Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

18712 vulnerabilities reference this CWE, most recent first.

CVE-2026-107763 (GCVE-0-2026-107763)

Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-18 11:22
VLAI
Title
Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
Summary
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:10 UTC
CWE
Assigner
Wordfence CNA under the mitre root
CNA scorecard C 65/100 over 2260 records in the last 180 days details
References
Impacted products
Vendor Product Version
hostspa Fastcache by Host.it Affected: 0 , ≤ 1.7.5 (semver)
Create a notification for this product.
Credits
Wordfence PRISM
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107763",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:10:14.166836Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:22:48.291Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Fastcache by Host.it",
          "vendor": "hostspa",
          "versions": [
            {
              "lessThanOrEqual": "1.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin\u0027s page-cache rewrite rules in the site\u0027s root .htaccess file."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:04.849Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f0b4db0-2ccd-47e8-8f40-82e97726f815?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Admin.php#L304"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Admin.php#L44"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/fastcache-by-host-it/tags/1.7.4/src/Core/Platform/Utility.php#L372"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3737013%40fastcache-by-host-it\u0026new=3737013%40fastcache-by-host-it"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-09T04:48:47.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Fastcache by Host.it \u003c= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107763",
    "datePublished": "2026-10-17T02:31:04.849Z",
    "dateReserved": "2026-10-08T19:10:07.035Z",
    "dateUpdated": "2026-10-18T11:22:48.291Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107746 (GCVE-0-2026-107746)

Vulnerability from cvelistv5 – Published: 2026-10-16 04:27 – Updated: 2026-10-16 15:53
VLAI
Title
FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter
Summary
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII — including full name, street address, email address, and phone number — for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:49 UTC
CWE
Assigner
Wordfence CNA under the mitre root
CNA scorecard C 65/100 over 2260 records in the last 180 days details
References
Impacted products
Credits
Kuba
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107746",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:31.146847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:53:00.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FunnelKit \u2013 Funnel Builder Plugin for WooCommerce Checkout",
          "vendor": "teamfunnelkit",
          "versions": [
            {
              "lessThanOrEqual": "3.16.0.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve billing PII \u2014 including full name, street address, email address, and phone number \u2014 for any WooCommerce order on the site by submitting an enumerable sequential order ID. This is only exploitable on sites where a FunnelKit thank-you page exists that renders the [wfty_order_meta] or [wfty_order_total] shortcode."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T04:27:03.447Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc9883b7-ea99-41e4-adf6-a3988f616a3f?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L318"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L328"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/includes/class-wfty-data.php#L286"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/funnel-builder/tags/3.16.0.5/modules/thankyou-pages/class-wffn-thank-you-wc-pages.php#L429"
        },
        {
          "url": "https://downloads.wordpress.org/plugin/funnel-builder.3.17.0.zip"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T18:41:24.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T15:40:24.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "FunnelKit \u003c= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via \u0027order_id\u0027 / \u0027order\u0027 POST Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107746",
    "datePublished": "2026-10-16T04:27:03.447Z",
    "dateReserved": "2026-10-08T18:26:05.307Z",
    "dateUpdated": "2026-10-16T15:53:00.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107744 (GCVE-0-2026-107744)

Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22
VLAI
Title
LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
Summary
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:07 UTC
CWE
Assigner
Wordfence CNA under the mitre root
CNA scorecard C 65/100 over 2260 records in the last 180 days details
References
Impacted products
Credits
Kuba
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:07:56.529901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:22:46.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:30.064Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1894596-b430-41b3-9d28-12c7dea7ff9b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L105"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-request-handler.php#L173"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3750011/learnpress/trunk/inc/admin/class-lp-admin-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T18:40:24.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:31:20.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via \u0027search-authors\u0027 AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107744",
    "datePublished": "2026-10-17T03:43:30.064Z",
    "dateReserved": "2026-10-08T18:25:02.823Z",
    "dateUpdated": "2026-10-18T11:22:46.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107725 (GCVE-0-2026-107725)

