CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2024-5600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-09T09:15:06Z",
    "severity": "MODERATE"
  },
  "details": "The SCSS Happy Compiler \u2013 Compile SCSS to CSS \u0026 Automatic Enqueue plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check and insufficient sanitization on the import_settings() function in all versions up to, and including, 1.3.10. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject malicious web scripts.",
  "id": "GHSA-jpfv-v788-59pg",
  "modified": "2026-04-08T18:33:32Z",
  "published": "2024-07-09T09:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5600"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/happy-scss-compiler/trunk/admin/class-hm-wp-scss-admin.php#L384"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3d0ecffe-8543-4d82-a1cc-f2474499f373?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-4119"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T09:16:23Z",
    "severity": "CRITICAL"
  },
  "details": "The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post action hooks for creating tables (admin_post_add_table) and deleting tables (admin_post_delete_db_table) without implementing any capability checks via current_user_can() or nonce verification via wp_verify_nonce()/check_admin_referer(). The admin_post hook only requires the user to be logged in, meaning any authenticated user including Subscribers can access these endpoints. The cdbt_delete_db_table() function takes a user-supplied table name from $_POST[\u0027db_table\u0027] and executes a DROP TABLE SQL query, allowing any authenticated attacker to delete any database table including critical WordPress core tables such as wp_users or wp_options. The cdbt_create_new_table() function similarly allows creating arbitrary tables. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary database tables and delete any existing database table, potentially destroying the entire WordPress installation.",
  "id": "GHSA-jpj9-vrh6-4wmc",
  "modified": "2026-04-22T09:31:33Z",
  "published": "2026-04-22T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4119"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L370"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L376"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L405"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-db-tables.php#L408"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-new-table.php#L14"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/tags/1.2.1/create-new-table.php#L69"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L370"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L376"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L405"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-db-tables.php#L408"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-new-table.php#L14"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/create-db-tables/trunk/create-new-table.php#L69"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1a3bc4b-cc17-4728-b242-13841b5f7660?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-11742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-18T06:15:38Z",
    "severity": "MODERATE"
  },
  "details": "The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the \u0027wishlist_quickview\u0027 AJAX action in all versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user\u0027s wishlist data and information.",
  "id": "GHSA-jpjg-wf9r-25rj",
  "modified": "2025-10-18T06:30:25Z",
  "published": "2025-10-18T06:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11742"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3378540%40woo-smart-wishlist\u0026new=3378540%40woo-smart-wishlist\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/60d65c7e-5533-4ac0-b2f0-339342224581?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.19.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/getarcaneapp/arcane/backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.19.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47125"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-23T00:16:56Z",
    "nvd_published_at": "2026-05-29T18:17:12Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `PUT /api/environments/{id}/templates/variables` endpoint, which writes the system-wide `.env.global` file used for variable substitution in every project\u0027s compose file, is missing an admin authorization check. Any authenticated non-admin user can call this endpoint with their bearer token or API key and overwrite the global environment variables that are merged into every project deployment. By overriding values like `REGISTRY`, `IMAGE`, `DATABASE_URL`, or `SECRET_KEY` that other users reference via `${VAR}` in compose files, an attacker can redirect image pulls to attacker-controlled registries (supply-chain RCE on the Docker host), exfiltrate database credentials, or disrupt all projects.\n\n## Details\n\nThe endpoint is registered at `backend/internal/huma/handlers/templates.go:374`:\n\n```go\nhuma.Register(api, huma.Operation{\n    OperationID: \"updateGlobalVariables\",\n    Method:      \"PUT\",\n    Path:        \"/environments/{id}/templates/variables\",\n    ...