege in wifi settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231583603",
"id": "GHSA-57rw-93xc-4hpv",
"modified": "2022-12-20T21:30:19Z",
"published": "2022-12-20T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20529"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-57V5-WQX3-CGJ4
Vulnerability from github – Published: 2026-09-08 17:53 – Updated: 2026-09-08 17:53Scope note (please read first)
This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit acfc02ee8 ("Improve database field visibility across views", #11020) and is live on v3.7.4-alpha.1, so it will ship in v3.7.4 unless gated first. No released stable version is affected.
Summary
/api/av/getAttributeViewFieldViews is registered with CheckAuth only and applies no publish-access filtering. Given a database avID, it returns the complete view structure of that database: every view's name, icon, layout type and the per-field Hidden flag, regardless of whether the caller is authorized to see that database or those views.
The route registered immediately before it, getAttributeViewKeys, does gate reader roles.
Details
| Item | Detail |
|---|---|
| Route | kernel/api/router.go:530 POST /api/av/getAttributeViewFieldViews → model.CheckAuth → getAttributeViewFieldViews |
| Middleware | CheckAuth only, no CheckReadonly, no CheckAdminRole |
| Guard in handler | None. Greps for IsReadOnlyRoleContext, publishAccess and Filter* all return zero matches |
| Exposed | For each entry in attrView.Views: ID, Icon, Name, Type, and the Hidden flag for the requested field |
| Introduced by | acfc02ee8 (feature), dev branch only |
The leak path. The handler binds avID and keyID, validating them against the ID pattern only, then calls GetAttributeViewFieldViews(avID, keyID). That function calls av.ParseAttributeView(avID), which reads the database's storage file directly by identifier. There is no ownership check and no publish-access check anywhere on the path. The result is a per-view record for every view the database defines.
What a reader learns is author-written: view names are typed by the user, and layout type distinguishes a table from a gallery or kanban. The Hidden flag additionally reveals, per view, which fields the author chose to conceal.
Guarded sibling, one route earlier. getAttributeViewKeys (kernel/api/router.go:529) is also reader-reachable and does gate:
if model.IsReadOnlyRoleContext(c) {
blockAttributeViewKeys = model.FilterBlockAttributeViewKeysByPublishAccess(c, publishAccess, ...)
}
The new route at 530 applies nothing equivalent.
This is worth flagging as more than an isolated omission. acfc02ee8 added a new reader-reachable attribute-view endpoint during the same development cycle in which the surrounding attribute-view endpoints were being hardened. The same pattern produced an earlier exposure: f2d966659, which added encrypted-notebook unlock status for plugin consumption, created a reader-reachable disclosure on a surface that was otherwise being tightened. A check on new reader-reachable routes against the gating applied to their registered neighbours would catch this class before release.
Reachability, stated honestly. The endpoint requires a valid avID and keyID. renderAttributeView supplies both to a reader for any database embedded in a document the reader can access. The realistic target is therefore a partially-published database: the document publishes one view, and this endpoint enumerates the existence, name, layout type and hidden-field configuration of the database's other views, including views the author did not publish. Against a database with no reader-accessible surface at all, obtaining the identifiers is harder, particularly since the getAttributeViewKeysByID enumeration path was closed on the development branch. The severity below reflects that constraint rather than a worst case.
Proof of Concept
Precondition: v3.7.4-alpha.1 build, publish mode enabled (default port 6808), anonymous when Publish.Auth.Enable is false, otherwise any publish reader account. A database embedded in a reader-accessible document, with at least one additional view that is not published.
Step 1, obtain the identifiers through the reader-accessible path:
POST http://127.0.0.1:6808/api/av/renderAttributeView
{"id":"<block id of the embedded database in a published doc>"}
→ 200, returns the published view together with its key identifiers
Step 2, enumerate the rest of the database's views:
POST http://127.0.0.1:6808/api/av/getAttributeViewFieldViews
{"avID":"<avID from step 1>","keyID":"<keyID from step 1>"}
→ 200, returns a record per view: ID, Icon, Name, Type, Hidden
The response includes views that were never published, disclosing their author-written names, their layout types, and which field is hidden in each.
