CWE-862
Weakness Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Dimensions
- Behavior-Property: Missing
- Behavior-Type: Authorization
Mapping guidance
This CWE entry is a Class and might have Base-level children that would be more appropriate
Examine children of this entry to see if there is a better fit
Relationships and members
Modes of introduction
OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
Authorization weaknesses may arise when a single-user application is ported to a multi-user environment.
A developer may introduce authorization weaknesses because of a lack of understanding about the underlying technologies. For example, a developer may assume that attackers cannot modify certain inputs such as headers or cookies.
Detection methods
Automated Static Analysis
Automated static analysis is useful for detecting commonly-used idioms for authorization. A tool may be able to analyze related configuration files, such as .htaccess in Apache web servers, or detect the usage of commonly-used authorization libraries.
Generally, automated static analysis tools have difficulty detecting custom authorization schemes. In addition, the software's design may include some functionality that is accessible to any user and does not require an authorization check; an automated technique that detects the absence of authorization may report false positives.
Effectiveness: Limited
Automated Dynamic Analysis
Automated dynamic analysis may find many or all possible interfaces that do not require authorization, but manual analysis is required to determine if the lack of authorization violates business logic.
Manual Analysis
This weakness can be detected using tools and techniques that require manual (human) analysis, such as penetration testing, threat modeling, and interactive tools that allow the tester to record and modify an active session.
Specifically, manual static analysis is useful for evaluating the correctness of custom authorization mechanisms.
Effectiveness: Moderate
These may be more effective than strictly automated techniques. This is especially the case with weaknesses that are related to design and business rules. However, manual efforts might not achieve desired code coverage within limited time constraints.
Manual Static Analysis - Binary or Bytecode
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness: SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Web Application Scanner
Web Services Scanner
Database Scanners
Effectiveness: SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Host Application Interface Scanner
Fuzz Tester
Framework-based Fuzzer
Effectiveness: SOAR Partial
Manual Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Focused Manual Spotcheck - Focused manual analysis of source
Manual Source Code Review (not inspections)
Effectiveness: SOAR Partial
Automated Static Analysis - Source Code
According to SOAR [REF-1479], the following detection techniques may be useful:
Cost effective for partial coverage:
Source code Weakness Analyzer
Context-configured Source Code Weakness Analyzer
Effectiveness: SOAR Partial
Architecture or Design Review
According to SOAR [REF-1479], the following detection techniques may be useful:
Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Formal Methods / Correct-By-Construction
Effectiveness: High
Notes
Terminology
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
Content history
Suggested mappings to ISA/IEC 62443.
Provided diagram to improve CWE usability
updated Demonstrative_Examples, Related_Attack_Patterns, Relationships
updated Potential_Mitigations, References, Relationships
updated Demonstrative_Examples, Observed_Examples, References, Relationships
updated Potential_Mitigations
updated Relationships
updated Detection_Factors
updated Relationships
updated Applicable_Platforms, Modes_of_Introduction, References, Relationships
updated References
updated Relationships
updated Relationships
updated Relationships
updated Relationships
updated Alternate_Terms, Observed_Examples
updated Observed_Examples, Related_Attack_Patterns, Relationships
updated Relationships
updated Relationships
updated Observed_Examples
updated Description, Potential_Mitigations
updated References, Relationships, Taxonomy_Mappings
updated Mapping_Notes, Relationships, Taxonomy_Mappings
updated Common_Consequences, Description, Diagram, Relationships, Terminology_Notes
updated Applicable_Platforms, Detection_Factors, Observed_Examples, References
updated Applicable_Platforms, Relationships, Weakness_Ordinalities
updated Applicable_Platforms, Observed_Examples, Relationships
updated Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
20038 vulnerabilities reference this CWE, most recent first.
GHSA-GH7W-Q9RM-C8W9
Vulnerability from github – Published: 2023-12-04 03:30 – Updated: 2023-12-07 00:30In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
{
"affected": [],
"aliases": [
"CVE-2023-42690"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-04T01:15:09Z",
"severity": "HIGH"
},
"details": "In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed",
"id": "GHSA-gh7w-q9rm-c8w9",
"modified": "2023-12-07T00:30:38Z",
"published": "2023-12-04T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42690"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH86-CJ5C-G55J
Vulnerability from github – Published: 2025-03-27 12:30 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Terms & Conditions Per Product: from n/a through 1.2.15.
