CWE-862
Weakness Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Dimensions
- Behavior-Property: Missing
- Behavior-Type: Authorization
Mapping guidance
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
Relationships and members
Modes of introduction
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Authorization weaknesses may arise when a single-user application is ported to a multi-user environment.
A developer may introduce authorization weaknesses because of a lack of understanding about the underlying technologies. For example, a developer may assume that attackers cannot modify certain inputs such as headers or cookies.
Detection methods
Automated Static Analysis
Automated static analysis is useful for detecting commonly-used idioms for authorization. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authorization libraries.
Generally, automated static analysis tools have difficulty detecting custom authorization schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an authorization check; an automated technique that detects the absence of authorization may report false positives.
Effectiveness: Limited
Automated Dynamic Analysis
Automated dynamic analysis may find many or all possible interfaces that do not require authorization, but manual analysis is required to determine if the lack of authorization violates business logic.
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
Specifically, manual static analysis is useful for evaluating the correctness of custom authorization mechanisms.
Effectiveness: Moderate
These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules. However, manual efforts might not achieve desired code coverage within limited time constraints.
Manual Static Analysis - Binary or Bytecode
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness: SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Web Application Scanner
Web Services Scanner
Database Scanners
Effectiveness: SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Host Application Interface Scanner
Fuzz Tester
Framework-based Fuzzer
Effectiveness: SOAR Partial
Manual Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Focused Manual Spotcheck - Focused manual analysis of source
Manual Source Code Review (not inspections)
Effectiveness: SOAR Partial
Automated Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
Architecture or Design Review
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction
Effectiveness: High
Notes
Terminology
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
Content history
Suggested mappings to ISA/IEC 62443.
Provided diagram to improve CWE usability
updated Demonstrative_Examples, Related_Attack_Patterns, Relationships
updated Potential_Mitigations, References, Relationships
updated Demonstrative_Examples, Observed_Examples, References, Relationships
updated Potential_Mitigations
updated Relationships
updated Detection_Factors
updated Relationships
updated Applicable_Platforms, Modes_of_Introduction, References, Relationships
updated References
updated Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms, Observed_Examples
updated Observed_Examples, Related_Attack_Patterns, Relationships
updated Relationships
updated Relationships
updated Observed_Examples
updated Description, Potential_Mitigations
updated References, Relationships, Taxonomy_Mappings
updated Mapping_Notes, Relationships, Taxonomy_Mappings
updated Common_Consequences, Description, Diagram, Relationships, Terminology_Notes
updated Applicable_Platforms, Detection_Factors, Observed_Examples, References
updated Applicable_Platforms, Relationships, Weakness_Ordinalities
updated Applicable_Platforms, Observed_Examples, Relationships
updated Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
19867 vulnerabilities reference this CWE, most recent first.
GHSA-8XGJ-5PJF-7XMJ
Vulnerability from github – Published: 2025-01-07 18:30 – Updated: 2026-04-01 18:33Missing Authorization vulnerability in ORION Allada T-shirt Designer for Woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through 1.1.
{
"affected": [],
"aliases": [
"CVE-2025-22363"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-07T17:15:33Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in ORION Allada T-shirt Designer for Woocommerce.This issue affects Allada T-shirt Designer for Woocommerce: from n/a through 1.1.",
"id": "GHSA-8xgj-5pjf-7xmj",
"modified": "2026-04-01T18:33:05Z",
"published": "2025-01-07T18:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22363"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/allada-tshirt-designer-for-woocommerce/vulnerability/wordpress-allada-t-shirt-designer-for-woocommerce-plugin-1-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XJQ-PR36-CCGF
Vulnerability from github – Published: 2026-08-28 17:15 – Updated: 2026-08-28 17:15Summary
The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges (ReadPacket) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.
Vulnerability Details
In yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java, the exportPackets method processes requests to export raw packets from the tm (telemetry archive) table.
