Vulnerability-Lookup

CVE-2026-95685 (GCVE-0-2026-95685)

Vulnerability from cvelistv5 – Published: 2026-09-22 14:13 – Updated: 2026-09-22 15:13

Title

MISP Missing Authorization on replaceSuggestionInReport Event Report Action

Summary

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard. An authenticated user without the perm_add permission could invoke the replaceSuggestionInReport endpoint to alter report suggestion data, violating the intended authorization model. This constitutes an improper authorization weakness that could lead to unauthorized modification of event report content, potentially corrupting shared threat intelligence data or injecting misleading information into reports relied upon by other analysts and automated consumers.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:13 UTC

CWE

CWE-862 - Missing Authorization

Assigner

CIRCL CNA under the ENISA root

CNA scorecard A 90/100 over 244 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/66aebfb1a	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.47 (semver)

Credits

Jeroen Pinoy iglocska

GCVE extensions

AI-generated Human-reviewed Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

bcp-05-x-01

AI-assisted vulnerability information annotation

GCVE-BCP-05-X-01

Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

bcp-05-x-02

Patch-to-vulnerability generation provenance

GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-22 14:08
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/66aebfb1a.patch 4dbeb3f23f82…
Confidence: medium

Commit	Subject	Patch SHA-256
`66aebfb1a1e5`	fix: [ACL] tightening of eventreports	`4dbeb3f23f82…`

Fix summary

The ACL mapping for the replaceSuggestionInReport action was corrected from the wildcard permission ('*') to the perm_add permission, aligning it with all other report-modification actions and ensuring that only users explicitly granted the add permission can invoke the action.

Patch summary

In app/Controller/Component/ACLComponent.php, a single-line change was made in the event reports ACL array: the permission requirement for the 'replaceSuggestionInReport' key was changed from array('*') to array('perm_add'), restricting the action to users with the perm_add privilege.

CVSS rationale

The vulnerability is exploitable over the network (AV:N) via a simple HTTP request to the MISP API or web interface (AC:L). No attack target manipulation is required (AT:N). The attacker must be an authenticated user with at least basic access but without perm_add (PR:L). No user interaction is needed (UI:N). The primary impact is on the integrity of the vulnerable system's event report data (VI:H), as an unauthorized user can modify report suggestions. Confidentiality and availability impacts are not directly evidenced (VC:N, VA:N). No secondary system impact is indicated (SC:N, SI:N, SA:N).

Weakness rationale

CWE-862 The replaceSuggestionInReport action was accessible to all authenticated users (wildcard '*') when it should have required the perm_add permission. The authorization check was effectively missing for this specific action, allowing any authenticated user to perform a privileged operation.

Attack pattern rationale

CAPEC-126 The attacker invokes the replaceSuggestionInReport endpoint directly (e.g., via API or URL manipulation) relying on the fact that the ACL layer permits the action for all authenticated users. The attack pattern of accessing a resource or action the user is not authorized to perform by directly requesting it matches Forced Browsing. Uncertainty: the exact request vector (REST API vs. web UI) is not specified in the patch, but the underlying mechanism of bypassing intended authorization by directly calling the endpoint is consistent with this pattern.

