CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2025-31854"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-01T15:16:26Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple Sticky Add To Cart For WooCommerce: from n/a through 1.4.5.",
  "id": "GHSA-8cq7-m6j9-qw55",
  "modified": "2026-04-01T18:34:22Z",
  "published": "2025-04-01T15:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31854"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/sticky-add-to-cart-woo/vulnerability/wordpress-simple-sticky-add-to-cart-for-woocommerce-plugin-1-4-5-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-120551"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-03T05:18:32Z",
    "severity": "MODERATE"
  },
  "details": "The WP Compress \u2013 Instant Performance \u0026 Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints \u2014 enabling full control over cache purging, file deletion, opcode cache invalidation, and other privileged plugin operations. This vulnerability only affects fresh installations or lite/free-mode installs where no api_key is already stored, as the sole guard fails open when the stored key is absent.",
  "id": "GHSA-8cqm-xp6w-w8hf",
  "modified": "2026-11-03T06:31:13Z",
  "published": "2026-11-03T06:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120551"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/connect.class.php#L103"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L29"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/tags/7.21.27/classes/mainwp.class.php#L9"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3680035%40wp-compress-image-optimizer\u0026new=3680035%40wp-compress-image-optimizer"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-85390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-03T19:17:30Z",
    "severity": "HIGH"
  },
  "details": "Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.",
  "id": "GHSA-8cvg-rxfw-4pf6",
  "modified": "2026-09-03T21:31:15Z",
  "published": "2026-09-03T21:31:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85390"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bluewave-labs/Checkmate/issues/3916"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bluewave-labs/Checkmate"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/checkRoutes.ts"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/maintenanceWindowRoutes.ts"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/notificationRoutes.ts"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/checkmate-through-3.11.0-missing-authorization-on-maintenance-window-notification-and-check-deletion-routes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-23684"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-22T15:15:21Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Eugen Bobrowski Debug Tool allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Debug Tool: from n/a through 2.2.",
  "id": "GHSA-8cw5-2qqr-3xvc",
  "modified": "2026-04-01T18:33:21Z",
  "published": "2025-01-22T15:32:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23684"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/debug-tool/vulnerability/wordpress-debug-tool-plugin-2-2-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-09T09:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Pluggabl LLC Booster Plus for WooCommerce.This issue affects Booster Plus for WooCommerce: from n/a before 7.1.2.",
  "id": "GHSA-8cw5-9cww-c669",
  "modified": "2024-06-09T09:30:34Z",
  "published": "2024-06-09T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52232"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/booster-plus-for-woocommerce/wordpress-booster-plus-for-woocommerce-plugin-7-1-2-authenticated-arbitrary-post-page-deletion-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "studiocms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-24134"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-27T22:13:52Z",
    "nvd_published_at": "2026-01-28T00:15:50Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nStudioCMS contains a Broken Object Level Authorization (BOLA) vulnerability in the Content Management feature that allows users with the \"Visitor\" role to access draft content created by Editor/Admin/Owner users.\n\n### Details\n**The Issue:**\nThe endpoint `/dashboard/content-management/edit?edit={UUID}` validates user authentication but does NOT validate:\n1. User role (should require Editor/Admin/Owner)\n2. Content ownership (should verify the draft belongs to the user)\n\nThis allows users with \"Visitor\" role (lowest privilege) to access draft content created by Editor/Admin/Owner users by directly accessing the edit URL with the content UUID.