Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

14657 vulnerabilities reference this CWE, most recent first.

GHSA-RCRR-P232-7F6X

Vulnerability from github – Published: 2023-12-08 18:30 – Updated: 2023-12-13 00:30
VLAI
Details

In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-48402"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-08T16:15:16Z",
    "severity": "HIGH"
  },
  "details": "In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n",
  "id": "GHSA-rcrr-p232-7f6x",
  "modified": "2023-12-13T00:30:33Z",
  "published": "2023-12-08T18:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48402"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2023-12-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RCRV-6R7R-RR7M

Vulnerability from github – Published: 2022-05-13 01:17 – Updated: 2024-01-30 21:43
VLAI
Summary
Missing permission check in Jenkins FTP publisher Plugin
Details

A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jvnet.hudson.plugins:ftppublisher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-1003059"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T21:43:50Z",
    "nvd_published_at": "2019-04-04T16:29:00Z",
    "severity": "MODERATE"
  },
  "details": "A missing permission check in Jenkins FTP publisher Plugin in the FTPPublisher.DescriptorImpl#doLoginCheck method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server.",
  "id": "GHSA-rcrv-6r7r-rr7m",
  "modified": "2024-01-30T21:43:50Z",
  "published": "2022-05-13T01:17:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1003059"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-04-03/#SECURITY-974"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/04/12/2"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107790"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Missing permission check in Jenkins FTP publisher Plugin"
}

GHSA-RCVP-6FGW-C7FH

Vulnerability from github – Published: 2026-05-08 19:52 – Updated: 2026-05-15 23:53
VLAI
Summary
Open WebUI's Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show
Details

Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show

Affected Component

Ollama proxy endpoints missing model access control: - backend/open_webui/routers/ollama.py (lines 955-995, generate_completion) - backend/open_webui/routers/ollama.py (lines 835-881, embed) - backend/open_webui/routers/ollama.py (lines 891-937, embeddings) - backend/open_webui/routers/ollama.py (lines 791-820, show_model_info)

Affected Versions

Current main branch (commit 6fdd19bf1) and likely all versions with Ollama model access control support.

Description

Four Ollama proxy endpoints accept any model name from the user and forward the request to the Ollama backend without checking whether the user is authorized to access that model. These endpoints only require get_verified_user (any authenticated non-pending user) and validate that the model exists in the full unfiltered model list, but never check AccessGrants.has_access().

This is in direct contrast with the /ollama/api/chat endpoint (line 1101-1122) which correctly validates model access grants and returns 403 for unauthorized users:

# /api/chat (line 1101-1122) — CORRECTLY checks access
if not bypass_filter and user.role == 'user':
    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}
    if not (
        user.id == model_info.user_id
        or AccessGrants.has_access(
            user_id=user.id, resource_type='model',
            resource_id=model_info.id, permission='read',
            user_group_ids=user_group_ids,
        )
    ):
        raise HTTPException(status_code=403, detail='Model not found')

# /api/generate (line 955-995) — NO access check at all
# /api/embed (line 835-881) — NO access check at all
# /api/embeddings (line 891-937) — NO access check at all
# /api/show (line 791-820) — NO access check at all

CVSS 3.1 Breakdown

Metric Value Rationale
Attack Vector Network (N) Exploited remotely via API calls
Attack Complexity Low (L) Single API call with a known model name
Privileges Required Low (L) Requires any authenticated user account
User Interaction None (N) No victim interaction required
Scope Unchanged (U) Impact within the Ollama model access boundary
Confidentiality Low (L) /api/show exposes restricted model details including system prompts and parameters
Integrity None (N) No data modification
Availability Low (L) Unauthorized consumption of GPU/compute resources on restricted models

Attack Scenario

  1. Admin configures model access control, restricting llama3:70b to the "ML Engineers" group. Regular user Alice is only authorized for llama3:8b.
  2. Alice knows the restricted model name (model names are predictable — llama3:70b, mistral:latest, etc.).
  3. Alice calls the unprotected endpoints directly: ```bash # Run completions on restricted model curl -X POST /ollama/api/generate \ -H "Authorization: Bearer " \ -d '{"model": "llama3:70b", "prompt": "..."}'

# View restricted model details and system prompt curl -X POST /ollama/api/show \ -H "Authorization: Bearer " \ -d '{"model": "llama3:70b"}'

# Generate embeddings with restricted model curl -X POST /ollama/api/embed \ -H "Authorization: Bearer " \ -d '{"model": "llama3:70b", "input": "..."}' ``` 4. All requests succeed and are proxied to Ollama without any access control check.

