CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2026-5025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-27T15:17:04Z",
    "severity": "MODERATE"
  },
  "details": "The \u0027/logs\u0027 and \u0027/logs-stream\u0027 endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication (\u0027get_current_active_user\u0027) without any privilege checks (e.g., \u0027is_superuser\u0027).",
  "id": "GHSA-jpqv-w4r8-mmqw",
  "modified": "2026-03-27T15:30:26Z",
  "published": "2026-03-27T15:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5025"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/research/tra-2026-23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-39749"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T09:17:46Z",
    "severity": "MODERATE"
  },
  "details": "Subscriber Broken Access Control in App for Cloudflare\u00ae \u003c= 1.10.1 versions.",
  "id": "GHSA-jpqw-xf2f-65rh",
  "modified": "2026-10-06T09:31:26Z",
  "published": "2026-10-06T09:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39749"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/app-for-cf/vulnerability/wordpress-app-for-cloudflare-plugin-1-10-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-32244"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-10T08:15:20Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in QuantumCloud SEO Help allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SEO Help: from n/a through 6.6.1.",
  "id": "GHSA-jpr3-g2j4-m8cp",
  "modified": "2026-04-01T18:34:38Z",
  "published": "2025-04-10T09:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32244"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/seo-help/vulnerability/wordpress-seo-help-plugin-6-6-0-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-62999"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T16:18:05Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in themezaa Litho Addons litho-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Litho Addons: from n/a through \u003c= 3.4.",
  "id": "GHSA-jprr-5wvh-3rxj",
  "modified": "2026-01-20T15:32:02Z",
  "published": "2025-12-09T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62999"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/litho-addons/vulnerability/wordpress-litho-addons-plugin-3-4-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/litho-addons/vulnerability/wordpress-litho-addons-plugin-3-4-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-12734"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-06T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "SiteVision 4 has Incorrect Access Control.",
  "id": "GHSA-jpw6-2r95-2wmf",
  "modified": "2024-04-04T02:42:06Z",
  "published": "2022-05-24T17:02:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12734"
    },
    {
      "type": "WEB",
      "url": "https://support.sitevision.com/Main/Default.aspx"
    },
    {
      "type": "WEB",
      "url": "https://www.cybercom.com/About-Cybercom/Blogs/Security-Advisories/high-risk-vulnerabilities-in-cms-product"
    },
    {
      "type": "WEB",
      "url": "https://www.cybercom.com/contentassets/ac929be030744b8e92dc6e457fdb7dcc/sitevision-disclosure-insufficient-access-control.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.sitevision.se"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/155584/SiteVision-4.x-5.x-Insufficient-Module-Access-Control.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2019/Dec/12"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2019/Dec/13"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-63293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-03T21:19:38Z",
    "severity": "MODERATE"
  },
  "details": "FairSketch Rise Ultimate Project Manager \u0026 CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API.",
  "id": "GHSA-jpw9-952g-5qcp",
  "modified": "2025-11-03T21:34:45Z",
  "published": "2025-11-03T21:34:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63293"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/@barrattjack89/cve-2025-63293-insecure-permissions-in-rise-crm-3-9-4-452c88c24195"
    },
    {
      "type": "WEB",
      "url": "http://fairsketch.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-30926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-01T06:15:55Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in KingAddons.com King Addons for Elementor. This issue affects King Addons for Elementor: from n/a through 24.12.58.",
  "id": "GHSA-jpx4-2v97-44rr",
  "modified": "2026-04-01T18:34:18Z",
  "published": "2025-04-01T06:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30926"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/king-addons/vulnerability/wordpress-king-addons-for-elementor-plugin-24-12-58-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-24353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-14T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects.",
  "id": "GHSA-jpx5-rg85-r3xv",
  "modified": "2022-07-29T00:00:42Z",
  "published": "2022-05-24T19:05:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24353"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/74c23d56-e81f-47e9-bf8b-33d3f0e81894"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/blog/2021/05/severe-vulnerabilities-patched-in-simple-301-redirects-by-betterlinks-plugin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-4600"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-30T12:15:09Z",
    "severity": "MODERATE"
  },
  "details": "The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027affwp_activate_addons_page_plugin\u0027 function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to activate arbitrary plugins.",
  "id": "GHSA-jq25-pgm7-4vh9",
  "modified": "2024-04-04T07:16:30Z",
  "published": "2023-08-30T12:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4600"
    },
    {
      "type": "WEB",
      "url": "https://affiliatewp.com/changelog"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eab422b8-8cf5-441e-a21f-6a0e1b7642b2?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.6.0"
            },
            {
              "fixed": "5.9.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:34:52Z",
    "nvd_published_at": "2026-04-22T00:16:28Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `actionSavePermissions()` endpoint allows a user with only `viewUsers` permission to remove arbitrary users from all user groups. While `_saveUserGroups()` enforces per-group authorization for additions, it performs no equivalent authorization check for removals, so submitting an empty `groups` value removes all existing group memberships.\n\n## Affected Versions\n\n- Craft CMS 5.6.0 through 5.9.14 (latest release at time of report)\n- Regression introduced in 5.6.0 when the `viewUsers` permission was added\n- Prior to 5.6.0, `editedUser()` required `editUsers`, which implicitly protected this endpoint\n- Requires Pro edition or higher (the vulnerable code path is gated by `CmsEdition::Pro`)\n\n## Vulnerability Details\n\n### Root Cause\n\nThis is a **regression** introduced in Craft CMS 5.6.0 when the `viewUsers` permission was added. Before that change, `editedUser()` required `editUsers` permission for accessing other users\u2019 data, which implicitly protected `actionSavePermissions()`. After the change, `actionSavePermissions()` became reachable for users with read-only access to other users, but the underlying group-saving logic still lacked authorization for group removals.\n\nThe vulnerability has two components:\n\n1. **`actionSavePermissions()` reachable with read-only access**: The action only requires a control panel request and delegates to `editedUser()`, which now only checks `viewUsers` \u2014 a permission explicitly documented as \"read-only access to user elements.\"\n\n2. **Asymmetric authorization in `_saveUserGroups()`**: The method checks `assignUserGroup` permission only when **adding** a user to a new group. When the `groups` parameter is an empty string (resulting in an empty array), the loop is skipped entirely, no authorization checks are run, and all group memberships are removed.\n\n### Prerequisites\n\n- Attacker has a control panel account with `accessCp` and `viewUsers` permissions only\n- Target user belongs to one or more user groups that grant additional permissions\n- Pro edition or higher\n\n### Attack Steps\n\n1. Attacker authenticates to the Control Panel\n2. Attacker sends a POST request to `actions/users/save-permissions` with:\n   - `userId` = target user\u0027s ID\n   - `groups` = `` (empty string)\n3. All group memberships for the target user are removed\n4. All permissions inherited from those groups are immediately revoked\n\n### Impact\n\n- **Privilege revocation**: An attacker can strip group-based permissions from arbitrary users, including accounts whose effective access derives from group membership\n- **Denial of access**: Users lose access to sections, volumes, and features that were granted through group membership\n- **Bypass of elevated session requirement**: Group removal does not trigger `requireElevatedSession()` (which is only triggered when new groups are added)",
  "id": "GHSA-jq2f-59pj-p3m3",
  "modified": "2026-04-24T20:42:09Z",
  "published": "2026-04-14T23:34:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-jq2f-59pj-p3m3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/b135384808ad43fcf8836a9dd9b877fb0087bc27"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action"
}