{
"affected": [],
"aliases": [
"CVE-2025-30866"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-27T11:15:47Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Giannis Kipouros Terms \u0026 Conditions Per Product allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Terms \u0026 Conditions Per Product: from n/a through 1.2.15.",
"id": "GHSA-gh86-cj5c-g55j",
"modified": "2026-04-01T18:34:08Z",
"published": "2025-03-27T12:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30866"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/terms-and-conditions-per-product/vulnerability/wordpress-terms-conditions-per-product-plugin-1-2-15-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GH98-4PHW-6FMW
Vulnerability from github – Published: 2026-10-07 20:36 – Updated: 2026-10-07 20:36Summary
Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:
POST /api/v1/build/{flow_id}/vertices(retrieve_vertices_order)POST /api/v1/build/{flow_id}/vertices/{vertex_id}(build_vertex)
Any authenticated user who knows (or obtains) another user's flow_id could load that user's private flow graph, enumerate its vertex IDs, and build (execute) individual vertices of it, receiving the vertex results in the response.
Both routes are declared with deprecated=True, include_in_schema=False, so they do not appear in the OpenAPI docs, but they remained registered on the router. The Langflow UI no longer calls them (it uses POST /api/v1/build/{flow_id}/flow), so they are only reachable by direct HTTP requests.
The issue is fixed in Langflow 1.10.1 (langflow-base 0.10.1) by #13153.
Details
In affected versions, both handlers go straight to the graph loader:
retrieve_vertices_order(src/backend/base/langflow/api/v1/chat.py, lines 81-159 in 1.9.1) only required authentication viadependencies=[Depends(get_current_active_user)]. The user was never injected into the handler, and the flow was loaded withbuild_graph_from_db(flow_id=flow_id, ...).build_vertex(chat.py, lines 320-491 in 1.9.1) receivescurrent_user, but only uses it for variable resolution (user_id=str(current_user.id)). It is never used to scope the flow lookup. The graph is taken from the chat-service cache keyed byflow_id, or rebuilt withbuild_graph_from_dbon a cache miss.build_graph_from_db_no_cache(src/backend/base/langflow/api/utils/flow_utils.py) does a bare primary-key lookup,session.get(Flow, flow_id), with no owner filter.
The supported replacement, POST /api/v1/build/{flow_id}/flow, already restricted the lookup to the owner or a PUBLIC flow (added in #12305 for GHSA-qj98-rhf8-v93f). The deprecated siblings were not covered by that fix, nor by the _read_flow fix for GHSA-8c4j-f57c-35cf.
Additional side effects in affected versions:
retrieve_vertices_orderstores the graph in the chat-service cache under the victim'sflow_id(chat_service.set_cache(str(flow_id), graph)). When the request includes adatabody, the cached graph is attacker-supplied.build_vertexscheduleslog_vertex_buildfor the victim'sflow_id, so attacker-triggered builds are recorded in the victim flow's vertex build history.
Note on older versions: up to and including 1.7.1, these two routes had no authentication dependency at all. Authentication was added in 1.7.2 by #10977, but no ownership check was added. This advisory covers the missing ownership check, which is present in every release from 1.0.0 (when the routes were introduced) through 1.10.0.
Attack scenario
- The attacker authenticates as any valid user.
- The attacker obtains a victim
flow_id(shared URLs, exported flow files, logs, screenshots, etc.). POST /api/v1/build/{victim_flow_id}/verticesreturns 200 OK with{"ids": [...], "run_id": "...", "vertices_to_run": [...]}listing the victim flow's vertex IDs (component type plus suffix, e.g.ChatInput-abc12).- The attacker calls
POST /api/v1/build/{victim_flow_id}/vertices/{vertex_id}for a returned ID. The victim's graph is loaded and the vertex is built. Its results, outputs and artifacts are returned to the attacker.
Impact
- Confidentiality (Low): Discloses the structure of private flows (vertex IDs and component types) and the outputs of vertices the attacker chooses to build. That includes values hardcoded in node configuration, such as prompt text or fixed inputs.
- Global variables and credentials in the variable store are not exposed, because variable resolution uses the caller's
user_id. - The victim's stored flow definition is not returned wholesale.