Impact
An anonymous reader in publish mode, or any publish RoleReader, can enumerate the full view structure of a database when only part of that database is published. View names are author-written free text and frequently describe the data they filter, so this discloses the existence and subject matter of unpublished views. The per-field Hidden flags additionally reveal the author's concealment choices across those views. Confidentiality only, with no integrity or availability impact, and bounded by the reader needing identifiers obtainable from a reader-accessible database.
Suggested fix
Gate the handler for read-only roles, mirroring getAttributeViewKeys: when IsReadOnlyRoleContext(c) holds, resolve the block that owns the avID and apply the publish-access check before returning any view record, or filter the returned set through the same FilterBlockAttributeViewKeysByPublishAccess path its neighbour uses.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan/kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260726004013-64c26e74bb82"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T17:53:44Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Scope note (please read first)\n\nThis endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit `acfc02ee8` (\"Improve database field visibility across views\", #11020) and is live on `v3.7.4-alpha.1`, so it will ship in v3.7.4 unless gated first. No released stable version is affected.\n\n### Summary\n\n`/api/av/getAttributeViewFieldViews` is registered with `CheckAuth` only and applies no publish-access filtering. Given a database `avID`, it returns the complete view structure of that database: every view\u0027s name, icon, layout type and the per-field `Hidden` flag, regardless of whether the caller is authorized to see that database or those views.\n\nThe route registered immediately before it, `getAttributeViewKeys`, does gate reader roles.\n\n### Details\n\n| Item | Detail |\n|---|---|\n| Route | `kernel/api/router.go:530` `POST /api/av/getAttributeViewFieldViews` \u2192 `model.CheckAuth` \u2192 `getAttributeViewFieldViews` |\n| Middleware | `CheckAuth` only, no `CheckReadonly`, no `CheckAdminRole` |\n| Guard in handler | None. Greps for `IsReadOnlyRoleContext`, `publishAccess` and `Filter*` all return zero matches |\n| Exposed | For each entry in `attrView.Views`: `ID`, `Icon`, `Name`, `Type`, and the `Hidden` flag for the requested field |\n| Introduced by | `acfc02ee8` (feature), dev branch only |\n\n**The leak path.** The handler binds `avID` and `keyID`, validating them against the ID pattern only, then calls `GetAttributeViewFieldViews(avID, keyID)`. That function calls `av.ParseAttributeView(avID)`, which reads the database\u0027s storage file directly by identifier. There is no ownership check and no publish-access check anywhere on the path. The result is a per-view record for every view the database defines.\n\nWhat a reader learns is author-written: view names are typed by the user, and layout type distinguishes a table from a gallery or kanban. The `Hidden` flag additionally reveals, per view, which fields the author chose to conceal.\n\n**Guarded sibling, one route earlier.** `getAttributeViewKeys` (`kernel/api/router.go:529`) is also reader-reachable and does gate:\n\n```go\nif model.IsReadOnlyRoleContext(c) {\n blockAttributeViewKeys = model.FilterBlockAttributeViewKeysByPublishAccess(c, publishAccess, ...)\n}\n```\n\nThe new route at 530 applies nothing equivalent.\n\nThis is worth flagging as more than an isolated omission. `acfc02ee8` added a new reader-reachable attribute-view endpoint during the same development cycle in which the surrounding attribute-view endpoints were being hardened. The same pattern produced an earlier exposure: `f2d966659`, which added encrypted-notebook unlock status for plugin consumption, created a reader-reachable disclosure on a surface that was otherwise being tightened. A check on new reader-reachable routes against the gating applied to their registered neighbours would catch this class before release.\n\n**Reachability, stated honestly.** The endpoint requires a valid `avID` and `keyID`. `renderAttributeView` supplies both to a reader for any database embedded in a document the reader can access. The realistic target is therefore a partially-published database: the document publishes one view, and this endpoint enumerates the existence, name, layout type and hidden-field configuration of the database\u0027s other views, including views the author did not publish. Against a database with no reader-accessible surface at all, obtaining the identifiers is harder, particularly since the `getAttributeViewKeysByID` enumeration path was closed on the development branch. The severity below reflects that constraint rather than a worst case.\n\n### Proof of Concept\n\nPrecondition: `v3.7.4-alpha.1` build, publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. A database embedded in a reader-accessible document, with at least one additional view that is not published.