Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
18567 vulnerabilities reference this CWE, most recent first.
CVE-2026-110721 (GCVE-0-2026-110721)
Vulnerability from cvelistv5 – Published: 2026-10-16 04:27 – Updated: 2026-10-16 15:09
VLAI
EPSS
VEX
Title
NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route
Summary
The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback => '__return_true', and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign's own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign — WP Comments, WooCommerce/EDD/Give sales, reviews, etc.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:56 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| wpdevteam | NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar |
Affected:
0 , ≤ 3.3.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:56:40.516470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:39.990Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NotificationX \u2013 FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner \u0026 Floating Notification Bar",
"vendor": "wpdevteam",
"versions": [
{
"lessThanOrEqual": "3.3.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eunho Kim"
}
],
"descriptions": [
{
"lang": "en",
"value": "The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callback =\u003e \u0027__return_true\u0027, and the handler at PopupNotification::handle_popup_submission() accepts an attacker-controlled nx_id, loads whichever NotificationX campaign that id points to, and copies that campaign\u0027s own source into the new entry without verifying that the campaign is a Popup Notification or Exit Intent Popup (the two sources this form is intended to serve). This makes it possible for unauthenticated attackers to inject forged social-proof entries (name, title, message, email, theme) into any enabled non-popup NotificationX campaign \u2014 WP Comments, WooCommerce/EDD/Give sales, reviews, etc."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T04:27:00.768Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84b5e044-4522-480a-ad14-8886ed691a86?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/PopupNotification/PopupNotification.php#L1161"
},
{
"url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Extensions/Extension.php#L668"
},
{
"url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L58"
},
{
"url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Core/Rest/Popup.php#L186"
},
{
"url": "https://plugins.trac.wordpress.org/browser/notificationx/tags/3.3.3/includes/Admin/Entries.php#L93"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3746251/notificationx/trunk/includes/Extensions/PopupNotification/PopupNotification.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T15:00:30.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T16:22:58.000Z",
"value": "Disclosed"
}
],
"title": "NotificationX \u003c= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via \u0027nx_id\u0027 Parameter on /popup-submit REST Route"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110721",
"datePublished": "2026-10-16T04:27:00.768Z",
"dateReserved": "2026-10-14T14:45:02.807Z",
"dateUpdated": "2026-10-16T15:09:39.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110629 (GCVE-0-2026-110629)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:17 – Updated: 2026-10-14 17:32
VLAI
EPSS
VEX
Title
VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions
Summary
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:22 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
11 references
| URL | Tags |
|---|---|
| https://github.com/venturedrake/laravel-crm/issues/79 | issue-tracking |
| https://github.com/venturedrake/laravel-crm/issues/80 | issue-tracking |
| https://github.com/venturedrake/laravel-crm/blob/… | technical-description |
| https://github.com/venturedrake/laravel-crm/blob/… | technical-description |
| https://github.com/venturedrake/laravel-crm/commi… | patch |
| https://github.com/venturedrake/laravel-crm/commi… | patch |
| https://github.com/venturedrake/laravel-crm/commi… | patch |
| https://github.com/venturedrake/laravel-crm/commi… | patch |
| https://github.com/venturedrake/laravel-crm/relea… | release-notes |
| https://github.com/venturedrake/laravel-crm | product |
| https://www.vulncheck.com/advisories/venturedrake… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| venturedrake | laravel-crm |
Affected:
0 , < 2.4.0
(semver)
|
Date Public
2026-03-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:22:47.941064Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:32:32.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/venturedrake/laravel-crm",
"product": "laravel-crm",
"repo": "https://github.com/venturedrake/laravel-crm",
"vendor": "venturedrake",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-03-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:17:03.868Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/venturedrake/laravel-crm/issues/79"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/venturedrake/laravel-crm/issues/80"
},
{
"name": "DealIndex actions with no authorization at 2.3.0",
"tags": [
"technical-description"
],
"url": "https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Livewire/Deals/DealIndex.php#L125-L170"
},
{
"name": "Activities routes with auth only at 2.3.0",
"tags": [
"technical-description"
],