\n    Security: []map[string][]string{\n        {\"BearerAuth\": {}},\n        {\"ApiKeyAuth\": {}},\n    },\n}, h.UpdateGlobalVariables)\n```\n\nThe handler at `backend/internal/huma/handlers/templates.go:889` performs no role check:\n\n```go\nfunc (h *TemplateHandler) UpdateGlobalVariables(ctx context.Context, input *UpdateGlobalVariablesInput) (*UpdateGlobalVariablesOutput, error) {\n    if h.templateService == nil {\n        return nil, huma.Error500InternalServerError(\"service not available\")\n    }\n\n    if input.EnvironmentID != \"0\" {\n        return h.updateGlobalVariablesForRemoteEnvironmentInternal(ctx, input)\n    }\n\n    if err := h.templateService.UpdateGlobalVariables(ctx, input.Body.Variables); err != nil {\n        return nil, huma.Error500InternalServerError((\u0026common.GlobalVariablesUpdateError{Err: err}).Error())\n    }\n    ...\n}\n```\n\nThis is anomalous compared to every other admin-sensitive handler in the codebase, all of which begin with `if err := checkAdmin(ctx); err != nil { return nil, err }` (see `users.go`, `events.go`, `swarm.go`, `settings.go`, `apikeys.go`, `environments.go`, `notifications.go`, `container_registries.go`, `git_repositories.go`, `system.go`). The helper exists at `backend/internal/huma/handlers/helpers.go:12` but is never invoked from `templates.go`.\n\nThe auth middleware at `backend/internal/huma/middleware/auth.go:192-254` only validates that *some* authenticated user is present (Bearer JWT, API key, or environment access token); it does not enforce roles. Role enforcement is the responsibility of each handler.\n\nThat this endpoint is intended to be admin-only is evidenced by the UI customization search at `backend/internal/huma/handlers/customize.go:82-91` and `:106-114`, which explicitly hides the `variables` and `registries` categories from non-admin users:\n\n```go\nif !humamw.IsAdminFromContext(ctx) {\n    filtered := []category.Category{}\n    for _, cat := range results.Results {\n        if cat.ID != \"registries\" \u0026\u0026 cat.ID != \"variables\" {\n            filtered = append(filtered, cat)\n        }\n    }\n    results.Results = filtered\n    ...\n}\n```\n\nThe corresponding `container_registries.go` handlers all enforce admin via `checkAdmin()` (e.g. `container_registries.go:273,329,360,387,442`); the equivalent enforcement for the global-variables write was forgotten.\n\nThe service layer at `backend/internal/services/template_service.go:1107` writes attacker-supplied keys/values to `\u003cprojectsDirectory\u003e/.env.global`:\n\n```go\nfunc (s *TemplateService) UpdateGlobalVariables(ctx context.Context, vars []env.Variable) error {\n    envPath, err := s.getGlobalVariablesPath(ctx)\n    ...\n    for _, v := range vars {\n        if strings.TrimSpace(v.Key) == \"\" { continue }\n        key := strings.TrimSpace(v.Key)\n        value := strings.TrimSpace(v.Value)\n        if strings.ContainsAny(value, \" \\t\\n\\r#\") {\n            value = fmt.Sprintf(`\"%s\"`, strings.ReplaceAll(value, `\"`, `\\\"`))\n        }\n        _, _ = fmt.Fprintf(\u0026builder, \"%s=%s\\n\", key, value)\n    }\n    if err := projects.WriteFileWithPerm(envPath, builder.String(), common.FilePerm); err != nil { ... }\n}\n```\n\nThat file is then loaded for every project at deploy time via `backend/pkg/projects/env.go:65-82` (`EnvLoader.LoadEnvironment` \u2192 `loadAndMergeGlobalEnv`):\n\n```go\nif strings.TrimSpace(l.projectsDir) != \"\" {\n    globalEnvPath := filepath.Join(l.projectsDir, GlobalEnvFileName)\n    if err := l.loadAndMergeGlobalEnv(ctx, globalEnvPath, envMap, injectionVars); err != nil ...\n}\n```\n\n`loadAndMergeGlobalEnv` (`env.go:94-125`) populates both `envMap` (used by compose-go for `${VAR}` substitution in compose files) and `injectionVars` (auto-injected into containers). The result: a single non-admin write to the global variables endpoint changes the resolved compose state of every project on the host.\n\nAdditionally, the key field is only `strings.TrimSpace`\u0027d (`template_service.go:1128`); embedded newlines inside the key are not removed, so a key like `\"FOO\\nINJECTED\"` will write two lines into `.env.global`, allowing arbitrary key injection and overwrite of variables an attacker did not include in their request body.\n\n## Impact\n\n- **Cross-project supply-chain RCE on the Docker host.** Compose files commonly reference `${REGISTRY}/${IMAGE}:${TAG}`. By pointing `REGISTRY` (or `IMAGE`) at an attacker-controlled registry, the next deploy of any affected project pulls and runs attacker code with whatever privileges Arcane gives that container (commonly Docker socket access, host volume mounts, etc.).\n- **Credential theft from other users\u0027 projects.** Variables like `DATABASE_URL`, `SMTP_HOST`, `WEBHOOK_URL`, `S3_ENDPOINT` can be redirected to attacker-controlled servers; the next deploy will hand the new connection strings to applications that then submit credentials/data to the attacker.\n- **Cross-tenant integrity and availability.** A single non-admin user can corrupt `.env.global` to break every project on the instance.\n- **Bypass of intended privilege boundary.** The UI explicitly hides the variables and registries surfaces from non-admins, indicating these are admin-only controls; this finding closes the gap between the documented privilege model and the API enforcement.\n\nThe privilege delta is significant: the project clearly distinguishes admin from non-admin users (separate roles, admin-only UI categories, `checkAdmin()` enforced on dozens of other endpoints), yet this endpoint grants a non-admin the ability to execute attacker-controlled images on the host on behalf of every other tenant.",