\n\nStep 1, obtain the identifiers through the reader-accessible path:\n\n```\nPOST http://127.0.0.1:6808/api/av/renderAttributeView\n{\"id\":\"\u003cblock id of the embedded database in a published doc\u003e\"}\n\n\u2192 200, returns the published view together with its key identifiers\n```\n\nStep 2, enumerate the rest of the database\u0027s views:\n\n```\nPOST http://127.0.0.1:6808/api/av/getAttributeViewFieldViews\n{\"avID\":\"\u003cavID from step 1\u003e\",\"keyID\":\"\u003ckeyID from step 1\u003e\"}\n\n\u2192 200, returns a record per view: ID, Icon, Name, Type, Hidden\n```\n\nThe response includes views that were never published, disclosing their author-written names, their layout types, and which field is hidden in each.\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, can enumerate the full view structure of a database when only part of that database is published. View names are author-written free text and frequently describe the data they filter, so this discloses the existence and subject matter of unpublished views. The per-field `Hidden` flags additionally reveal the author\u0027s concealment choices across those views. Confidentiality only, with no integrity or availability impact, and bounded by the reader needing identifiers obtainable from a reader-accessible database.\n\n### Suggested fix\n\nGate the handler for read-only roles, mirroring `getAttributeViewKeys`: when `IsReadOnlyRoleContext(c)` holds, resolve the block that owns the `avID` and apply the publish-access check before returning any view record, or filter the returned set through the same `FilterBlockAttributeViewKeysByPublishAccess` path its neighbour uses.",
"id": "GHSA-57v5-wqx3-cgj4",
"modified": "2026-09-08T17:53:44Z",
"published": "2026-09-08T17:53:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/commit/64c26e74bb82c24a73513107684b91cc01335fab"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews"
}
GHSA-57VV-VQRH-49WX
Vulnerability from github – Published: 2026-03-01 00:30 – Updated: 2026-03-01 00:30wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.
{
"affected": [],
"aliases": [
"CVE-2026-28554"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-28T22:16:00Z",
"severity": "MODERATE"
},
"details": "wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.",
"id": "GHSA-57vv-vqrh-49wx",
"modified": "2026-03-01T00:30:14Z",
"published": "2026-03-01T00:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28554"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/wpforo"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/wpforo/#developers"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/wpforo-forum-missing-authorization-via-post-approval-ajax-handler"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-57VW-F9G4-3923
Vulnerability from github – Published: 2026-10-29 06:30 – Updated: 2026-10-29 12:30The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
{
"affected": [],
"aliases": [
"CVE-2026-78395"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-29T06:17:24Z",
"severity": "MODERATE"
},
"details": "The Link Library WordPress plugin before 7.10.0 does not re-check the selected library\u0027s own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.",
"id": "GHSA-57vw-f9g4-3923",
"modified": "2026-10-29T12:30:35Z",
"published": "2026-10-29T06:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78395"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/e2cf7d5f-b9c9-4320-9fc8-4ac8c6d24f78"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-57XQ-C793-MR49
Vulnerability from github – Published: 2025-06-06 15:30 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in WP Compress WP Compress for MainWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Compress for MainWP: from n/a through 6.30.32.
{
"affected": [],
"aliases": [
"CVE-2025-30932"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T13:15:33Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WP Compress WP Compress for MainWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Compress for MainWP: from n/a through 6.30.32.",
"id": "GHSA-57xq-c793-mr49",
"modified": "2026-04-01T18:35:19Z",
"published": "2025-06-06T15:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30932"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-compress-mainwp/vulnerability/wordpress-wp-compress-for-mainwp-6-30-32-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-582Q-V28R-7CXR
Vulnerability from github – Published: 2026-07-01 17:57 – Updated: 2026-07-01 17:57Summary
GeoNetwork's Elasticsearch-backed search API is responsible for injecting access-control and visibility filters into every request before it reaches the underlying Elasticsearch index. Under certain request conditions, that filtering step does not run, allowing an unauthenticated user to retrieve indexed metadata records that should be restricted, including records limited to specific groups.