Impact

  • Model access control is silently ineffective for four out of five Ollama proxy endpoints
  • Unauthorized users can consume GPU/compute resources on restricted models (cost and capacity impact in multi-user deployments)
  • /api/show exposes restricted model configurations including system prompts, parameters, templates, and license information
  • Admins have a false sense of security — access restrictions appear to work via the main chat interface but are trivially bypassed via direct API calls

Preconditions

  • Ollama must be configured as a backend
  • Admin must have configured model access control (not using BYPASS_MODEL_ACCESS_CONTROL=true)
  • Attacker must know the restricted model name (model names follow predictable conventions)
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.12"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44563"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T19:52:42Z",
    "nvd_published_at": "2026-05-15T20:16:48Z",
    "severity": "MODERATE"
  },
  "details": "# Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show\n\n## Affected Component\n\nOllama proxy endpoints missing model access control:\n- `backend/open_webui/routers/ollama.py` (lines 955-995, `generate_completion`)\n- `backend/open_webui/routers/ollama.py` (lines 835-881, `embed`)\n- `backend/open_webui/routers/ollama.py` (lines 891-937, `embeddings`)\n- `backend/open_webui/routers/ollama.py` (lines 791-820, `show_model_info`)\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions with Ollama model access control support.\n\n## Description\n\nFour Ollama proxy endpoints accept any model name from the user and forward the request to the Ollama backend without checking whether the user is authorized to access that model. These endpoints only require `get_verified_user` (any authenticated non-pending user) and validate that the model exists in the full unfiltered model list, but never check `AccessGrants.has_access()`.\n\nThis is in direct contrast with the `/ollama/api/chat` endpoint (line 1101-1122) which correctly validates model access grants and returns 403 for unauthorized users:\n\n```python\n# /api/chat (line 1101-1122) \u2014 CORRECTLY checks access\nif not bypass_filter and user.role == \u0027user\u0027:\n    user_group_ids = {group.id for group in Groups.get_groups_by_member_id(user.id)}\n    if not (\n        user.id == model_info.user_id\n        or AccessGrants.has_access(\n            user_id=user.id, resource_type=\u0027model\u0027,\n            resource_id=model_info.id, permission=\u0027read\u0027,\n            user_group_ids=user_group_ids,\n        )\n    ):\n        raise HTTPException(status_code=403, detail=\u0027Model not found\u0027)\n\n# /api/generate (line 955-995) \u2014 NO access check at all\n# /api/embed (line 835-881) \u2014 NO access check at all\n# /api/embeddings (line 891-937) \u2014 NO access check at all\n# /api/show (line 791-820) \u2014 NO access check at all\n```\n\n## CVSS 3.1 Breakdown\n\n| Metric | Value | Rationale |\n|--------|-------|-----------|\n| Attack Vector | Network (N) | Exploited remotely via API calls |\n| Attack Complexity | Low (L) | Single API call with a known model name |\n| Privileges Required | Low (L) | Requires any authenticated user account |\n| User Interaction | None (N) | No victim interaction required |\n| Scope | Unchanged (U) | Impact within the Ollama model access boundary |\n| Confidentiality | Low (L) | `/api/show` exposes restricted model details including system prompts and parameters |\n| Integrity | None (N) | No data modification |\n| Availability | Low (L) | Unauthorized consumption of GPU/compute resources on restricted models |\n\n## Attack Scenario\n\n1. Admin configures model access control, restricting `llama3:70b` to the \"ML Engineers\" group. Regular user Alice is only authorized for `llama3:8b`.\n2. Alice knows the restricted model name (model names are predictable \u2014 `llama3:70b`, `mistral:latest`, etc.).\n3. Alice calls the unprotected endpoints directly:\n   ```bash\n   # Run completions on restricted model\n   curl -X POST /ollama/api/generate \\\n     -H \"Authorization: Bearer \u003calice_token\u003e\" \\\n     -d \u0027{\"model\": \"llama3:70b\", \"prompt\": \"...\"}\u0027\n\n   # View restricted model details and system prompt\n   curl -X POST /ollama/api/show \\\n     -H \"Authorization: Bearer \u003calice_token\u003e\" \\\n     -d \u0027{\"model\": \"llama3:70b\"}\u0027\n\n   # Generate embeddings with restricted model\n   curl -X POST /ollama/api/embed \\\n     -H \"Authorization: Bearer \u003calice_token\u003e\" \\\n     -d \u0027{\"model\": \"llama3:70b\", \"input\": \"...\"}\u0027\n   ```\n4. All requests succeed and are proxied to Ollama without any access control check.\n\n## Impact\n\n- Model access control is silently ineffective for four out of five Ollama proxy endpoints\n- Unauthorized users can consume GPU/compute resources on restricted models (cost and capacity impact in multi-user deployments)\n- `/api/show` exposes restricted model configurations including system prompts, parameters, templates, and license information\n- Admins have a false sense of security \u2014 access restrictions appear to work via the main chat interface but are trivially bypassed via direct API calls\n\n## Preconditions\n\n- Ollama must be configured as a backend\n- Admin must have configured model access control (not using `BYPASS_MODEL_ACCESS_CONTROL=true`)\n- Attacker must know the restricted model name (model names follow predictable conventions)",
  "id": "GHSA-rcvp-6fgw-c7fh",
  "modified": "2026-05-15T23:53:14Z",
  "published": "2026-05-08T19:52:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-rcvp-6fgw-c7fh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44563"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI\u0027s Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show"
}