@Override
public void exportPackets(Context ctx, ExportPacketsRequest request, Observer<HttpBody> observer) {
String instance = InstancesApi.verifyInstance(request.getInstance());
Set<String> nameSet = new HashSet<>(request.getNameList());
ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet);
SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME);
// ... time filters ...
if (request.getNameCount() > 0) {
sqlb.whereColIn("pname", nameSet);
}
String sql = sqlb.toString();
// ...
The method attempts to verify privileges using ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet). However, if the request.getNameList() is empty (i.e., the attacker does not specify any packet names to filter by), nameSet is empty. The checkObjectPrivileges method loops over this empty set and successfully passes without throwing a ForbiddenException.
Since request.getNameCount() is 0, no WHERE pname IN (...) filter is added to the SQL query. The resulting sql query becomes a SELECT * FROM tm (with optional time filters).
Finally, the query is executed and the results are streamed back to the user:
StreamFactory.stream(instance, sql, sqlb.getQueryArguments(), new StreamSubscriber() {
@Override
public void onTuple(Stream stream, Tuple tuple) {
if (observer.isCancelled()) {
stream.close();
return;
}
byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);
HttpBody body = HttpBody.newBuilder()
.setData(ByteString.copyFrom(raw))
.build();
observer.next(body);
}
// ...
Crucially, unlike the streamPackets or exportPacket methods (which explicitly check ctx.user.hasObjectPrivilege for each packet retrieved before returning them), the onTuple handler in exportPackets blindly streams all retrieved packets to the user without any per-row authorization checks.
Thus, a user who possesses no ReadPacket privileges at all can easily bypass authorization and extract all telemetry data from the archive.
Steps to Reproduce
- Start the Yamcs server (e.g., using the
simulationexample) with authentication enforced. - Log in as a low-privileged user (or use their credentials) who does not have the
ReadPacketprivilege. - Send an HTTP GET request to the export packets endpoint without specifying any
nameparameters:bash curl -v -u low_priv_user:password "http://localhost:8090/api/archive/simulator:exportPackets" -o dumped_packets.raw - Observe that the server responds with HTTP
200 OKand streams all raw packets to the response, saving them todumped_packets.raw. - The downloaded file contains raw CCSDS Space Packets (binary telemetry data).
- Contrast this with an attempt to fetch a specific packet (or calling
listPacketsfor an unauthorized packet), which correctly enforces authorization and rejects the request.
Impact
Telemetry packets contain the core mission data, vehicle health status, and sensitive measurements (CCSDS Protocol data). This vulnerability completely breaks the access control model for telemetry data, allowing any authenticated user to exfiltrate all historical telemetry packets from the database. In an aerospace or mission-critical environment, this represents a severe data leak (Massive Information Disclosure) of proprietary or classified spacecraft data.
Remediation
Ensure that exportPackets enforces the same per-row privilege checks as streamPackets.
Update the onTuple handler to check the user's privileges before emitting each packet:
@Override
public void onTuple(Stream stream, Tuple tuple) {
if (observer.isCancelled()) {
stream.close();
return;
}
// FIX: Retrieve packet name and check authorization
String pname = (String) tuple.getColumn(XtceTmRecorder.PNAME_COLUMN);
if (ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, pname)) {
byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);
HttpBody body = HttpBody.newBuilder()
.setData(ByteString.copyFrom(raw))
.build();
observer.next(body);
}
}
System Information
- Affected Versions: 5.13.0 (Latest Release), 5.12.x, and current
masterbranch. - Tested Revision (master):
309218c651680f79df11a8d0f8628f7033f98a83 - Vulnerability Type: Insecure Direct Object Reference (IDOR) / Logical Authorization Bypass
PoC Images:
-
Check version:
-
Check privilege of user:
-
Exploit:
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.13.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.yamcs:yamcs-core"
},
"ranges": [
{
"events": [
{
"introduced": "5.13.0"
},
{
"fixed": "5.13.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.12.7"
},
"package": {
"ecosystem": "Maven",
