CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2025-31789"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-03T14:15:39Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Matat Technologies TextMe SMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects TextMe SMS: from n/a through 1.9.1.",
  "id": "GHSA-9j9c-h6wf-5647",
  "modified": "2026-04-01T18:34:28Z",
  "published": "2025-04-03T15:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31789"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/textme-sms-integration/vulnerability/wordpress-textme-sms-plugin-1-9-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-66076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-02T12:16:52Z",
    "severity": "MODERATE"
  },
  "details": "Unauthenticated Broken Access Control in Woostify Sites Library \u003c= 1.6.2 versions.",
  "id": "GHSA-9j9h-m3wq-x944",
  "modified": "2026-07-02T12:30:59Z",
  "published": "2026-07-02T12:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66076"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/woostify-sites-library/vulnerability/wordpress-woostify-sites-library-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-37496"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T13:19:12Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Metro Magazine: from n/a through 1.3.7.",
  "id": "GHSA-9jch-cwm3-wfjh",
  "modified": "2026-06-17T18:35:42Z",
  "published": "2026-06-17T18:35:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37496"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/metro-magazine/vulnerability/wordpress-metro-magazine-theme-1-3-7-broken-access-control-on-notice-dismissal-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-34256"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-14T01:16:03Z",
    "severity": "HIGH"
  },
  "details": "Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the overwritten report is subsequently executed, the intended functionality could become unavailable. Successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.",
  "id": "GHSA-9jcw-cw9q-r69r",
  "modified": "2026-04-14T03:31:40Z",
  "published": "2026-04-14T03:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34256"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3731908"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-37453"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-01T15:15:25Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 5.8.7.",
  "id": "GHSA-9jcw-gp33-g7j3",
  "modified": "2024-11-01T15:31:57Z",
  "published": "2024-11-01T15:31:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37453"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/profilegrid-user-profiles-groups-and-communities/wordpress-profilegrid-user-profiles-groups-and-communities-plugin-5-8-7-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-0345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-352",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-28T09:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).",
  "id": "GHSA-9jh8-cc8h-44v2",
  "modified": "2022-03-17T00:04:55Z",
  "published": "2022-03-01T00:00:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0345"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/b3b523b9-6c92-4091-837a-d34e3174eb19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.moquette:moquette-broker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-85058"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:58:39Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMoquette MQTT Broker fails to enforce ACL write permission checks when publishing Will (Last Will and Testament) messages on behalf of disconnected clients. All normal PUBLISH paths (`receivedPublishQos0`, `receivedPublishQos1`, `receivedPublishQos2`) correctly invoke `authorizator.canWrite()` before publishing, but the Will message publishing path (`fireWill()` \u2192 `publishWill()` \u2192 `publish2Subscribers()`) completely bypasses this authorization check.\n\nThis allows an unauthenticated attacker (when `allow_anonymous=true`, which is the default) to inject arbitrary messages into any ACL-protected topic by setting a restricted topic as the Will Topic in the CONNECT packet and then disconnecting abruptly via TCP RST.