CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2026-72823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-14T12:16:45Z",
    "severity": "MODERATE"
  },
  "details": "The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources.",
  "id": "GHSA-mfhq-ghcj-c36q",
  "modified": "2026-08-14T12:31:26Z",
  "published": "2026-08-14T12:31:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-vq9w-jwj5-wfjg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72823"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-before-api-key-scope-cap-bypass-via-democontroller"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-0293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-14T21:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Read of RFC destination does not always perform necessary authorization checks, resulting in escalation of privileges to access information on RFC destinations on managed systems and SAP Solution Manager system (ST-PI, before versions 2008_1_700, 2008_1_710, and 740).",
  "id": "GHSA-mfmp-hpg9-83ch",
  "modified": "2024-04-04T00:38:39Z",
  "published": "2022-05-24T16:45:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0293"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2756625"
    },
    {
      "type": "WEB",
      "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=520259032"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/108324"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-39612"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-08T09:16:30Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in kutethemes KuteShop kuteshop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KuteShop: from n/a through \u003c= 4.2.9.",
  "id": "GHSA-mfmr-7g5x-h6pm",
  "modified": "2026-04-13T21:30:35Z",
  "published": "2026-04-08T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39612"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/kuteshop/vulnerability/wordpress-kuteshop-theme-4-2-9-arbitrary-shortcode-execution-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-63049"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T16:18:10Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through \u003c= 1.0.2.",
  "id": "GHSA-mfr5-v73v-62qr",
  "modified": "2026-01-20T15:32:03Z",
  "published": "2025-12-09T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63049"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/listingpro-lead-form/vulnerability/wordpress-listingpro-lead-form-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/listingpro-lead-form/vulnerability/wordpress-listingpro-lead-form-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260724121519-426991d155c0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72798"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-04T20:58:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "**CVE:** This vulnerability corresponds to [CVE-2026-72798](https://nvd.nist.gov/vuln/detail/CVE-2026-72798).\n\n### Summary\n\n`renderAttributeView` correctly applies the reader publish-access filter, but the filter\u0027s row-accessibility decision is keyed solely to the row\u0027s **first cell**, and it never inspects the remaining cells\u0027 values. Relation and Rollup cells carry mirrored content from a *different* database, so a row belonging to a published database can hand an anonymous reader the contents of a related database whose host document is hidden, publish-forbidden, or password-protected. Separately, when the first column is not a block value the accessibility check is skipped entirely and the row is returned unchecked.\n\n### Note:\n\nThis is distinct from the previously reported password-tier omission in the same function that concerns the row\u0027s own primary block, whereas these two defects concern (a) other cells\u0027 related-database content, which no row-level check covers and (b) rows where the first cell is not a block at all. A fix to the row-drop condition alone would close neither.\n\n### Details\n\n`renderAttributeView` applies the filter (`kernel/api/av.go:68`):\n```go\nretDataMap[\"view\"] = model.FilterViewByPublishAccess(c, publishAccess, retDataMap[\"view\"].(av.Viewable))\n```\n\nInside `FilterViewByPublishAccess` (`kernel/model/publish_access.go`):\n```go\nif row.Cells[0].Value.Block != nil {\n    bt = treenode.GetBlockTree(row.Cells[0].Value.Block.ID)\n}\nif bt != nil {\n    if !CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) {\n        row = nil   // drop\n    }\n}\n// every other cell in the row is returned as-is\n```\n\n**(a) Relation and Rollup cells leak the related database.** These value types carry mirrored content, not just references:\n```go\ntype ValueRelation struct { BlockIDs []string; Contents []*Value }\ntype ValueRollup   struct { Contents []*Value }\n```\nThe render pipeline populates them from a different attribute view e.g. `kernel/model/attribute_view.go:2731`:\n```go\nv.GroupVal.Relation.Contents = []*av.Value{ relationDestAv.GetBlockValue(groupValue) }\n```\n`relationDestAv` is a separate database that may live in a hidden, publish-forbidden, or password-protected document. When a published database\u0027s row survives the filter (because its column-0 document is public), its Relation and Rollup columns return the related, non-published database\u0027s content block text, titles, and mirrored column values. `FilterViewByPublishAccess` performs no publish-access evaluation on `Relation.Contents` or `Rollup.Contents`.\n\n**(b) Fail-open when column 0 is not a block.** `bt` is assigned only when `row.Cells[0].Value.Block != nil`. If the first column is a non-block type (Relation, Text, \u2026) or the row is detached, `bt` remains `nil`, the `if bt != nil` guard is skipped, and the row is returned with no accessibility check at all. Column order is user-reorderable, so any database whose first column is not the document block bypasses row filtering entirely.\n\nVerified at `origin/master` (`eef105683`).