"name": "org.yamcs:yamcs-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.12.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55548"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T17:15:01Z",
"nvd_published_at": "2026-07-16T17:16:57Z",
"severity": "MODERATE"
},
"details": "## Summary\nThe `PacketsApi.exportPackets` endpoint in Yamcs fails to properly enforce object-level privileges (`ReadPacket`) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.\n\n## Vulnerability Details\nIn `yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java`, the `exportPackets` method processes requests to export raw packets from the `tm` (telemetry archive) table.\n\n```java\n @Override\n public void exportPackets(Context ctx, ExportPacketsRequest request, Observer\u003cHttpBody\u003e observer) {\n String instance = InstancesApi.verifyInstance(request.getInstance());\n\n Set\u003cString\u003e nameSet = new HashSet\u003c\u003e(request.getNameList());\n ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet);\n\n SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME);\n \n // ... time filters ...\n\n if (request.getNameCount() \u003e 0) {\n sqlb.whereColIn(\"pname\", nameSet);\n }\n String sql = sqlb.toString();\n // ...\n```\nThe method attempts to verify privileges using `ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet)`. However, if the `request.getNameList()` is empty (i.e., the attacker does not specify any packet names to filter by), `nameSet` is empty. The `checkObjectPrivileges` method loops over this empty set and successfully passes without throwing a `ForbiddenException`. \n\nSince `request.getNameCount()` is 0, no `WHERE pname IN (...)` filter is added to the SQL query. The resulting `sql` query becomes a `SELECT * FROM tm` (with optional time filters).\n\nFinally, the query is executed and the results are streamed back to the user:\n```java\n StreamFactory.stream(instance, sql, sqlb.getQueryArguments(), new StreamSubscriber() {\n\n @Override\n public void onTuple(Stream stream, Tuple tuple) {\n if (observer.isCancelled()) {\n stream.close();\n return;\n }\n\n byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);\n HttpBody body = HttpBody.newBuilder()\n .setData(ByteString.copyFrom(raw))\n .build();\n observer.next(body);\n }\n // ...\n```\nCrucially, unlike the `streamPackets` or `exportPacket` methods (which explicitly check `ctx.user.hasObjectPrivilege` for each packet retrieved before returning them), the `onTuple` handler in `exportPackets` **blindly streams all retrieved packets to the user without any per-row authorization checks**. \n\nThus, a user who possesses no `ReadPacket` privileges at all can easily bypass authorization and extract all telemetry data from the archive.\n\n## Steps to Reproduce\n1. Start the Yamcs server (e.g., using the `simulation` example) with authentication enforced.\n2. Log in as a low-privileged user (or use their credentials) who does **not** have the `ReadPacket` privilege.\n3. Send an HTTP GET request to the export packets endpoint without specifying any `name` parameters:\n ```bash\n curl -v -u low_priv_user:password \"http://localhost:8090/api/archive/simulator:exportPackets\" -o dumped_packets.raw\n ```\n4. Observe that the server responds with HTTP `200 OK` and streams all raw packets to the response, saving them to `dumped_packets.raw`. \n5. The downloaded file contains raw CCSDS Space Packets (binary telemetry data).\n6. Contrast this with an attempt to fetch a specific packet (or calling `listPackets` for an unauthorized packet), which correctly enforces authorization and rejects the request.\n\n## Impact\nTelemetry packets contain the core mission data, vehicle health status, and sensitive measurements (CCSDS Protocol data). This vulnerability completely breaks the access control model for telemetry data, allowing any authenticated user to exfiltrate all historical telemetry packets from the database. In an aerospace or mission-critical environment, this represents a severe data leak (Massive Information Disclosure) of proprietary or classified spacecraft data.\n\n## Remediation\nEnsure that `exportPackets` enforces the same per-row privilege checks as `streamPackets`. \nUpdate the `onTuple` handler to check the user\u0027s privileges before emitting each packet:\n\n```java\n @Override\n public void onTuple(Stream stream, Tuple tuple) {\n if (observer.isCancelled()) {\n stream.close();\n return;\n }\n\n // FIX: Retrieve packet name and check authorization\n String pname = (String) tuple.getColumn(XtceTmRecorder.PNAME_COLUMN);\n if (ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, pname)) {\n byte[] raw = (byte[]) tuple.getColumn(StandardTupleDefinitions.TM_PACKET_COLUMN);\n HttpBody body = HttpBody.newBuilder()\n .setData(ByteString.copyFrom(raw))\n .build();\n observer.next(body);\n }\n }\n```\n\n## System Information\n- **Affected Versions:** 5.13.0 (Latest Release), 5.12.x, and current `master` branch.