- Integrity (Low): The attacker can trigger execution of the victim's nodes, including any side effects baked into their configuration (fixed endpoints, webhooks, hardcoded API keys). Build records are written under the victim's
flow_id. The attacker cannot modify the stored flow. - Availability: None.
The attacker must be authenticated and must know the target flow UUID. Flow UUIDs are random v4 values, so blind enumeration is not practical.
Proof of concept
Observed on langflow==1.9.1 using the project's test client and in-memory SQLite fixtures (see the attached poc.zip):
| Request | Expected (hardened) | Observed on 1.9.1 |
|---|---|---|
Attacker → POST /api/v1/build/{victim_flow_id}/vertices |
404 Not Found |
200 OK with vertex order payload |
Attacker → POST /api/v1/build/{victim_flow_id}/vertices/<bogus-id> |
404 Not Found |
500 {"detail":"Vertex <id> not found"}: the victim graph was loaded before the vertex lookup failed |
| Owner (control) → same endpoints | non-404 | non-404 |
On 1.10.1 and later, the attacker requests return 404 Not Found. This is covered by regression tests in src/backend/tests/unit/test_endpoints.py:
test_get_vertices_returns_404_for_other_users_private_flowtest_get_vertices_with_supplied_data_returns_404_for_other_users_private_flowtest_build_vertex_returns_404_for_other_users_private_flow
Patches
Fixed in Langflow 1.10.1 (langflow-base 0.10.1) by #13153 (merge commit fb3d6ec90b). Both handlers now:
- inject
current_user(forretrieve_vertices_order, this replaces the dependencies-only declaration), - load the flow with an owner-scoped query and return
404when it is not found, so a flow you don't own looks the same as a missing flow, and - call
ensure_flow_permission(current_user, FlowAction.EXECUTE, ...)before building or caching any graph.
# retrieve_vertices_order / build_vertex (1.10.1)
stmt = (
select(Flow)
.where(Flow.id == flow_id)
.where((Flow.user_id == current_user.id) | (Flow.access_type == AccessTypeEnum.PUBLIC))
)
flow = (await session.exec(stmt)).first()
if not flow:
raise HTTPException(status_code=404, detail=f"Flow with id {flow_id} not found")
await ensure_flow_permission(
current_user,
FlowAction.EXECUTE,
flow_id=flow_id,
flow_user_id=flow.user_id,
workspace_id=flow.workspace_id,
folder_id=flow.folder_id,
)
Related hardening in later releases:
- #14342 (1.11.2) applies the same guard to the sibling
GET /api/v1/build/{flow_id}/{vertex_id}/streamroute. - #14497 (1.12.0) makes all three deprecated vertex routes owner-only, dropping the
PUBLICexception, because their graph cache is keyed by flow UUID rather than by the executing user.
Users should upgrade to 1.10.1 or later. The latest release is recommended.
Workarounds
If upgrading is not immediately possible, block POST /api/v1/build/*/vertices and POST /api/v1/build/*/vertices/* (and GET /api/v1/build/*/*/stream) at a reverse proxy. The Langflow UI does not use these routes.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langflow"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.10.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "langflow-base"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-105698"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T20:36:25Z",
"nvd_published_at": "2026-10-05T21:16:35Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nBefore **Langflow 1.10.1**, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:\n\n- `POST /api/v1/build/{flow_id}/vertices` (`retrieve_vertices_order`)\n- `POST /api/v1/build/{flow_id}/vertices/{vertex_id}` (`build_vertex`)\n\nAny authenticated user who knows (or obtains) another user\u0027s `flow_id` could load that user\u0027s private flow graph, enumerate its vertex IDs, and build (execute) individual vertices of it, receiving the vertex results in the response.\n\nBoth routes are declared with `deprecated=True, include_in_schema=False`, so they do not appear in the OpenAPI docs, but they remained registered on the router. The Langflow UI no longer calls them (it uses `POST /api/v1/build/{flow_id}/flow`), so they are only reachable by direct HTTP requests.\n\nThe issue is fixed in **Langflow 1.10.1** (`langflow-base` 0.10.1) by [#13153](https://github.com/langflow-ai/langflow/pull/13153).