Details
The search proxy layer forwards client-supplied search requests to Elasticsearch after adding GeoNetwork's own access-control and filter clauses. A flaw in how that filter-injection step is triggered means it can be skipped under certain conditions, so the affected request reaches Elasticsearch without the intended access restrictions applied.
Impact
This is an authorization bypass leading to information disclosure (CWE-862: Missing Authorization). The skipped filter step is responsible for enforcing several layers of access control at once: group-based record visibility, draft record exclusion, record ownership checks, and portal-specific filtering.
Any public-facing GeoNetwork 4.x instance (4.0.0-alpha.1 through 4.4.10) is affected. An unauthenticated attacker can retrieve the full contents of metadata records that should not be publicly visible.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.geonetwork-opensource:geonetwork"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0-alpha.1"
},
{
"last_affected": "4.0.6-0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.15"
},
"package": {
"ecosystem": "Maven",
"name": "org.geonetwork-opensource:geonetwork"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.4.10-0"
},
"package": {
"ecosystem": "Maven",
"name": "org.geonetwork-opensource:geonetwork"
},
"ranges": [
{
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-46487"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T17:57:13Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nGeoNetwork\u0027s Elasticsearch-backed search API is responsible for injecting access-control and visibility filters into every request before it reaches the underlying Elasticsearch index. Under certain request conditions, that filtering step does not run, allowing an unauthenticated user to retrieve indexed metadata records that should be restricted, including records limited to specific groups.\n\n### Details\nThe search proxy layer forwards client-supplied search requests to Elasticsearch after adding GeoNetwork\u0027s own access-control and filter clauses. A flaw in how that filter-injection step is triggered means it can be skipped under certain conditions, so the affected request reaches Elasticsearch without the intended access restrictions applied.\n\n### Impact\nThis is an authorization bypass leading to information disclosure (CWE-862: Missing Authorization). The skipped filter step is responsible for enforcing several layers of access control at once: group-based record visibility, draft record exclusion, record ownership checks, and portal-specific filtering.\n\nAny public-facing GeoNetwork 4.x instance (4.0.0-alpha.1 through 4.4.10) is affected. An unauthenticated attacker can retrieve the full contents of metadata records that should not be publicly visible.",
"id": "GHSA-582q-v28r-7cxr",
"modified": "2026-07-01T17:57:13Z",
"published": "2026-07-01T17:57:13Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-582q-v28r-7cxr"
},
{
"type": "PACKAGE",
"url": "https://github.com/geonetwork/core-geonetwork"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field"
}
GHSA-582X-674X-HC38
Vulnerability from github – Published: 2026-10-28 09:31 – Updated: 2026-10-28 09:31The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.
{
"affected": [],
"aliases": [
"CVE-2026-85655"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-28T08:16:30Z",
"severity": "MODERATE"
},
"details": "The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media \u2014 including Administrator-owned posts \u2014 making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress\u0027s standard admin UI and REST API would otherwise forbid that user from editing.",
"id": "GHSA-582x-674x-hc38",
"modified": "2026-10-28T09:31:56Z",
"published": "2026-10-28T09:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85655"
},
{
"type": "WEB",
"url": "https://github.com/short-pixel-optimizer/enable-media-replace/releases/tag/v4.2.3"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/build/shortpixel/replacer/src/Replacer.php#L250"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/Controller/ReplaceController.php#L253"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L59"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.1.9/classes/ViewController/UploadViewController.php#L66"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/build/shortpixel/replacer/src/Replacer.php#L250"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/Controller/ReplaceController.php#L253"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L59"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/enable-media-replace/tags/4.2.2/classes/ViewController/UploadViewController.php#L66"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aff42473-63c6-41ca-8312-058f213e2302?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.