\n- **Tested Revision (master):** `309218c651680f79df11a8d0f8628f7033f98a83` \n- **Vulnerability Type:** Insecure Direct Object Reference (IDOR) / Logical Authorization Bypass\n\n## PoC Images:\n\n- Check version:\n\u003cimg width=\"1157\" height=\"489\" alt=\"image\" src=\"https://github.com/user-attachments/assets/58608222-b76f-4eb4-8e57-423523062992\" /\u003e\n\n- Check privilege of user:\n\u003cimg width=\"1439\" height=\"953\" alt=\"image\" src=\"https://github.com/user-attachments/assets/aa7e55f2-2460-4f24-8b6f-d461d2499a6f\" /\u003e\n\u003cimg width=\"1214\" height=\"224\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e9123ae3-a194-462d-a5ca-2c0b1cc9cc6f\" /\u003e\n\n\n- Exploit:\n\n\n\u003cimg width=\"1728\" height=\"685\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0c7b3099-44d6-4392-bbaa-8e84cc151784\" /\u003e\n\n\u003cimg width=\"1768\" height=\"797\" alt=\"image\" src=\"https://github.com/user-attachments/assets/df4016a5-d460-4611-a34a-8c0d206edd9c\" /\u003e",
"id": "GHSA-8xjq-pr36-ccgf",
"modified": "2026-08-28T17:15:02Z",
"published": "2026-08-28T17:15:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55548"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/commit/b566beceba98cc35514b0e1519be126b8c5a0438"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/commit/c743cc3acf5b5c53ff5181b94eacc21340f70dd9"
},
{
"type": "PACKAGE",
"url": "https://github.com/yamcs/yamcs"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"type": "WEB",
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets"
}
GHSA-8XMG-V9FM-XCGV
Vulnerability from github – Published: 2024-06-12 12:30 – Updated: 2024-06-12 12:30The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0
{
"affected": [],
"aliases": [
"CVE-2024-5674"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-12T11:15:51Z",
"severity": "MODERATE"
},
"details": "The Newsletter - API v1 and v2 addon plugin for WordPress is vulnerable to unauthorized subscribers management due to PHP type juggling issue on the check_api_key function in all versions up to, and including, 2.4.5. This makes it possible for unauthenticated attackers to list, create or delete newsletter subscribers. This issue affects only sites running the PHP version below 8.0",
"id": "GHSA-8xmg-v9fm-xcgv",
"modified": "2024-06-12T12:30:41Z",
"published": "2024-06-12T12:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5674"
},
{
"type": "WEB",
"url": "https://www.thenewsletterplugin.com/documentation/developers/newsletter-api-2"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ecd9800e-ce0f-45f3-bb66-3690c51d885b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XPG-G2FV-RMCW
Vulnerability from github – Published: 2024-10-30 00:31 – Updated: 2026-04-01 18:32Missing Authorization vulnerability in Templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through 3.1.5.
{
"affected": [],
"aliases": [
"CVE-2024-50424"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-29T22:15:04Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through 3.1.5.",
"id": "GHSA-8xpg-g2fv-rmcw",
"modified": "2026-04-01T18:32:14Z",
"published": "2024-10-30T00:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50424"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/templately/vulnerability/wordpress-templately-plugin-3-1-5-broken-access-control-vulnerability-2?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/templately/wordpress-templately-plugin-3-1-5-broken-access-control-vulnerability-2?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XPW-M3X3-RQ75
Vulnerability from github – Published: 2022-05-14 00:01 – Updated: 2022-05-26 00:01SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-22282"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-13T20:15:00Z",
"severity": "CRITICAL"
},
"details": "SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability.",
"id": "GHSA-8xpw-m3x3-rq75",
"modified": "2022-05-26T00:01:28Z",
"published": "2022-05-14T00:01:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22282"
},
{
"type": "WEB",
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8XQH-VR8H-F939
Vulnerability from github – Published: 2025-02-12 15:32 – Updated: 2025-02-12 15:32A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.