Assumptions to verify

The affected version range is inferred from the tag boundary (v2.5.47, 136 commits after fix); the exact last vulnerable version is not explicitly stated in the patch metadata.
The CVSS VI:H rating assumes that modifying report suggestions constitutes a significant integrity impact on the MISP instance's threat intelligence data; if the practical impact is considered lower, VI:M may be more appropriate.
The CAPEC-126 mapping is the closest available pattern; the exact exploitation vector (REST API call vs. web form submission) is not specified in the patch, but the core mechanism of unauthorized action invocation is consistent.
The patch does not include the full ACLComponent context, so the exact set of users affected (e.g., whether 'perm_add' is a common or rare permission in typical MISP deployments) is not fully determinable.
No authentication bypass is implied; the attacker must already be an authenticated MISP user.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	5	9	medium	5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95685",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:13:31.472359Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:13:38.313Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "EventReports",
            "ACLComponent"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/Component/ACLComponent.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission (\u0027*\u0027) in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.\u0026nbsp;\u003c/p\u003e\u003cp\u003eAn authenticated user without the perm_add permission could invoke the replaceSuggestionInReport endpoint to alter report suggestion data, violating the intended authorization model.\u0026nbsp;\u003c/p\u003e\u003cp\u003eThis constitutes an improper authorization weakness that could lead to unauthorized modification of event report content, potentially corrupting shared threat intelligence data or injecting misleading information into reports relied upon by other analysts and automated consumers.\u003c/p\u003e"
            }
          ],
          "value": "MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission (\u0027*\u0027) in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.\u00a0\n\nAn authenticated user without the perm_add permission could invoke the replaceSuggestionInReport endpoint to alter report suggestion data, violating the intended authorization model.\u00a0\n\nThis constitutes an improper authorization weakness that could lead to unauthorized modification of event report content, potentially corrupting shared threat intelligence data or injecting misleading information into reports relied upon by other analysts and automated consumers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Forced Browsing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T14:13:26.670Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/66aebfb1a"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe ACL mapping for the replaceSuggestionInReport action was corrected from the wildcard permission (\u0027*\u0027) to the perm_add permission, aligning it with all other report-modification actions and ensuring that only users explicitly granted the add permission can invoke the action.\u003c/p\u003e"
            }
          ],
          "value": "The ACL mapping for the replaceSuggestionInReport action was corrected from the wildcard permission (\u0027*\u0027) to the perm_add permission, aligning it with all other report-modification actions and ensuring that only users explicitly granted the add permission can invoke the action."
        }
      ],
      "title": "MISP Missing Authorization on replaceSuggestionInReport Event Report Action",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version range is inferred from the tag boundary (v2.5.47, 136 commits after fix); the exact last vulnerable version is not explicitly stated in the patch metadata.",
                  "The CVSS VI:H rating assumes that modifying report suggestions constitutes a significant integrity impact on the MISP instance\u0027s threat intelligence data; if the practical impact is considered lower, VI:M may be more appropriate.",
                  "The CAPEC-126 mapping is the closest available pattern; the exact exploitation vector (REST API call vs. web form submission) is not specified in the patch, but the core mechanism of unauthorized action invocation is consistent.",
                  "The patch does not include the full ACLComponent context, so the exact set of users affected (e.g., whether \u0027perm_add\u0027 is a common or rare permission in typical MISP deployments) is not fully determinable.",
                  "No authentication bypass is implied; the attacker must already be an authenticated MISP user."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The attacker invokes the replaceSuggestionInReport endpoint directly (e.g., via API or URL manipulation) relying on the fact that the ACL layer permits the action for all authenticated users. The attack pattern of accessing a resource or action the user is not authorized to perform by directly requesting it matches Forced Browsing. Uncertainty: the exact request vector (REST API vs. web UI) is not specified in the patch, but the underlying mechanism of bypassing intended authorization by directly calling the endpoint is consistent with this pattern."
                  }
                ],
                "commit": "66aebfb1a1e58a82b3a681367347f69c46c38ee5",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  }
                ],
                "cvssRationale": "The vulnerability is exploitable over the network (AV:N) via a simple HTTP request to the MISP API or web interface (AC:L). No attack target manipulation is required (AT:N). The attacker must be an authenticated user with at least basic access but without perm_add (PR:L). No user interaction is needed (UI:N). The primary impact is on the integrity of the vulnerable system\u0027s event report data (VI:H), as an unauthorized user can modify report suggestions. Confidentiality and availability impacts are not directly evidenced (VC:N, VA:N). No secondary system impact is indicated (SC:N, SI:N, SA:N).",
                "fixSummary": "The ACL mapping for the replaceSuggestionInReport action was corrected from the wildcard permission (\u0027*\u0027) to the perm_add permission, aligning it with all other report-modification actions and ensuring that only users explicitly granted the add permission can invoke the action.",
                "generatedAt": "2026-09-22T14:08:14.968747Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "4dbeb3f23f82f36cfdc980039b1d19717eea20a3f4d4caf25a3f0a3f72523c83",
                "patchSummary": "In app/Controller/Component/ACLComponent.php, a single-line change was made in the event reports ACL array: the permission requirement for the \u0027replaceSuggestionInReport\u0027 key was changed from array(\u0027*\u0027) to array(\u0027perm_add\u0027), restricting the action to users with the perm_add privilege.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "66aebfb1a1e58a82b3a681367347f69c46c38ee5",
                    "patchSha256": "4dbeb3f23f82f36cfdc980039b1d19717eea20a3f4d4caf25a3f0a3f72523c83",
                    "source": "https://github.com/MISP/MISP/commit/66aebfb1a.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/66aebfb1a.patch",
                    "subject": "fix: [ACL] tightening of eventreports"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/66aebfb1a.patch",
                "subject": "fix: [ACL] tightening of eventreports",
                "tagVersionBoundary": {
                  "commits_after_fix": 136,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The replaceSuggestionInReport action was accessible to all authenticated users (wildcard \u0027*\u0027) when it should have required the perm_add permission. The authorization check was effectively missing for this specific action, allowing any authenticated user to perform a privileged operation."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20095"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95685",
    "datePublished": "2026-09-22T14:13:26.670Z",
    "dateReserved": "2026-09-22T14:13:20.760Z",
    "dateUpdated": "2026-09-22T15:13:38.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95683 (GCVE-0-2026-95683)