\n\nOther major MQTT Broker implementations (Mosquitto, EMQX, HiveMQ) correctly enforce ACL checks on Will messages, confirming this is a bug, not a design choice.\n\n## Details\n\nIn the MQTT protocol, a client can declare a \"Will\" topic and message in the CONNECT packet. When the client disconnects abnormally (without sending a DISCONNECT packet), the Broker publishes the Will message on behalf of the client. Although the Will message content (topic and payload) is entirely controlled by the connecting client \u2014 making it functionally equivalent to a PUBLISH \u2014 Moquette skips the ACL check for this path.\n\n### Root Cause\n\n**File**: `broker/src/main/java/io/moquette/broker/PostOffice.java` (v0.18.0)\n\nWill publishing path (lines 286-328) \u2014 **no canWrite() check**:\n```java\npublic void fireWill(Session bindedSession) {\n    final ISessionsRepository.Will will = bindedSession.getWill();\n    if (will.delayInterval == 0) {\n        publishWill(will);  // No canWrite() check!\n    } else {\n        trackWillSpecificationForFutureFire(...);\n    }\n}\n\nprivate void publishWill(ISessionsRepository.Will will) {\n    // ... build message ...\n    publish2Subscribers(WILL_PUBLISKER, messageExpiryInstant, willPublishMessage);\n    // No canWrite() check!\n}\n```\n\nNormal PUBLISH path (line 641) \u2014 **has canWrite() check**:\n```java\nif (!authorizator.canWrite(topic, username, clientID)) {\n    LOG.error(\"client is not authorized to publish on topic: {}\", topic);\n    return;\n}\n```\n\nAdditionally, `SessionRegistry.createNewWill()` (line 408-428) stores the Will topic from the CONNECT packet without any `canWrite()` pre-check. The `fireWill()`/`publishWill()` method is the only publishing path that does not invoke `authorizator.canWrite()`, creating a complete authorization bypass.\n\n### Prerequisites\n\n| Condition | Who controls | Default? | Notes |\n|-----------|-------------|----------|-------|\n| Attacker can establish MQTT connection to Broker | Environment | Yes | `allow_anonymous` defaults to true |\n| Broker has ACL restricting topic write access | Application | No | Only deployments with ACL configured have \"bypass\" significance, but this is a normal security deployment |\n| Client disconnects abnormally (TCP RST, not DISCONNECT) | Attacker | Yes | Attacker simply closes the TCP connection |\n\n## PoC\n\nVerified against Moquette Broker **v0.18.0** (latest release as of 2024-12-27). All scripts are included in the attached `GitHub_Advisory_POC.zip`.\n[GitHub_Advisory_POC.zip](https://github.com/user-attachments/files/29499548/GitHub_Advisory_POC.zip)\n### Environment Setup\n\n**Step 1: Download Moquette Broker v0.18.0**\n\nDownload the official release bundle from GitHub and extract:\n\n```bash\ncurl -L -o /tmp/moquette-0.18-bundle.tar.gz \"https://github.com/moquette-io/moquette/releases/download/v0.18.0/distribution-0.18-bundle.tar.gz\"\nmkdir -p /tmp/moquette-0.18\ntar xzf /tmp/moquette-0.18-bundle.tar.gz -C /tmp/moquette-0.18\n```\n\n**Step 2: Configure ACL rules**\n\nReplace `/tmp/moquette-0.18/config/acl.conf` with the provided `acl.conf` (from POC zip), which contains:\n\n```conf\n# acl.conf - restrict write access to restricted/topic\ntopic write allowed/topic\ntopic read restricted/topic\n```\n\n\u003e Note: Must use `topic` rules (not `pattern` rules). Moquette\u0027s `AuthorizationsCollector.canDoOperation()` skips `pattern` rules when username is null (anonymous users), because `isNotEmpty(null)` returns false.