\n\n### Details\n\nIn affected versions, both handlers go straight to the graph loader:\n\n- `retrieve_vertices_order` (`src/backend/base/langflow/api/v1/chat.py`, lines 81-159 in 1.9.1) only required authentication via `dependencies=[Depends(get_current_active_user)]`. The user was never injected into the handler, and the flow was loaded with `build_graph_from_db(flow_id=flow_id, ...)`.\n- `build_vertex` (`chat.py`, lines 320-491 in 1.9.1) receives `current_user`, but only uses it for variable resolution (`user_id=str(current_user.id)`). It is never used to scope the flow lookup. The graph is taken from the chat-service cache keyed by `flow_id`, or rebuilt with `build_graph_from_db` on a cache miss.\n- `build_graph_from_db_no_cache` (`src/backend/base/langflow/api/utils/flow_utils.py`) does a bare primary-key lookup, `session.get(Flow, flow_id)`, with no owner filter.\n\nThe supported replacement, `POST /api/v1/build/{flow_id}/flow`, already restricted the lookup to the owner or a `PUBLIC` flow (added in #12305 for GHSA-qj98-rhf8-v93f). The deprecated siblings were not covered by that fix, nor by the `_read_flow` fix for GHSA-8c4j-f57c-35cf.\n\nAdditional side effects in affected versions:\n\n- `retrieve_vertices_order` stores the graph in the chat-service cache under the victim\u0027s `flow_id` (`chat_service.set_cache(str(flow_id), graph)`). When the request includes a `data` body, the cached graph is attacker-supplied.\n- `build_vertex` schedules `log_vertex_build` for the victim\u0027s `flow_id`, so attacker-triggered builds are recorded in the victim flow\u0027s vertex build history.\n\nNote on older versions: up to and including **1.7.1**, these two routes had no authentication dependency at all. Authentication was added in 1.7.2 by #10977, but no ownership check was added. This advisory covers the missing ownership check, which is present in every release from 1.0.0 (when the routes were introduced) through 1.10.0.\n\n### Attack scenario\n\n1. The attacker authenticates as any valid user.\n2. The attacker obtains a victim `flow_id` (shared URLs, exported flow files, logs, screenshots, etc.).\n3. `POST /api/v1/build/{victim_flow_id}/vertices` returns **200 OK** with `{\"ids\": [...], \"run_id\": \"...\", \"vertices_to_run\": [...]}` listing the victim flow\u0027s vertex IDs (component type plus suffix, e.g. `ChatInput-abc12`).\n4. The attacker calls `POST /api/v1/build/{victim_flow_id}/vertices/{vertex_id}` for a returned ID. The victim\u0027s graph is loaded and the vertex is built. Its results, outputs and artifacts are returned to the attacker.\n\n### Impact\n\n- **Confidentiality (Low):** Discloses the structure of private flows (vertex IDs and component types) and the outputs of vertices the attacker chooses to build. That includes values hardcoded in node configuration, such as prompt text or fixed inputs.\n - Global variables and credentials in the variable store are **not** exposed, because variable resolution uses the caller\u0027s `user_id`.\n - The victim\u0027s stored flow definition is not returned wholesale.\n- **Integrity (Low):** The attacker can trigger execution of the victim\u0027s nodes, including any side effects baked into their configuration (fixed endpoints, webhooks, hardcoded API keys). Build records are written under the victim\u0027s `flow_id`. The attacker cannot modify the stored flow.\n- **Availability:** None.\n\nThe attacker must be authenticated and must know the target flow UUID. Flow UUIDs are random v4 values, so blind enumeration is not practical.\n\n### Proof of concept\n\nObserved on `langflow==1.9.1` using the project\u0027s test client and in-memory SQLite fixtures (see the attached `poc.zip`):\n\n| Request | Expected (hardened) | Observed on 1.9.1 |\n|---|---|---|\n| Attacker \u2192 `POST /api/v1/build/{victim_flow_id}/vertices` | `404 Not Found` | `200 OK` with vertex order payload |\n| Attacker \u2192 `POST /api/v1/build/{victim_flow_id}/vertices/\u003cbogus-id\u003e` | `404 Not Found` | `500` `{\"detail\":\"Vertex \u003cid\u003e not found\"}`: the victim graph was loaded before the vertex lookup failed |\n| Owner (control) \u2192 same endpoints | non-404 | non-404 |\n\nOn 1.10.1 and later, the attacker requests return `404 Not Found`. This is covered by regression tests in `src/backend/tests/unit/test_endpoints.py`:\n\n- `test_get_vertices_returns_404_for_other_users_private_flow`\n- `test_get_vertices_with_supplied_data_returns_404_for_other_users_private_flow`\n- `test_build_vertex_returns_404_for_other_users_private_flow`\n\n### Patches\n\nFixed in **Langflow 1.10.1** (`langflow-base` 0.10.1) by [#13153](https://github.com/langflow-ai/langflow/pull/13153) (merge commit `fb3d6ec90b`). Both handlers now:\n\n1. inject `current_user` (for `retrieve_vertices_order`, this replaces the dependencies-only declaration),\n2. load the flow with an owner-scoped query and return `404` when it is not found, so a flow you don\u0027t own looks the same as a missing flow, and\n3. call `ensure_flow_permission(current_user, FlowAction.EXECUTE, ...)` before building or caching any graph.\n\n```python\n# retrieve_vertices_order / build_vertex (1.10.1)\nstmt = (\n select(Flow)\n .where(Flow.id == flow_id)\n .where((Flow.user_id == current_user.id) | (Flow.access_type == AccessTypeEnum.PUBLIC))\n)\nflow = (await session.exec(stmt)).first()\nif not flow:\n raise HTTPException(status_code=404, detail=f\"Flow with id {flow_id} not found\")\nawait ensure_flow_permission(\n current_user,\n FlowAction.EXECUTE,\n flow_id=flow_id,\n flow_user_id=flow.user_id,\n workspace_id=flow.workspace_id,\n folder_id=flow.folder_id,\n)\n```\n\nRelated hardening in later releases:\n\n- [#14342](https://github.com/langflow-ai/langflow/pull/14342) (1.11.2) applies the same guard to the sibling `GET /api/v1/build/{flow_id}/{vertex_id}/stream` route.\n- [#14497](https://github.com/langflow-ai/langflow/pull/14497) (1.12.0) makes all three deprecated vertex routes owner-only, dropping the `PUBLIC` exception, because their graph cache is keyed by flow UUID rather than by the executing user.\n\nUsers should upgrade to **1.10.1 or later**. The latest release is recommended.\n\n### Workarounds\n\nIf upgrading is not immediately possible, block `POST /api/v1/build/*/vertices` and `POST /api/v1/build/*/vertices/*` (and `GET /api/v1/build/*/*/stream`) at a reverse proxy. The Langflow UI does not use these routes.",
"id": "GHSA-gh98-4phw-6fmw",
"modified": "2026-10-07T20:36:25Z",
"published": "2026-10-07T20:36:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-gh98-4phw-6fmw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105698"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/pull/13153"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/commit/fb3d6ec90b1e4d52eaa40915a64b1f86b6542f55"
},
{
"type": "PACKAGE",
"url": "https://github.com/langflow-ai/langflow"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/releases/tag/v1.10.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints"
}
GHSA-GH9H-42R8-X5G7
Vulnerability from github – Published: 2026-10-21 00:32 – Updated: 2026-10-21 18:33Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2026-113137"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-20T22:19:05Z",
"severity": "HIGH"
},
"details": "Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
"id": "GHSA-gh9h-42r8-x5g7",
"modified": "2026-10-21T18:33:03Z",
"published": "2026-10-21T00:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113137"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/513758047"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH9M-CJ69-97GH
Vulnerability from github – Published: 2026-01-23 15:31 – Updated: 2026-01-26 21:30Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through <= 2.7.9.
{
"affected": [],
"aliases": [
"CVE-2026-24583"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-23T15:16:16Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through \u003c= 2.7.9.",
"id": "GHSA-gh9m-cj69-97gh",
"modified": "2026-01-26T21:30:36Z",
"published": "2026-01-23T15:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24583"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/sumup-payment-gateway-for-woocommerce/vulnerability/wordpress-sumup-payment-gateway-for-woocommerce-plugin-2-7-9-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHC4-9M25-367H
Vulnerability from github – Published: 2026-09-25 18:31 – Updated: 2026-09-25 18:31Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop_left_child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.