Vulnerability from cvelistv5 – Published: 2026-10-08 22:04 – Updated: 2026-10-09 14:53
VLAI
Title
Hazelcast: Authorization bypass in IMap Predicates API
Summary
Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 14:51 UTC
CWE
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7613 records in the last 180 days details
References
Impacted products
Vendor Product Version
hazelcast hazelcast Affected: < 5.4.5
Affected: >= 5.5.0, < 5.5.10
Affected: >= 5.6.0, < 5.6.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107725",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T14:51:55.522210Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T14:53:26.897Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hazelcast",
          "vendor": "hazelcast",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.4.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.5.0, \u003c 5.5.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.6.0, \u003c 5.6.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T22:04:28.446Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-w294-6q5q-53p8"
        },
        {
          "name": "https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/hazelcast/hazelcast/commit/5d68f4828e2a914398a39f12fe11cafd335cefe0"
        },
        {
          "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/community"
        },
        {
          "name": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.hazelcast.com/hazelcast/5.7/release-notes/enterprise"
        }
      ],
      "source": {
        "advisory": "GHSA-w294-6q5q-53p8",
        "discovery": "UNKNOWN"
      },
      "title": "Hazelcast: Authorization bypass in IMap Predicates API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107725",
    "datePublished": "2026-10-08T22:04:28.446Z",
    "dateReserved": "2026-10-08T17:21:52.976Z",
    "dateUpdated": "2026-10-09T14:53:26.897Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107659 (GCVE-0-2026-107659)

Vulnerability from cvelistv5 – Published: 2026-10-16 04:27 – Updated: 2026-10-16 17:07
VLAI
Title
Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT
Summary
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route' parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin's own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:46 UTC
CWE
Assigner
Wordfence CNA under the mitre root
CNA scorecard C 65/100 over 2260 records in the last 180 days details
References
Impacted products
Credits
Kuba
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T16:46:55.040888Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T17:07:09.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Modula Image Gallery \u2013 Photo Grid \u0026 Video Gallery",
          "vendor": "wpchill",
          "versions": [
            {
              "lessThanOrEqual": "3.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Modula Image Gallery \u2013 Photo Grid \u0026 Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the \u0027id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for collection route\u0027 parameter. This makes it possible for unauthenticated attackers to extract the plaintext Password Protect password and username for every published gallery from the modulaSettings REST field. The plugin\u0027s own /wp-json/modula/v2/gallery/{id}/settings endpoint correctly redacts the password for unauthenticated callers via redact_settings_for_public(), but no equivalent redaction is applied on the core /wp-json/wp/v2/modula-gallery path exposed by show_in_rest=true CPT registration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T04:27:05.213Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea70ffaf-b78b-4550-b334-d105f25b3f61?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L209"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/tags/3.0.11/includes/admin/cpt/class-modula-cpt.php#L141"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/modula-best-grid-gallery/"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3729079/modula-best-grid-gallery/trunk/includes/admin/cpt/class-modula-cpt.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T14:52:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-15T16:17:24.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Modula Image Gallery \u003c= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed \u0027modulaSettings\u0027 REST field on the modula-gallery CPT"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107659",
    "datePublished": "2026-10-16T04:27:05.213Z",
    "dateReserved": "2026-10-08T14:36:43.799Z",
    "dateUpdated": "2026-10-16T17:07:09.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107623 (GCVE-0-2026-107623)

Vulnerability from cvelistv5 – Published: 2026-10-08 14:39 – Updated: 2026-10-08 17:41
VLAI
Title
Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation
Summary
A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:41 UTC
CWE
Assigner
redhat CNA under the redhat root
CNA scorecard B 82/100 over 1036 records in the last 180 days details
References
URL Tags
https://access.redhat.com/security/cve/CVE-2026-107623 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2547957 issue-trackingx_refsource_REDHAT
Impacted products
Vendor Product Version
Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
Create a notification for this product.
Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
Create a notification for this product.
Date Public
2026-10-07 12:39
Credits
Red Hat would like to thank Peter Su (psu512) for reporting this issue.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107623",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:41:07.629367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:41:13.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "keycloak-services",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat Build of Keycloak",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Peter Su (psu512) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-07T12:39:27.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T14:39:35.945Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-107623"
        },
        {
          "name": "RHBZ#2547957",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547957"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-07T12:39:27.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-07T12:39:27.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-862: Missing Authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-107623",
    "datePublished": "2026-10-08T14:39:35.945Z",
    "dateReserved": "2026-10-08T13:50:01.978Z",
    "dateUpdated": "2026-10-08T17:41:13.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107568 (GCVE-0-2026-107568)