"url": "https://github.com/venturedrake/laravel-crm/blob/fee88f9f95f18302a49e739298885b455beb02e5/src/Http/routes.php#L573-L581"
},
{
"name": "Merge of PR #89: can: middleware on Activities and product routes",
"tags": [
"patch"
],
"url": "https://github.com/venturedrake/laravel-crm/commit/1a280cb22fc006f63fb96fe540dc4d651a8fb0a8"
},
{
"tags": [
"patch"
],
"url": "https://github.com/venturedrake/laravel-crm/commit/cc41264eff5563f470984b8d2cfcc9ab4583c586"
},
{
"tags": [
"patch"
],
"url": "https://github.com/venturedrake/laravel-crm/commit/049fc966029234a6d0f02b69efeabdb16e35bbb0"
},
{
"tags": [
"patch"
],
"url": "https://github.com/venturedrake/laravel-crm/commit/78dbf4e41afe48def4037c69d5dd7a34820122c3"
},
{
"name": "laravel-crm 2.4.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/venturedrake/laravel-crm/releases/tag/2.4.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/venturedrake/laravel-crm"
},
{
"name": "VulnCheck Advisory: VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/venturedrake-laravel-crm-before-2.4.0-missing-authorization-via-livewire-actions"
}
],
"title": "VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110629",
"datePublished": "2026-10-14T14:17:03.868Z",
"dateReserved": "2026-10-14T13:07:29.774Z",
"dateUpdated": "2026-10-14T17:32:32.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110624 (GCVE-0-2026-110624)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:17 – Updated: 2026-10-14 16:15
VLAI
EPSS
VEX
Title
Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all
Summary
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 16:15 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/papermerge/papermerge-core/iss… | issue-tracking |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/papermerge/papermerge-core/com… | patch |
| https://www.vulncheck.com/advisories/papermerge-c… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| papermerge | papermerge-core |
Affected:
0 , ≤ 3.5.3
(semver)
cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:* |
Date Public
2026-02-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T16:15:12.249372Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:15:28.906Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/papermerge/papermerge-core",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/papermerge/papermerge-core",
"product": "papermerge-core",
"repo": "https://github.com/papermerge/papermerge-core",
"vendor": "papermerge",
"versions": [
{
"lessThanOrEqual": "3.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups\u0027 tags and document types by supplying a group_id parameter. Attackers who know a group\u0027s UUID can query GET /tags/all or GET /document-types/all, which skip the user_belongs_to check, to disclose metadata of groups they do not belong to."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:17:00.623Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/papermerge/papermerge-core/issues/1291"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tags/router.py#L39-L64"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document_types/router.py#L37-L62"
},
{
"tags": [
"patch"
],
"url": "https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269"
},
{
"name": "VulnCheck Advisory: Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-via-tags-all-and-document-types-all"
}
],
"title": "Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110624",
"datePublished": "2026-10-14T14:17:00.623Z",
"dateReserved": "2026-10-14T13:07:28.120Z",
"dateUpdated": "2026-10-14T16:15:28.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110623 (GCVE-0-2026-110623)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-16 17:16
VLAI
EPSS
VEX
Title
Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API
Summary
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims' documents and revoke existing shares.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/papermerge/papermerge-core/iss… | issue-tracking |
| https://github.com/papermerge/papermerge-core/iss… | issue-tracking |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/papermerge/papermerge-core/com… | patch |
| https://www.vulncheck.com/advisories/papermerge-c… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| papermerge | papermerge-core |
Affected:
0 , ≤ 3.5.3
(semver)
cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:* |
Date Public
2026-02-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110623",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:35:42.242876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:16:11.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/papermerge/papermerge-core",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/papermerge/papermerge-core",
"product": "papermerge-core",
"repo": "https://github.com/papermerge/papermerge-core",
"vendor": "papermerge",
"versions": [
{
"lessThanOrEqual": "3.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users\u0027 documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes or PATCH /shared-nodes/access/{node_id} to grant themselves any role, then read, modify, or delete victims\u0027 documents and revoke existing shares."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:59.957Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/papermerge/papermerge-core/issues/1290"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/papermerge/papermerge-core/issues/1291"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/shared_nodes/router.py#L78-L150"