\n\nEdit `/tmp/moquette-0.18/config/moquette.conf` to ensure ACL is enabled. Use the provided `moquette.conf` (from POC zip) as reference:\n\n```conf\n# moquette.conf\nport 1883\nhost 0.0.0.0\nallow_anonymous true\nacl_file config/acl.conf\n```\n\n**Step 3: Download dependency and compile POC scripts**\n\nDownload `commons-collections-3.2.1.jar` (required by CC6 deserialization chain) and compile the POC Java sources (all from POC zip):\n\n```bash\n# Download commons-collections (required for CC6 RCE POC only)\n# Place commons-collections-3.2.1.jar in /tmp/\n\n# Compile POC scripts\ncd /tmp\njavac -cp /tmp/commons-collections-3.2.1.jar CC6PayloadGen.java          # CC6 deserialization payload generator\njavac -cp /tmp/commons-collections-3.2.1.jar AttackerCC6_v018.java       # Attacker-side full POC (Will bypass + CC6 RCE)\njavac MqttDeviceService_v018.java                                         # Victim-side IoT subscriber service\n```\n\nScripts overview:\n\n| Script | Language | Purpose |\n|--------|----------|---------|\n| `poc_will_bypass.py` | Python | Lightweight Will ACL bypass verification (no Java/deserialization dependency) |\n| `AttackerCC6_v018.java` | Java | Full attacker POC: generates CC6 payload, verifies ACL blocks direct PUBLISH, bypasses ACL via Will, verifies victim-side RCE |\n| `CC6PayloadGen.java` | Java | CC6 deserialization payload generator (dependency of AttackerCC6_v018) |\n| `MqttDeviceService_v018.java` | Java | Victim-side IoT device subscriber \u2014 subscribes to `restricted/topic`, deserializes received messages via `ObjectInputStream.readObject()` |\n| `MoquetteWillAclBypassPoc.java` | Java | Standalone pure-Java POC for v0.15 (no external dependencies, verifies Will ACL bypass only) |\n| `acl.conf` | Config | ACL rules \u2014 `restricted/topic` read-only, no write |\n| `moquette.conf` | Config | Broker configuration \u2014 enables ACL, allows anonymous |\n\n### Reproduction \u2014 Will ACL Bypass Only (Python, no dependencies)\n\nThis verifies the core vulnerability: Will message bypasses ACL. Uses `poc_will_bypass.py`.\n\n**Terminal 1 \u2014 Start the Broker** (using Moquette\u0027s built-in main class `io.moquette.broker.Server`):\n\n```bash\ncd /tmp/moquette-0.18 \u0026\u0026 java -cp \u0027lib/*:lib\u0027 io.moquette.broker.Server\n```\n\nWait for \"Server started\" log.\n\n**Terminal 2 \u2014 Run POC**:\n\n```bash\npython3 poc_will_bypass.py\n```\n\nThis script automatically performs:\n1. Subscriber connects and subscribes to `restricted/topic`\n2. Verifies direct PUBLISH to `restricted/topic` is blocked by ACL\n3. Attacker connects with Will Topic=`restricted/topic`, then RST-disconnects\n4. Checks if subscriber received the Will message on the restricted topic\n\n**Expected output**:\n```\n[Step 1] Direct PUBLISH to restricted/topic (should be blocked)\n  [+] No message - ACL blocking direct PUBLISH (expected)\n\n[Step 2] Will ACL Bypass on v0.18.0\n  SUBACK: 9003000100\n  Attacker connected, Will set to \u0027restricted/topic\u0027\n  RST disconnecting attacker...\n  [!!!] WILL MESSAGE RECEIVED on restricted/topic!\n  [!!!] VULNERABILITY CONFIRMED on Moquette v0.18.0!\n```\n\n### Reproduction \u2014 Full RCE Chain (Will Bypass + CC6 Deserialization)\n\nThis demonstrates the real-world impact: Will bypass + Java deserialization = Remote Code Execution. Uses `AttackerCC6_v018.java`, `CC6PayloadGen.java`, and `MqttDeviceService_v018.java`.\n\n**Terminal 1 \u2014 Start the Broker** (using Moquette\u0027s built-in main class `io.moquette.broker.Server`):\n\n```bash\ncd /tmp/moquette-0.18 \u0026\u0026 java -cp \u0027lib/*:lib\u0027 io.moquette.broker.Server\n```\n\nWait for \"Server started\" log.\n\n**Terminal 2 \u2014 Start victim subscriber** (`MqttDeviceService_v018.java`):\n\n```bash\ncd /tmp \u0026\u0026 java -cp .:/tmp/commons-collections-3.2.1.jar MqttDeviceService_v018 localhost 1883\n```\n\nThis simulates an IoT device that subscribes to `restricted/topic` and deserializes received messages via `ObjectInputStream.readObject()`. Wait for:\n\n```\n[\u7b49\u5f85\u4e2d]   \u7b49\u5f85\u7ba1\u7406\u5e73\u53f0\u4e0b\u53d1\u6307\u4ee4...