  "id": "GHSA-jpjh-jm2p-39hh",
  "modified": "2026-06-09T10:30:50Z",
  "published": "2026-05-23T00:16:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getarcaneapp/arcane/security/advisories/GHSA-jpjh-jm2p-39hh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47125"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getarcaneapp/arcane"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Arcane: Missing admin authorization on global variables endpoint"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-6872"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-03T12:15:17Z",
    "severity": "MODERATE"
  },
  "details": "The Build Your Dream Website Fast with 400+ Starter Templates and Landing Pages, No Coding Needed, One-Click Import for Elementor \u0026 Gutenberg Blocks! \u2013 TemplateSpare plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027templatespare_activate_required_theme\u0027 and \u0027templatespare_get_theme_status\u0027 functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate any installed theme and read any theme status. If the attacker attempts to activate a theme that is not installed, a non-existent theme with the slug chosen by the attacker will be considered the active theme, leaving the site with no theme functionality.",
  "id": "GHSA-jpjp-f6hh-7rpq",
  "modified": "2025-03-01T03:30:55Z",
  "published": "2024-08-03T12:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6872"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/templatespare/trunk/includes/templatespare-kit.php#L13"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/templatespare/trunk/includes/templatespare-kit.php#L34"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3129809"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c74807-b85c-478e-bebf-1f0b46a21c11?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-1778"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-23T07:15:48Z",
    "severity": "MODERATE"
  },
  "details": "The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_bookmark() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter bookmark statuses.",
  "id": "GHSA-jpph-v56f-mxcx",
  "modified": "2024-02-23T09:30:38Z",
  "published": "2024-02-23T09:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1778"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/admin-side-data-storage-for-contact-form-7/trunk/inc/admin/class.ztdcfcf.admin.action.php#L235"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d74040d0-1fee-4906-af6f-a5d842c42fd4?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "golang.org/x/crypto"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.52.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-39833"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-25T22:13:31Z",
    "nvd_published_at": "2026-05-22T04:16:22Z",
    "severity": "CRITICAL"
  },
  "details": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
  "id": "GHSA-jppx-rxg9-jmrx",
  "modified": "2026-07-07T15:27:28Z",
  "published": "2026-06-25T22:13:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39833"
    },
    {
      "type": "PACKAGE",
      "url": "https://cs.opensource.google/go/x/crypto"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/778640"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/778641"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/issue/79436"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2026-5005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "golang.org/x/crypto doesn\u0027t enforce invoking key constraints"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-87611"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T01:17:19Z",
    "severity": "LOW"
  },
  "details": "Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-jpqc-gpr9-7pp8",
  "modified": "2026-09-09T18:31:51Z",
  "published": "2026-09-09T03:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87611"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/495876543"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0856"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-06T23:15:51Z",
    "severity": "HIGH"
  },
  "details": "The PGS Core plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.8.0. This makes it possible for unauthenticated attackers to add, modify, or plugin options.",
  "id": "GHSA-jpqq-22mr-fmc5",
  "modified": "2025-05-07T00:31:34Z",
  "published": "2025-05-07T00:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0856"
    },
    {
      "type": "WEB",
      "url": "https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c33b1cb-6eb1-48cd-b706-5ec270f4ae7e?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-118754"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-28T22:17:14Z",
    "severity": "MODERATE"
  },
  "details": "Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.",
  "id": "GHSA-jpqr-vpm2-xhh4",
  "modified": "2026-10-29T00:31:24Z",
  "published": "2026-10-29T00:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118754"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr/pull/41108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr/commit/f4ee5e9722c7ae04bf22a4afff8d8b91802d8157"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr/blob/24.0.1/htdocs/public/recruitment/view.php#L106"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.2-missing-authorization-via-public-recruitment-view-php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}