},
{
"tags": [
"patch"
],
"url": "https://github.com/papermerge/papermerge-core/commit/0fd469102b05b5ebeb5ee39b3f73ff76991ab269"
},
{
"name": "VulnCheck Advisory: Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-shared-nodes-api"
}
],
"title": "Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110623",
"datePublished": "2026-10-14T14:16:59.957Z",
"dateReserved": "2026-10-14T13:07:27.788Z",
"dateUpdated": "2026-10-16T17:16:11.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110622 (GCVE-0-2026-110622)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 18:08
VLAI
EPSS
VEX
Title
Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints
Summary
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims' pages, and trigger OCR via /tasks/ocr.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:07 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/papermerge/papermerge-core/iss… | issue-tracking |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/papermerge/papermerge-core/blo… | technical-description |
| https://github.com/papermerge/papermerge-core/com… | patch |
| https://www.vulncheck.com/advisories/papermerge-c… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| papermerge | papermerge-core |
Affected:
0 , ≤ 3.5.3
(semver)
cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:* |
Date Public
2026-02-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110622",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:07:44.770408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:08:00.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/papermerge/papermerge-core",
"defaultStatus": "unaffected",
"packageURL": "pkg:github/papermerge/papermerge-core",
"product": "papermerge-core",
"repo": "https://github.com/papermerge/papermerge-core",
"vendor": "papermerge",
"versions": [
{
"lessThanOrEqual": "3.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:papermerge:papermerge:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users\u0027 pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs can call /pages/, /pages/move, or /pages/extract to rotate, delete, or extract victims\u0027 pages, and trigger OCR via /tasks/ocr."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:59.250Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/papermerge/papermerge-core/issues/1290"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/document/router_pages.py#L29-L131"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/papermerge/papermerge-core/blob/3.5.3/papermerge/core/features/tasks/router.py#L17-L35"
},
{
"tags": [
"patch"
],
"url": "https://github.com/papermerge/papermerge-core/commit/6ad2836dc40b61bd032146013272036bbece6144"
},
{
"name": "VulnCheck Advisory: Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/papermerge-core-through-3.5.3-missing-authorization-in-page-management-and-ocr-endpoints"
}
],
"title": "Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110622",
"datePublished": "2026-10-14T14:16:59.250Z",
"dateReserved": "2026-10-14T13:07:27.460Z",
"dateUpdated": "2026-10-14T18:08:00.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110621 (GCVE-0-2026-110621)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId
Summary
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Swetrix/swetrix/issues/477 | issue-tracking |
| https://github.com/Swetrix/swetrix/blob/v5.0.3/ba… | technical-description |
| https://github.com/Swetrix/swetrix/commit/63eb76e… | patch |
| https://github.com/Swetrix/swetrix/releases/tag/v5.1.0 | release-notes |
| https://www.vulncheck.com/advisories/swetrix-clou… | third-party-advisory |
Date Public
2026-02-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/Swetrix/swetrix",
"defaultStatus": "unaffected",
"product": "swetrix",
"repo": "https://github.com/Swetrix/swetrix",
"vendor": "Swetrix",
"versions": [
{
"lessThan": "5.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lighthousekeeper1212"
},
{
"lang": "en",
"type": "reporter",
"value": "leediay153 from Viettel Post"
}
],
"datePublic": "2026-02-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an organisation and add a victim project by its public tracking ID to read analytics, change settings, or delete it."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:58.557Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Swetrix/swetrix/issues/477"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Swetrix/swetrix/blob/v5.0.3/backend/apps/cloud/src/project/project.controller.ts#L888-L920"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Swetrix/swetrix/commit/63eb76edcb446402ad1db5ff870920773f5ff588"
},
{
"name": "Swetrix v5.1.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/Swetrix/swetrix/releases/tag/v5.1.0"
},
{
"name": "VulnCheck Advisory: Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/swetrix-cloud-before-5.1.0-missing-authorization-via-post-project-organisation-orgid"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110621",
"datePublished": "2026-10-14T14:16:58.557Z",
"dateReserved": "2026-10-14T13:07:27.159Z",
"dateUpdated": "2026-10-14T14:16:58.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110617 (GCVE-0-2026-110617)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 18:05
VLAI
EPSS
VEX
Title
we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint
Summary
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.