Vulnerability from cvelistv5 – Published: 2026-10-19 15:34 – Updated: 2026-10-19 15:34
VLAI
Title
Missing Authorization in hMailServer
Summary
Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification's From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API's self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain's DKIM key, because it signs by the From header's domain, producing forged mail aligned to pass the domain's DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine, a rule's Reply was likewise sent from whatever address the action named, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have a domain's or an account's rule reply from any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
Assigner
GitLab CNA under the mitre root
CNA scorecard C 75/100 over 311 records in the last 180 days details
References
Impacted products
Vendor Product Version
Progressive Robot Ltd hMailServer Affected: 6.0.0 , ≤ 6.3.6 (semver)
Create a notification for this product.
Credits
Found in the hMailServer project's own security review (Progressive Robot Ltd)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThanOrEqual": "6.3.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag names the sender; the server set the notification\u0027s From header to that :from as the script wrote it, without checking that the address belongs to the account - the check that the Sieve vacation action applies to its own :from, and that the server applies to the sender of mail queued over COM or sent from the webmail. An account that can store a Sieve script (over ManageSieve, the REST API\u0027s self-service filter, or the administration interface) could therefore have the server send a notification from any address, on this server or anywhere; and where the claimed address is at a domain the server hosts with DKIM signing enabled, the server signed the notification with that domain\u0027s DKIM key, because it signs by the From header\u0027s domain, producing forged mail aligned to pass the domain\u0027s DMARC policy. The notify action and this behaviour were introduced in 6.2.22. In the mail-rule engine, a rule\u0027s Reply was likewise sent from whatever address the action named, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have a domain\u0027s or an account\u0027s rule reply from any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain\u0027s key."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T15:34:22.493Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/82"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.7, which uses a Sieve notify :from only when it is an address that reaches the account (the account\u0027s own address or an active alias of it) - otherwise the notification goes from the account\u0027s own address, logged - and refuses a notify :from that is not an address when the script is stored, as the vacation action already does; and which sends a reply of an account\u0027s or a domain\u0027s mail rule only from an address the rule\u0027s owner may send as, refusing any other when the rule is saved and not sending a reply stored with one before (logged). Until then, where accounts need not set Sieve scripts, close the script surfaces: keep ManageSieve off (ManageSieveServerPort=0, the default) or bound to the loopback, and turn the REST API off where the webmail\u0027s filter editor is not wanted (RestApiPort=0, the default); and review active Sieve scripts for a notify whose :from is not the account\u0027s own address or an alias of it, and account and domain rules for a reply from an address the rule\u0027s owner may not send as. There is no per-extension setting that turns notify off while Sieve is in use."
        }
      ],
      "title": "Missing Authorization in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-107568",
    "datePublished": "2026-10-19T15:34:22.493Z",
    "dateReserved": "2026-10-08T10:51:05.636Z",
    "dateUpdated": "2026-10-19T15:34:22.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107566 (GCVE-0-2026-107566)

Vulnerability from cvelistv5 – Published: 2026-10-19 15:34 – Updated: 2026-10-19 15:34
VLAI
Title
Missing Authorization in hMailServer
Summary
Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script's editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script's header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message's first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account's address, or anyone's at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain's DKIM key, a forgery aligned to pass the domain's DMARC; or, where another sender's domain is one the server signs for, delete the DKIM-Signature that sender's message arrived with, alter a field, and redirect, so the server re-signed the altered message as that sender's domain. editheader placed no restriction on From, Sender, Resent-From, Resent-Sender or DKIM-Signature. The editheader action was introduced in 6.2.22. In the mail-rule engine, a domain's or an account's rule's Set header value action could likewise set From, Sender, Resent-From, Resent-Sender or DKIM-Signature ahead of a forward or a copy, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have the server forward or copy a message in the name of any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain's key.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CWE
Assigner
GitLab CNA under the mitre root
CNA scorecard C 75/100 over 311 records in the last 180 days details
References
Impacted products
Vendor Product Version
Progressive Robot Ltd hMailServer Affected: 6.0.0 , ≤ 6.3.6 (semver)
Create a notification for this product.
Credits
Found in the hMailServer project's own security review (Progressive Robot Ltd)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThanOrEqual": "6.3.6",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.6) of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the server signs for. A Sieve script\u0027s editheader (addheader/deleteheader) could add or delete any header field except Received and Return-Path, and the server applies a script\u0027s header edits before it queues a redirect, so the redirected copy is sent as the script left it. The server signs a message\u0027s first delivery pass as the domain named in its From header wherever it signs DKIM for that domain and the message carries no signature of it. A script could therefore delete and re-add From - another account\u0027s address, or anyone\u0027s at a hosted domain - and redirect, so the server sent the message in that name and, for a hosted domain, signed it with that domain\u0027s DKIM key, a forgery aligned to pass the domain\u0027s DMARC; or, where another sender\u0027s domain is one the server signs for, delete the DKIM-Signature that sender\u0027s message arrived with, alter a field, and redirect, so the server re-signed the altered message as that sender\u0027s domain. editheader placed no restriction on From, Sender, Resent-From, Resent-Sender or DKIM-Signature. The editheader action was introduced in 6.2.22. In the mail-rule engine, a domain\u0027s or an account\u0027s rule\u0027s Set header value action could likewise set From, Sender, Resent-From, Resent-Sender or DKIM-Signature ahead of a forward or a copy, whoever the rule belonged to, so that an account acting on its own rules over COM, a domain administrator, or an API key confined to a domain (over the REST API from 6.3.4) could have the server forward or copy a message in the name of any address, signed, where that address is at a domain the server hosts with DKIM signing enabled, with that domain\u0027s key."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T15:34:27.491Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/83"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.7"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.7, which refuses a Sieve script that adds or deletes From, Sender, Resent-From, Resent-Sender or DKIM-Signature when the script is stored, and does not make such an edit at delivery for a script stored earlier (logged), while leaving Reply-To and other fields editable; and which lets only a server rule\u0027s Set header value action, which only the server administrator saves, set those five fields, refusing an account\u0027s or a domain\u0027s rule that sets one when it is saved and not setting it at delivery for one stored before (logged). Until then, where accounts need not set Sieve scripts, close the script surfaces: keep ManageSieve off (ManageSieveServerPort=0, the default) or bound to the loopback, and turn the REST API off where the webmail\u0027s filter editor is not wanted (RestApiPort=0, the default); and review active Sieve scripts for an addheader or deleteheader of From, Sender, Resent-From, Resent-Sender or DKIM-Signature followed by a redirect, and account and domain rules for a Set header value of one of those fields. There is no per-extension setting that turns editheader off while Sieve is in use."
        }
      ],
      "title": "Missing Authorization in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-107566",
    "datePublished": "2026-10-19T15:34:27.491Z",
    "dateReserved": "2026-10-08T10:50:55.763Z",
    "dateUpdated": "2026-10-19T15:34:27.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107433 (GCVE-0-2026-107433)

