CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2025-6685"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-02T20:15:37Z",
    "severity": "HIGH"
  },
  "details": "ATEN eco DC Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of ATEN eco DC. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the web-based interface. The issue results from the lack of validating the assigned user role when handling requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-26647.",
  "id": "GHSA-mvpc-xjxr-w8vj",
  "modified": "2025-09-02T21:30:58Z",
  "published": "2025-09-02T21:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6685"
    },
    {
      "type": "WEB",
      "url": "https://www.aten.com/global/en/supportcenter/info/security-advisory/25"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-650"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-23545"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-19T09:16:12Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through \u003c= 3.0.4.",
  "id": "GHSA-mvpq-f8gc-p5w2",
  "modified": "2026-02-26T21:31:27Z",
  "published": "2026-02-19T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23545"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/aruba-hispeed-cache/vulnerability/wordpress-aruba-hispeed-cache-plugin-3-0-4-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-54310"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T15:15:36Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Gou Manage My Account Menu: from n/a through 1.0.1.8.",
  "id": "GHSA-mvpw-6hhp-gcq9",
  "modified": "2026-04-01T18:32:44Z",
  "published": "2024-12-13T15:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54310"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/gou-wc-account-tabs/vulnerability/wordpress-gou-manage-my-account-menu-plugin-1-0-1-8-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-27355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-23T12:17:17Z",
    "severity": "MODERATE"
  },
  "details": "Unauthenticated Broken Access Control in Ditty \u003c= 3.1.66 versions.",
  "id": "GHSA-mvpx-5vgf-mj2q",
  "modified": "2026-07-23T12:32:24Z",
  "published": "2026-07-23T12:32:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27355"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-66-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-58616"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-03T15:15:44Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Frisbii Frisbii Pay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Frisbii Pay: from n/a through 1.8.2.1.",
  "id": "GHSA-mvqw-fhqr-96w3",
  "modified": "2026-04-01T18:36:02Z",
  "published": "2025-09-03T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58616"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/reepay-checkout-gateway/vulnerability/wordpress-frisbii-pay-plugin-1-8-2-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-39995"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T15:15:20Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through 1.3.7.",
  "id": "GHSA-mvr3-fvpv-v5pf",
  "modified": "2026-04-28T21:35:25Z",
  "published": "2024-12-13T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39995"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/portfolio-and-projects/vulnerability/wordpress-portfolio-and-projects-plugin-1-3-7-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-7689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-29T10:15:29Z",
    "severity": "HIGH"
  },
  "details": "The Hydra Booking plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the tfhb_reset_password_callback() function in versions 1.1.0 to 1.1.18. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the password of an Administrator user, achieving full privilege escalation.",
  "id": "GHSA-mvv5-62qm-f67x",
  "modified": "2025-07-29T12:31:21Z",
  "published": "2025-07-29T12:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7689"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3334439"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/hydra-booking/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93027dd1-f36a-4954-a8d2-b77bbbaef6fb?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.0"
            },
            {
              "fixed": "0.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59226"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T16:55:30Z",
    "nvd_published_at": "2026-07-09T17:17:04Z",
    "severity": "LOW"
  },
  "details": "**Title:** Scheduled automations continue after pending-user deactivation and stored model ACL revocation\n\n### Summary\n\nOpen WebUI documents `pending` as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with `get_verified_user()` (which rejects `pending`), while automation create/update/run routes additionally require the `features.automations` permission. Two paths missed that lifecycle gate, so a deactivated (`pending`) account could keep acting through the background automation scheduler:\n\n1. **Scheduler did not re-gate the owner.** When a stored automation became due, `execute_automation()` rehydrated the owner with `Users.get_user_by_id(...)` and re-entered the chat completion pipeline without re-checking that the owner was still `user`/`admin` or still held `features.automations`. A still-active automation therefore kept running after its owner was deactivated.\n2. **Model ACL only enforced for exact role `user`.** `check_model_access()` applied private-model grants only when `user.role == \"user\"`, so a `pending` principal fell through a branch that denies a normal non-owner `user`.\n\nNet effect: a deactivated account could continue scheduled chat generation through the background worker, consuming the operator\u0027s configured model-provider credentials and reaching a stored automation model ID that its current role/ACL state would no longer permit through normal routes.\n\n### Impact\n\nA `pending`/deactivated account continues to execute due scheduled automations after its access has been revoked, consuming the operator\u0027s provider credentials, quota and shared capacity, and bypassing the private-model ACL for the automation\u0027s stored model ID. Exploitation requires a previously created active automation and a later transition to `pending` (deactivation or approval rollback), so it is bounded and not interactive. It does not grant unauthenticated access, account takeover, code execution, or cross-user data exfiltration.\n\n### Patched\n\nIn 0.10.0:\n\n- `execute_automation()` aborts and records an error unless the rehydrated owner is still `user` or `admin` and (for non-admins) still holds `features.automations`, so a deactivated or de-permissioned owner\u0027s due automation no longer runs.\n- `check_model_access()` enforces model ACLs for every non-admin role rather than only the exact role `user`, so a `pending` or otherwise unrecognised role no longer falls through.\n\n### Credits\n\n@rexpository",
  "id": "GHSA-mvx4-532p-xfm9",
  "modified": "2026-07-24T16:55:30Z",
  "published": "2026-07-24T16:55:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-mvx4-532p-xfm9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59226"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/pull/26047"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/920b655f4689e2118de928fbc936f6ebd4fed396"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.10.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-42763"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-25T23:16:32Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in SePay team SePay Gateway allows Retrieve Embedded Sensitive Data.\n\nThis issue affects SePay Gateway: from n/a through 1.1.20.",
  "id": "GHSA-mvxg-x6w9-jq73",
  "modified": "2026-05-26T13:30:52Z",
  "published": "2026-05-26T13:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42763"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/sepay-gateway/vulnerability/wordpress-sepay-gateway-plugin-1-1-20-sensitive-data-exposure-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-2381"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-14T12:29:00Z",
    "severity": "HIGH"
  },
  "details": "SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.",
  "id": "GHSA-mvxp-973j-8w5f",
  "modified": "2022-05-13T01:51:07Z",
  "published": "2022-05-13T01:51:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2381"
    },
    {
      "type": "WEB",
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2545842"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103010"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}