Severity
4.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 18:05 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGl | third-party-advisory |
| https://github.com/rachelos/we-mp-rss/blob/v1.5.3… | technical-description |
| https://github.com/rachelos/we-mp-rss | product |
| https://www.vulncheck.com/advisories/we-mp-rss-th… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110617",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T18:05:12.570437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T18:05:57.783Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGl"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "we-mp-rss",
"repo": "https://github.com/rachelos/we-mp-rss",
"vendor": "rachelos",
"versions": [
{
"lessThanOrEqual": "1.5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:55.915Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SyP4L62oGl"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/tools.py#L321-L376"
},
{
"tags": [
"product"
],
"url": "https://github.com/rachelos/we-mp-rss"
},
{
"name": "VulnCheck Advisory: we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/we-mp-rss-through-1.5.3-missing-authorization-via-export-file-download-endpoint"
}
],
"title": "we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110617",
"datePublished": "2026-10-14T14:16:55.915Z",
"dateReserved": "2026-10-14T13:07:25.853Z",
"dateUpdated": "2026-10-14T18:05:57.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110615 (GCVE-0-2026-110615)
Vulnerability from cvelistv5 – Published: 2026-10-14 14:16 – Updated: 2026-10-14 14:16
VLAI
EPSS
VEX
Title
jshERP through 3.6 Missing Authorization via /user/batchSetStatus
Summary
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jsherp-… | third-party-advisory |
| https://github.com/jishenghua/jshERP/blob/v3.6/js… | technical-description |
| https://github.com/jishenghua/jshERP/blob/v3.6/js… | technical-description |
| https://github.com/jishenghua/jshERP | product |
| https://www.vulncheck.com/advisories/jsherp-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| jishenghua | jshERP |
Affected:
0 , ≤ 3.6
(custom)
cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:* |
Date Public
2026-10-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/jishenghua/jshERP",
"product": "jshERP",
"repo": "https://github.com/jishenghua/jshERP",
"vendor": "jishenghua",
"versions": [
{
"lessThanOrEqual": "3.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:jishenghua:jsherp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users\u0027 account status. Attackers can submit crafted ids and status values to disable every non-owner account in their tenant, locking out administrators, or re-enable disabled accounts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:16:54.603Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jsherp-user-account-lifecycle-missing-authz"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/UserController.java#L541-L555"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java#L901-L946"
},
{
"tags": [
"product"
],
"url": "https://github.com/jishenghua/jshERP"
},
{
"name": "VulnCheck Advisory: jshERP through 3.6 Missing Authorization via /user/batchSetStatus",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/jsherp-through-3.6-missing-authorization-via-user-batchsetstatus"
}
],
"title": "jshERP through 3.6 Missing Authorization via /user/batchSetStatus",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-110615",
"datePublished": "2026-10-14T14:16:54.603Z",
"dateReserved": "2026-10-14T13:07:25.194Z",
"dateUpdated": "2026-10-14T14:16:54.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110590 (GCVE-0-2026-110590)
Vulnerability from cvelistv5 – Published: 2026-10-16 04:27 – Updated: 2026-10-16 15:09
VLAI
EPSS
VEX
Title
Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
Summary
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:57 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| klarnaplugin | Klarna for WooCommerce |
Affected:
0 , ≤ 4.13.3
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:57:42.888860Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:09:39.428Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Klarna for WooCommerce",
"vendor": "klarnaplugin",
"versions": [
{
"lessThanOrEqual": "4.13.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kuba"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order\u0027s secret order_key and full billing and shipping PII \u2014 including first name, last name, email address, phone number, street address, postcode, city, region, and country \u2014 emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T04:27:03.790Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3abb96e-6ee2-4992-a122-9f661da9a4d6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L185"
},
{
"url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L198"
},
{
"url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L204"
},
{
"url": "https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L159"
},
{
"url": "https://github.com/krokedil/klarna-payments-for-woocommerce/compare/4.13.3...f5362605a9901b7f9264cfa3b22fd782a7a3097b"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3740915/klarna-payments-for-woocommerce/trunk/classes/class-kp-assets.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-14T15:00:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-15T15:50:36.000Z",
"value": "Disclosed"
}
],
"title": "Klarna for WooCommerce \u003c= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via \u0027order-pay\u0027 Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-110590",
"datePublished": "2026-10-16T04:27:03.790Z",
"dateReserved": "2026-10-14T13:06:50.647Z",
"dateUpdated": "2026-10-16T15:09:39.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-110380 (GCVE-0-2026-110380)
Vulnerability from cvelistv5 – Published: 2026-10-16 12:31 – Updated: 2026-10-16 14:59 X_Open Source
VLAI
EPSS
VEX
Title
WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:52 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arraytics | WP Event Solution |
Affected:
0 , ≤ 4.1.26
(custom)
|
Date Public
2026-10-16 12:31
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-110380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:52:49.874297Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:59:31.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "wp-event-solution",
"product": "WP Event Solution",
"vendor": "Arraytics",
"versions": [
{
"changes": [
{
"at": "4.1.27",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.1.26",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "myhappyhoon | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-16T12:31:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects WP Event Solution: from n/a through 4.1.26.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.26."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T12:31:16.239Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/wp-event-solution/vulnerability/wordpress-wp-event-solution-plugin-4-1-26-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress WP Event Solution plugin to the latest available version (at least 4.1.27)."
}
],
"value": "Update the WordPress WP Event Solution plugin to the latest available version (at least 4.1.27)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress WP Event Solution plugin \u003c= 4.1.26 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-110380",
"datePublished": "2026-10-16T12:31:15.231Z",
"dateReserved": "2026-10-14T00:22:17.449Z",
"dateUpdated": "2026-10-16T14:59:31.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.