\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808); anonymous when `Publish.Auth.Enable` is `false`. Two databases: **DB-A** hosted in a published document, **DB-B** hosted in a publish-forbidden or password-protected document, with a Relation column in DB-A pointing at DB-B and containing a distinctive marker value.\n\n**(a) Related-database content disclosure:**\n```\nPOST http://127.0.0.1:6808/api/av/renderAttributeView\n{\"id\":\"\u003cDB_A_AV_ID\u003e\"}\n```\nRows of DB-A are returned (correctly, since its host document is public), and their Relation/Rollup cell `Contents` include DB-B\u0027s block text and mirrored column values, despite DB-B\u0027s host document being excluded from publishing.\n\n**(b) Fail-open row:**\nReorder DB-A so its first column is a non-block type (or use a detached row), mark its host document publish-forbidden, and request the same endpoint the row is returned without any accessibility evaluation.\n\n*Verification status:* both defects are confirmed by code inspection at `origin/master`. A live demonstration requires a build from HEAD with two linked databases; available on request.\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can read content from databases whose host documents are hidden, publish-forbidden, or password-protected, by requesting a *published* database that relates to them. Because relation graphs are commonly used to link a public index to private detail records, this exposes exactly the data the publish boundary is meant to withhold. The fail-open path additionally returns rows with no accessibility check whenever the first column is not a block value, which is a user-controlled layout property. Confidentiality-only.\n\n### Suggested fix\n\nIn `FilterViewByPublishAccess`:\n1. For each retained row, evaluate every `Relation.Contents` and `Rollup.Contents` entry against `CheckBlockIdAccessableByPublishAccess` (including the publish-password tier) and drop or mask entries that fail.\n2. Fail closed: when `row.Cells[0]` has no accessible block (`Value.Block == nil` or `bt == nil`), drop the row rather than returning it unchecked.",
  "id": "GHSA-mfrj-v65r-979c",
  "modified": "2026-09-04T20:58:04Z",
  "published": "2026-09-04T20:58:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mfrj-v65r-979c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72798"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/426991d155c0c7c3a9e71badd6761eddfa8aad5b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-renderattributeview"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-36427"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-06T23:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Missing Access Control vulnerability in About Rentals. Inc. About Rentals plugin \u003c= 1.5 at WordPress.",
  "id": "GHSA-mfvg-37xj-9w4x",
  "modified": "2022-09-10T00:00:35Z",
  "published": "2022-09-07T00:01:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36427"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/about-rentals/wordpress-about-rentals-plugin-1-5-missing-access-control-vulnerability/_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/about-rentals"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-46082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-02T12:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Cyberlord92 Broken Link Checker | Finder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broken Link Checker | Finder: from n/a through 2.4.2.",
  "id": "GHSA-mfvg-hp2g-pr6f",
  "modified": "2026-04-23T15:34:13Z",
  "published": "2025-01-02T12:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46082"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/broken-link-finder/vulnerability/wordpress-broken-link-checker-finder-plugin-2-4-2-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-49432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-08-15T16:15:29Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in FWDesign Ultimate Video Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Video Player: from n/a through 10.1.",
  "id": "GHSA-mfvx-x37r-j8rx",
  "modified": "2026-04-01T18:35:53Z",
  "published": "2025-08-15T18:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49432"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/fwduvp/vulnerability/wordpress-ultimate-video-player-plugin-plugin-10-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-82633"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-30T13:16:56Z",
    "severity": "MODERATE"
  },
  "details": "Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitrary user identifiers to access group names, entity associations, and private notes across tenant boundaries.",
  "id": "GHSA-mfxx-qcw7-5q5r",
  "modified": "2026-08-30T15:30:26Z",
  "published": "2026-08-30T15:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82633"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr/commit/fd478850f823e27c672300acb4b02baeef79aef1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr/blob/23.0.4/htdocs/user/class/api_users.class.php"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/dolibarr-10.0.0-before-24.0.0-missing-authorization-on-rest-users-groups-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-28515"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-27T23:16:05Z",
    "severity": "CRITICAL"
  },
  "details": "openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.",
  "id": "GHSA-mg2w-x76x-59h8",
  "modified": "2026-03-10T15:31:30Z",
  "published": "2026-02-28T00:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28515"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opendcim/openDCIM/pull/1664"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09"
    },
    {
      "type": "WEB",
      "url": "https://chocapikk.com/posts/2026/opendcim-sqli-to-rce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Chocapikk/opendcim-exploit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opendcim/openDCIM/blob/4467e9c4/container-install.php#L421-L435"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L293"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}