Vulnerability from cvelistv5 – Published: 2026-10-14 12:08 – Updated: 2026-10-14 17:29 X_Open Source
VLAI
Title
WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:28 UTC
CWE
Assigner
Patchstack CNA under the mitre root
CNA scorecard C 75/100 over 2954 records in the last 180 days details
References
Impacted products
Vendor Product Version
miniOrange WP OAuth Server Affected: 0 , ≤ 6.4.0 (custom)
Create a notification for this product.
Date Public
2026-10-12 11:15
Credits
Nguyen Viet Tin | Patchstack Bug Bounty Program
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T17:28:56.778654Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T17:29:24.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "miniorange-oauth-20-server",
          "product": "WP OAuth Server",
          "vendor": "miniOrange",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.5.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nguyen Viet Tin | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-12T11:15:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects WP OAuth Server: from n/a through 6.4.0.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T12:08:26.612Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/miniorange-oauth-20-server/vulnerability/wordpress-wp-oauth-server-plugin-6-4-0-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress WP OAuth Server plugin to the latest available version (at least 6.5.0)."
            }
          ],
          "value": "Update the WordPress WP OAuth Server plugin to the latest available version (at least 6.5.0)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress WP OAuth Server plugin \u003c= 6.4.0 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-107433",
    "datePublished": "2026-10-14T12:08:26.612Z",
    "dateReserved": "2026-10-08T00:19:19.566Z",
    "dateUpdated": "2026-10-14T17:29:24.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107432 (GCVE-0-2026-107432)

Vulnerability from cvelistv5 – Published: 2026-10-12 07:47 – Updated: 2026-10-12 11:40 X_Open Source
VLAI
Title
WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-12 11:31 UTC
CWE
Assigner
Patchstack CNA under the mitre root
CNA scorecard C 75/100 over 2954 records in the last 180 days details
References
Impacted products
Vendor Product Version
NOUS Ouvert Utile et Simple Event post Affected: 0 , ≤ 6.1.1 (custom)
Create a notification for this product.
Date Public
2026-10-12 07:46
Credits
Ananda Dhakal (Patchstack)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107432",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-12T11:31:42.331034Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-12T11:40:34.601Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "event-post",
          "product": "Event post",
          "vendor": "NOUS Ouvert Utile et Simple",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.1.2",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.1.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ananda Dhakal (Patchstack)"
        }
      ],
      "datePublic": "2026-10-12T07:46:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Event post: from n/a through 6.1.1.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T07:48:12.778Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/event-post/vulnerability/wordpress-event-post-plugin-6-1-1-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Event post plugin to the latest available version (at least 6.1.2)."
            }
          ],
          "value": "Update the WordPress Event post plugin to the latest available version (at least 6.1.2)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Event post plugin \u003c= 6.1.1 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-107432",
    "datePublished": "2026-10-12T07:47:11.169Z",
    "dateReserved": "2026-10-08T00:19:19.566Z",
    "dateUpdated": "2026-10-12T11:40:34.601Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list