{
"affected": [],
"aliases": [
"CVE-2026-80432"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T17:17:14Z",
"severity": "MODERATE"
},
"details": "Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because drop_enqueue_request() in kitty/dnd.c serves a drag data request without first checking the drop state of the window, so a client that issues the request while a drag is merely hovering receives the data offered for the drag. In the same file, drop_left_child(), which runs when the drag leaves the window without a drop having occurred, releases the offered MIME list but retains the pending request state, the open file descriptor and its main loop transfer timer, the directory handles, the URI list and the pending MIME name, so a client can continue to read through a retained directory handle, and an in-flight file transfer continues to stream, when no drag is in progress. The file contents are read from the filesystem by the kitty process itself using the paths the drag source offered. This results in disclosure of the contents of files the user moved over the window without ever releasing them into it.",
"id": "GHSA-ghc4-9m25-367h",
"modified": "2026-09-25T18:31:27Z",
"published": "2026-09-25T18:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80432"
},
{
"type": "WEB",
"url": "https://github.com/kovidgoyal/kitty/commit/026d11f517da17bfd3c35ea502057babdfbe5828"
},
{
"type": "WEB",
"url": "https://github.com/kovidgoyal/kitty/releases/tag/v0.49.0"
},
{
"type": "WEB",
"url": "https://secur0.com/en/cna/cve-list/cve-2026-80432-kitty-dnd-data-before-drop"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-GHFG-9R57-CHQV
Vulnerability from github – Published: 2025-04-04 18:31 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in Joao Romao Social Share Buttons & Analytics Plugin – GetSocial.io allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Share Buttons & Analytics Plugin – GetSocial.io: from n/a through 4.5.
{
"affected": [],
"aliases": [
"CVE-2025-32239"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-04T16:15:33Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Joao Romao Social Share Buttons \u0026 Analytics Plugin \u2013 GetSocial.io allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Share Buttons \u0026 Analytics Plugin \u2013 GetSocial.io: from n/a through 4.5.",
"id": "GHSA-ghfg-9r57-chqv",
"modified": "2026-04-01T18:34:32Z",
"published": "2025-04-04T18:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32239"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-share-buttons-analytics-by-getsocial/vulnerability/wordpress-social-share-buttons-analytics-plugin-plugin-4-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHG6-RFG3-53G7
Vulnerability from github – Published: 2024-10-02 18:31 – Updated: 2024-10-02 18:31A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device.
This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions such as reading device configuration information, uploading files, and modifying uploaded files. Note: This vulnerability only affects a subset of REST API endpoints and does not affect the web-based management interface.
{
"affected": [],
"aliases": [
"CVE-2024-20438"
],
"database_specific": {
"cwe_ids": [
"CWE-693",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-02T17:15:15Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device.\n\nThis vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this vulnerability by sending crafted API requests to an affected endpoint. A successful exploit could allow the attacker to perform limited network-admin functions such as reading device configuration information, uploading files, and modifying uploaded files.\nNote: This vulnerability only affects a subset of REST API endpoints and does not affect the web-based management interface.",
"id": "GHSA-ghg6-rfg3-53g7",
"modified": "2024-10-02T18:31:32Z",
"published": "2024-10-02T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20438"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndhs-uaapi-Jh4V6zpN"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-GHGW-M72F-XX8V
Vulnerability from github – Published: 2024-06-09 12:30 – Updated: 2024-06-09 12:30Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6.
{
"affected": [],
"aliases": [
"CVE-2023-23640"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-09T10:15:09Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in MainWP MainWP UpdraftPlus Extension.This issue affects MainWP UpdraftPlus Extension: from n/a through 4.0.6.",
"id": "GHSA-ghgw-m72f-xx8v",
"modified": "2024-06-09T12:30:51Z",
"published": "2024-06-09T12:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23640"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/mainwp-updraftplus-extension/wordpress-mainwp-updraftplus-extension-plugin-4-0-6-subscriber-arbitrary-plugin-activation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GHH3-46WV-4FMV
Vulnerability from github – Published: 2026-10-16 15:38 – Updated: 2026-10-16 15:38Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.
{
"affected": [],
"aliases": [
"CVE-2026-111396"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-16T13:16:55Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Post Manager: from n/a through 4.5.6.",
"id": "GHSA-ghh3-46wv-4fmv",
"modified": "2026-10-16T15:38:45Z",
"published": "2026-10-16T15:38:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111396"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/advanced-post-manager/vulnerability/wordpress-advanced-post-manager-plugin-4-5-6-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.