\n```\n\n**Terminal 3 \u2014 Run attacker POC** (`AttackerCC6_v018.java`):\n\n```bash\ncd /tmp \u0026\u0026 java -cp .:/tmp/commons-collections-3.2.1.jar AttackerCC6_v018 localhost 1883\n```\n\nThis script automatically performs:\n1. **Generate CC6 payload** \u2014 uses `CC6PayloadGen.java` to create a Commons Collections CC6 deserialization chain that executes `touch /tmp/pwned_by_will_bypass_\u003ctimestamp\u003e`\n2. **Verify direct PUBLISH is blocked** \u2014 attempts PUBLISH to `restricted/topic`, confirms ACL blocks it\n3. **Bypass ACL via Will** \u2014 CONNECT with Will Topic=`restricted/topic`, Will Message=CC6 serialized payload, then RST disconnect\n4. **Verify victim-side RCE** \u2014 checks if `/tmp/pwned_by_will_bypass_\u003ctimestamp\u003e` file was created on the victim\n\n\u003e Key verification point: Java CC6 chain triggers `exec` once during `HashMap.put()` when constructing the payload (a known CC6 artifact). The POC deletes this file before the Will bypass step, then verifies the file is re-created by the victim\u0027s `readObject()`, confirming the RCE is on the victim side, not a POC construction side-effect.\n\n**Expected attacker output** (Terminal 3):\n```\n=== \u653b\u51fb\u8005 (CC6\u539f\u751f\u53cd\u5e8f\u5217\u5316\u94fe) - Moquette v0.18.0 ===\n[1] \u751f\u6210CC6\u53cd\u5e8f\u5217\u5316payload...\n    payload\u957f\u5ea6: 1189 \u5b57\u8282\n[2] \u76f4\u63a5PUBLISH\u5230restricted topic (\u5e94\u88abACL\u62e6\u622a)...\n    \u5df2\u53d1\u9001\n[3] \u901a\u8fc7Will\u6d88\u606f\u7ed5\u8fc7ACL...\n    \u5df2\u8fde\u63a5\uff0cWill Topic=restricted/topic\n    Will Payload=CC6\u5e8f\u5217\u5316\u6570\u636e(1189\u5b57\u8282)\n    RST\u65ad\u5f00\u8fde\u63a5...\n    \u5df2\u65ad\u5f00\uff0cWill\u6d88\u606f\u7ed5\u8fc7ACL\u6295\u9012\u6210\u529f\n[4] \u9a8c\u8bc1\u53d7\u5bb3\u8005\u7aefRCE:\n    -rw-r--r-- 1 fire fire 0 ... /tmp/pwned_by_will_bypass_XXXXXXXXXXXXX\n    *** RCE\u6210\u529f! Will\u6d88\u606f\u7ed5\u8fc7ACL\u6295\u9012CC6 payload\uff0c\u53d7\u5bb3\u8005readObject()\u89e6\u53d1\u547d\u4ee4\u6267\u884c! ***\n```\n\n**Expected victim output** (Terminal 2):\n```\n[\u6536\u5230\u6d88\u606f] MQTT\u6d88\u606f\u5230\u8fbe\uff0c\u957f\u5ea6=1189\u5b57\u8282\n[\u53cd\u5e8f\u5217\u5316] \u6b63\u5728\u6267\u884c ObjectInputStream.readObject() ...\n[\u53cd\u5e8f\u5217\u5316] \u5b8c\u6210\uff0c\u5bf9\u8c61\u7c7b\u578b: java.util.HashMap\n```\n\n## Impact\n\n- **Authorization Bypass**: Attacker can inject arbitrary messages into any ACL-restricted topic, completely undermining the Broker\u0027s access control\n- **Remote Code Execution**: When subscribers deserialize MQTT message payloads (e.g., using Java `ObjectInputStream.readObject()`), attacker can inject deserialization gadgets (e.g., Commons Collections CC6 chain) to achieve RCE\n- **Affected scope**: All IoT/messaging middleware scenarios using Moquette as MQTT Broker with ACL enabled\n\n| Metric | Value | Rationale |\n|--------|-------|-----------|\n| Attack Vector | Network | MQTT Broker listens on TCP port, network-reachable |\n| Attack Complexity | Low | Standard MQTT CONNECT + TCP RST, no special conditions needed |\n| Privileges Required | None | `allow_anonymous` defaults to true |\n| User Interaction | None | Fully automated attack |\n| Scope | Unchanged | Impact limited to Broker\u0027s security domain |\n| Confidentiality | None | No data disclosure |\n| Integrity | High | ACL write protection completely bypassed |\n| Availability | None | No service disruption |\n[GitHub_Advisory_POC.zip](https://github.com/user-attachments/files/29499548/GitHub_Advisory_POC.zip)",
  "id": "GHSA-9jjc-fw8x-fmwx",
  "modified": "2026-09-18T17:58:39Z",
  "published": "2026-09-18T17:58:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/moquette-io/moquette"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "io.moquette:moquette-broker has a Missing Authorization issue"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13950"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-15T15:15:48Z",
    "severity": "MODERATE"
  },
  "details": "The OneSignal \u2013 Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying user capabilities or nonces. This makes it possible for unauthenticated attackers to overwrite the OneSignal App ID, REST API key, and notification behavior via direct POST requests.",
  "id": "GHSA-9jm2-ww3f-6gg3",
  "modified": "2025-12-15T15:30:32Z",
  "published": "2025-12-15T15:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13950"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OneSignal/OneSignal-WordPress-Plugin/pull/387/files"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cf2b5d05-24a3-4bc8-9dde-a7e8ce13ea16?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-121194"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-03T21:17:28Z",