\n\n### PoC\n   - **User A:** Editor role (example username: `dummy04`)\n   - **User B:** Visitor role (example username: `dummy01`)\n\n**Reproduction Steps:**\n\n**Step 1 - Create draft as Editor:**\n\n1. Login as User A (Editor role)\n2. Navigate to: `http://localhost:4321/dashboard/content-management`\n3. Create new content (it will stay as draft)\n4. After saving, note the UUID in the URL:\n````\n   http://localhost:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148\n````\n   Copy this UUID: `bad87630-69a4-4cd6-bcb2-6965839dc148`\n\n**Step 2 - Access draft as Visitor:**\n\n1. Login as Visitor and get auth_session cookie\n```\ncurl -X POST \"http://127.0.0.1:4321/studiocms_api/auth/login\" -F \u0027username=dummy01\u0027 -F \u0027password=dummy01pass$\u0027\n```\n\u003cimg width=\"1128\" height=\"376\" alt=\"01\" src=\"https://github.com/user-attachments/assets/86c5290e-e7a2-470e-bbf5-5f5247eddec1\" /\u003e\n\n2. Proof of Visitor permission\n\u003cimg width=\"1899\" height=\"450\" alt=\"02\" src=\"https://github.com/user-attachments/assets/aabd47d3-163f-4a56-8296-08bd40c5ccdc\" /\u003e\n\n3. Access Editor\u0027s draft using the UUID\n```\ncurl \"http://127.0.0.1:4321/dashboard/content-management/edit?edit=bad87630-69a4-4cd6-bcb2-6965839dc148\" -H \"Cookie: auth_session=qvawh6zv23hc2spu6xx7pzgrnn4rpd3q\" -v\n```\n\n**Result:** Returns full HTML page with draft content (200 OK)\n\n### Impact\n**Impact Scenarios:**\n\n1. **Information Disclosure:**\n   - Visitor users can read unpublished drafts containing sensitive information\n   - Drafts may contain confidential business information, unreleased announcements, or proprietary content\n   - Competitive intelligence could be gathered from draft content\n\n2. **Privacy Violation:**\n   - Personal notes, work-in-progress content, or internal communications in drafts exposed\n   - Violation of content creator privacy expectations\n\n3. **Business Impact:**\n   - Premature disclosure of marketing campaigns, product launches, or announcements\n   - Loss of competitive advantage if draft strategies are exposed\n   - Potential compliance issues if drafts contain regulated information\n\n4. **Complete RBAC Bypass:**\n   - The entire role-based access control system for draft content is bypassed\n   - \"Visitor\" role becomes equivalent to \"Editor\" for read access to drafts\n   - Undermines the trust model of multi-user content management",
  "id": "GHSA-8cw6-53m5-4932",
  "modified": "2026-01-29T03:43:54Z",
  "published": "2026-01-27T22:13:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8cw6-53m5-4932"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24134"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/commit/efc10bee20db090fdd75463622c30dda390c50ad"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withstudiocms/studiocms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms%400.2.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "StudioCMS has Authorization Bypass Through User-Controlled Key"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-33596"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-29T09:15:08Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations.This issue affects Five Star Restaurant Reservations: from n/a through 2.6.16.",
  "id": "GHSA-8f29-7cmc-83vw",
  "modified": "2026-04-28T21:35:00Z",
  "published": "2024-04-29T09:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33596"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/restaurant-reservations/wordpress-five-star-restaurant-reservations-plugin-2-6-16-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-36510"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T15:15:16Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in Reservation Diary ReDi Restaurant Reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ReDi Restaurant Reservation: from n/a through 23.0211.",
  "id": "GHSA-8f38-9x5m-gx9w",
  "modified": "2026-04-28T21:35:23Z",
  "published": "2024-12-13T15:30:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36510"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/redi-restaurant-reservation/vulnerability/wordpress-redi-restaurant-reservation-plugin-23-0211-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-44020"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-01T15:15:52Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Prasad Kirpekar WP Free SSL \u2013 Free SSL Certificate for WordPress and force HTTPS allows .\n\nThis issue affects WP Free SSL \u2013 Free SSL Certificate for WordPress and force HTTPS: from n/a through 1.2.6.",
  "id": "GHSA-8f3j-g8vx-2hgj",
  "modified": "2026-04-01T18:32:16Z",
  "published": "2024-11-01T15:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44020"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wp-free-ssl/vulnerability/wordpress-wp-free-ssl-plugin-1-2-6-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wp-free-ssl/wordpress-wp-free-ssl-plugin-1-2-6-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-40729"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-15T11:16:35Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in bPlugins 3D viewer \u2013 Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer \u2013 Embed 3D Models: from n/a through \u003c= 1.8.5.",
  "id": "GHSA-8f3x-4qgm-mmjv",
  "modified": "2026-04-29T12:33:06Z",
  "published": "2026-04-16T15:31:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40729"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/3d-viewer/vulnerability/wordpress-3d-viewer-embed-3d-models-plugin-1-8-5-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}