{
"affected": [],
"aliases": [
"CVE-2025-26373"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-12T14:15:38Z",
"severity": "MODERATE"
},
"details": "A CWE-862 \"Missing Authorization\" in maxprofile/users/routes.lua (user endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.",
"id": "GHSA-8xqh-vr8h-f939",
"modified": "2025-02-12T15:32:01Z",
"published": "2025-02-12T15:32:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26373"
},
{
"type": "WEB",
"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26373"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XR3-MXV3-QM4H
Vulnerability from github – Published: 2026-09-18 09:31 – Updated: 2026-09-18 09:31The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.
{
"affected": [],
"aliases": [
"CVE-2026-91707"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-18T07:16:51Z",
"severity": "MODERATE"
},
"details": "The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the \u0027Force Enable D4 Shortcode Framework\u0027 option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.",
"id": "GHSA-8xr3-mxv3-qm4h",
"modified": "2026-09-18T09:31:06Z",
"published": "2026-09-18T09:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91707"
},
{
"type": "WEB",
"url": "https://www.divichangelog.com"
},
{
"type": "WEB",
"url": "https://www.divichangelog.com/divi-update/divi-5/version-5-12-0"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79a2fa3b-f9eb-49d8-97be-3a81d1b69c2e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XR4-2923-95RP
Vulnerability from github – Published: 2023-10-31 03:31 – Updated: 2023-10-31 03:31Missing Authorization in GitHub repository hamza417/inure prior to Build95.
{
"affected": [],
"aliases": [
"CVE-2023-5862"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-31T01:15:07Z",
"severity": "MODERATE"
},
"details": "Missing Authorization in GitHub repository hamza417/inure prior to Build95.",
"id": "GHSA-8xr4-2923-95rp",
"modified": "2023-10-31T03:31:21Z",
"published": "2023-10-31T03:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5862"
},
{
"type": "WEB",
"url": "https://github.com/hamza417/inure/commit/52b8c0bae36f129a5be05e377d7391afc3629df6"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/0e517db6-d8ba-4cb9-9339-7991dda52e6d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8XWH-M77V-V26P
Vulnerability from github – Published: 2026-05-14 06:31 – Updated: 2026-05-14 06:31GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.
{
"affected": [],
"aliases": [
"CVE-2026-2900"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-14T06:16:21Z",
"severity": "LOW"
},
"details": "GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks.",
"id": "GHSA-8xwh-m77v-v26p",
"modified": "2026-05-14T06:31:33Z",
"published": "2026-05-14T06:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2900"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3561092"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/590983"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9238-XF4H-W28W
Vulnerability from github – Published: 2026-03-11 06:31 – Updated: 2026-05-07 18:30MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials. Attackers can send arbitrary username and password combinations to the PASS command handler, which unconditionally grants access and allows listing, reading, writing, and deleting files exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status.
{
"affected": [],
"aliases": [
"CVE-2026-29515"
],
"database_specific": {
"cwe_ids": [
"CWE-303",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T04:17:37Z",
"severity": "CRITICAL"
},
"details": "MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials. Attackers can send arbitrary username and password combinations to the PASS command handler, which unconditionally grants access and allows listing, reading, writing, and deleting files exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status.",
"id": "GHSA-9238-xf4h-w28w",
"modified": "2026-05-07T18:30:32Z",
"published": "2026-03-11T06:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29515"
},
{
"type": "WEB",
"url": "https://github.com/MiCode/FileExplorer"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/micode-fileexplorer-swiftp-server-authentication-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.