    "severity": "MODERATE"
  },
  "details": "Missing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted PDF file. (Chromium security severity: Medium)",
  "id": "GHSA-9jq7-c579-98j9",
  "modified": "2026-11-04T21:32:20Z",
  "published": "2026-11-03T21:32:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121194"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/566683019"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@haxtheweb/haxcms-nodejs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "elmsln/haxcms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-54378"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-25T20:10:22Z",
    "nvd_published_at": "2025-07-26T04:16:05Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe HAX CMS API endpoints do not perform authorization checks when interacting with a resource. Both the JS and PHP versions of the CMS do not verify that a user has permission to interact with a resource before performing a given operation.\n\n### Details\n\nThe API endpoints within the HAX CMS application check if a user is authenticated, but don\u0027t check for authorization before performing an operation.\n\n#### Affected Resources\n\n- [Operations.php: 760](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L760) `createNode()`\n- [Operations.php: 868](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L868) `saveNode()`\n- [Operations.php: 1171](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L1171) `deleteNode()`\n- [Operations.php: 1789](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L1789) `listSites()`\n- [Operations.php: 1890](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L1890) `createSite()`\n- [Operations.php: 2196](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L2195) `getConfig()`\n- [Operations.php: 2389](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L2389) `cloneSite()`\n- [Operations.php: 2467](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L2467) `deleteSite()`\n- [Operations.php: 2524](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L2524) `downloadSite()`\n- [Operations.php: 2607](https://github.com/haxtheweb/haxcms-php/blob/b158d8ba1f9602af92ab084fd03b418f953079fd/system/backend/php/lib/Operations.php#L2606) `archiveSite()`\n\n\n_Note: This may not include all affected endpoints within the application._\n\n### Impact\n\nAn authenticated attacker can make requests to interact with other users\u0027 sites. This can be used to enumerate, modify, and delete other users\u0027 sites and nodes.\n\nAdditionally, an authenticated attacker can use the \u0027getConfig\u0027 endpoint to pull the application\u0027s configuration, which may store cleartext credentials.\n\n### PoC - /deleteNode\n\n1. Browse to the \u0027site.json\u0027 file for a target site, and note the ID of the item to delete.\n\n![image](https://github.com/user-attachments/assets/84f8b396-876e-402b-b252-86d6cdec66c0)\n\n2. Make a POST request to the \u0027deleteNode\u0027 endpoint with a valid JWT and the target object ID.\n\n![image](https://github.com/user-attachments/assets/750f6b2b-ad57-4230-8fd9-05100c25cef5)\n\nSite before editing:\n\n![image](https://github.com/user-attachments/assets/b7482b53-fc12-4aca-a135-082f1751d4a2)\n\nSite after editing:\n\n![image](https://github.com/user-attachments/assets/5a982f70-d8ef-4523-bcdc-da2b5aa7f019)",
  "id": "GHSA-9jr9-8ff3-m894",
  "modified": "2025-07-28T13:04:31Z",
  "published": "2025-07-25T20:10:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-9jr9-8ff3-m894"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54378"
    },
    {
      "type": "WEB",
      "url": "https://github.com/haxtheweb/haxcms-nodejs/commit/5826e9b7f3d8c7c7635411768b86b199fad36969"
    },
    {
      "type": "WEB",
      "url": "https://github.com/haxtheweb/haxcms-php/commit/24d30222481ada037597c4d7c0a51a1ef7af6cfd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "HAX CMS API Lacks Authorization Checks"
}