GHSA-RCW6-V8GJ-MX3J

Vulnerability from github – Published: 2025-11-04 15:31 – Updated: 2025-11-05 17:48
VLAI
Details

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarDenunciasById.php'.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-41345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-04T14:15:36Z",
    "severity": "HIGH"
  },
  "details": "A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users\u0027 information by sending a POST through the\u00a0parameters \u0027id_denuncia\u0027 and \u0027id_user\u0027 in \u0027/backend/api/buscarDenunciasById.php\u0027.",
  "id": "GHSA-rcw6-v8gj-mx3j",
  "modified": "2025-11-05T17:48:28Z",
  "published": "2025-11-04T15:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41345"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RF35-M962-38XM

Vulnerability from github – Published: 2026-01-14 06:30 – Updated: 2026-01-14 06:30
VLAI
Details

The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings including disabling auto-compression and changing image quality settings.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-14482"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-14T06:15:52Z",
    "severity": "MODERATE"
  },
  "details": "The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple functions in all versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings including disabling auto-compression and changing image quality settings.",
  "id": "GHSA-rf35-m962-38xm",
  "modified": "2026-01-14T06:30:24Z",
  "published": "2026-01-14T06:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14482"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/crush-pics/trunk/inc/class-ajax.php#L193"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/crush-pics/trunk/inc/class-ajax.php#L30"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/crush-pics/trunk/inc/class-ajax.php#L66"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e71bf15-aee0-4efc-a1c6-faad9f6e4f38?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RF45-G4GV-FH4V

Vulnerability from github – Published: 2024-03-20 15:32 – Updated: 2026-04-08 18:32
VLAI
Details

The Coming Soon, Under Construction & Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUEST_URI to determine if the page being accesses is an admin area. This makes it possible for unauthenticated attackers to bypass maintenance mode and access the site which may be considered confidential when in maintenance mode.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-20T07:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The Coming Soon, Under Construction \u0026 Maintenance Mode By Dazzler plugin for WordPress is vulnerable to maintenance mode bypass in all versions up to, and including, 2.1.2. This is due to the plugin relying on the REQUEST_URI to determine if the page being accesses is an admin area.  This makes it possible for unauthenticated attackers to bypass maintenance mode and access the site which may be considered confidential when in maintenance mode.",
  "id": "GHSA-rf45-g4gv-fh4v",
  "modified": "2026-04-08T18:32:47Z",
  "published": "2024-03-20T15:32:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1181"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/coming-soon-wp/trunk/coming-soon-wp.php#L45"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3054042%40coming-soon-wp\u0026new=3054042%40coming-soon-wp\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc144cd-7119-477f-9fa1-b00cab215077?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RF55-6QXF-873F

Vulnerability from github – Published: 2025-11-21 15:31 – Updated: 2026-01-20 15:31
VLAI
Details

Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through <= 2.0.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-66114"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-21T13:15:53Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Show Variations as Single Products Woocommerce: from n/a through \u003c= 2.0.",
  "id": "GHSA-rf55-6qxf-873f",
  "modified": "2026-01-20T15:31:57Z",
  "published": "2025-11-21T15:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66114"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/woo-show-single-variations-shop-category/vulnerability/wordpress-show-variations-as-single-products-woocommerce-plugin-2-0-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/woo-show-single-variations-shop-category/vulnerability/wordpress-show-variations-as-single-products-woocommerce-plugin-2-0-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RF62-J559-5FCR

Vulnerability from github – Published: 2025-07-18 06:30 – Updated: 2025-07-18 06:30
VLAI
Details

The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gain full admin privileges.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-6813"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-18T05:15:32Z",
    "severity": "HIGH"
  },
  "details": "The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass all role checks and gain full admin privileges.",
  "id": "GHSA-rf62-j559-5fcr",
  "modified": "2025-07-18T06:30:24Z",
  "published": "2025-07-18T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6813"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/aapanel-wp-toolkit/tags/1.1/includes/class-aapanel-wp-toolkit-agent.php#L74"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/aapanel-wp-toolkit/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/430a0b93-2cb7-45bf-86ac-4a8b3a0be77a?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RF6G-9JPM-P8CR

Vulnerability from github – Published: 2023-09-04 03:30 – Updated: 2024-04-04 07:23
VLAI
Details

In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-38438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-04T02:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges",
  "id": "GHSA-rf6g-9jpm-p8cr",
  "modified": "2024-04-04T07:23:19Z",
  "published": "2023-09-04T03:30:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38438"
    },
    {
      "type": "WEB",
      "url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RF6X-MPCH-366Q

Vulnerability from github – Published: 2026-01-27 03:31 – Updated: 2026-01-27 03:31
VLAI
Details

SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on confidentiality, integrity and availability are not impacted.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-23683"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-27T01:16:01Z",
    "severity": "MODERATE"
  },
  "details": "SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has low impact on confidentiality, integrity and availability are not impacted.",
  "id": "GHSA-rf6x-mpch-366q",
  "modified": "2026-01-27T03:31:33Z",
  "published": "2026-01-27T03:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23683"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3122486"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list