Vulnerability from cvelistv5 – Published: 2026-09-22 14:06 – Updated: 2026-09-22 15:28

Title

MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL

Summary

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed. The result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report's own access-control policy. The vulnerability requires an authenticated MISP user with at least read access to the affected event.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:27 UTC

CWE

CWE-862 - Missing Authorization
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

CIRCL CNA under the ENISA root

CNA scorecard A 90/100 over 244 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/6932aace8	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.47 (semver)

Credits

Jeroen Pinoy iglocska Claude Fable 5.1

GCVE extensions

AI-generated Not human-reviewed Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

bcp-05-x-01

AI-assisted vulnerability information annotation

GCVE-BCP-05-X-01

Whole record AI-generated Not human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

bcp-05-x-02

Patch-to-vulnerability generation provenance

GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-22 13:58
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/6932aace8.patch d3472acf034e…
Confidence: medium

Commit	Subject	Patch SHA-256
`6932aace8445`	fix: [security] Apply the caller's ACL to the event view's	`d3472acf034e…`

Fix summary

The report fetch in the Overmind event enrichment now applies the caller's ACL via EventReport::buildACLConditions($user), enforcing the report's own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.

Patch summary

In app/Controller/EventsController.php, the __enrichEvent() method's report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds 'contain' => EventReport::DEFAULT_CONTAIN, and sets 'recursive' => -1 to prevent unnecessary eager-loading of associated models.

CVSS rationale

AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker's own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report's distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance's own data; no cross-system impact is evidenced.

Weakness rationale

CWE-862 The report's own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path.
CWE-639 The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report's distribution. This allowed bypass of the report's authorization by leveraging the event-level access.

Attack pattern rationale

CAPEC-126 The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report's distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object.

Assumptions to verify

The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with 'unspecified' version.
CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.
CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report's content and the organization's data classification.
CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers 'missing authorization on a sub-resource' more precisely.
The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.
The 'Overmind' feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	4	9	medium	6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95683",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:27:57.869012Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:28:07.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "EventsController (Overmind event view / __enrichEvent)"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/EventsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Fable 5.1"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\u003c/p\u003e\u003cp\u003eThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated MISP user with at least read access to the affected event.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report\u0027s own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event\u0027s distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.\n\nThe result is an unauthorized disclosure of threat-intelligence report content to users who should not have access under the report\u0027s own access-control policy.\n\nThe vulnerability requires an authenticated MISP user with at least read access to the affected event."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Exploiting Incorrectly Configured Access Controls"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639 Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T14:06:59.969Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/6932aace8"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.\u003c/p\u003e"
            }
          ],
          "value": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved."
        }
      ],
      "title": "MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "none",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The tag_version_boundary (v2.5.47, 57 commits after fix) is used as the nearest known version boundary; the exact first fixed release is not explicitly stated in the patch metadata, so the affected range is marked as less_than 2.5.47 with \u0027unspecified\u0027 version.",
                  "CVSS PR:L assumes the attacker needs only a standard authenticated MISP account with read access to the event; the specific role/permission level required is not detailed in the patch.",
                  "CVSS VC:H assumes the report content constitutes sensitive threat-intelligence data; the actual sensitivity depends on the report\u0027s content and the organization\u0027s data classification.",
                  "CAPEC-126 is selected as the closest match; the flaw is more precisely a missing authorization check (CWE-862) rather than a misconfiguration of an existing control, but no CAPEC entry specifically covers \u0027missing authorization on a sub-resource\u0027 more precisely.",
                  "The patch does not include test cases or reproduction steps; exploitability assessment is based solely on the code diff and commit message.",
                  "The \u0027Overmind\u0027 feature is assumed to be a MISP UI component for event viewing; its exact configuration and deployment context are not specified in the patch."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-126",
                    "rationale": "The access control for the EventReport resource was incorrectly configured (or absent) in the Overmind event-view code path: the report\u0027s distribution ACL was not applied, effectively leaving the resource accessible to any user who could see the parent event. This is the closest CAPEC to a missing/incomplete authorization check on a specific resource. The mapping is slightly uncertain because the flaw is a missing check rather than a misconfiguration of an existing check, but CAPEC-126 is the best available match for an access-control enforcement gap on a specific object."
                  }
                ],
                "commit": "6932aace844520526819253ea285def97e48189e",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Fable 5.1"
                  }
                ],
                "cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: An authenticated user with read access to any event simply views it in the Overmind interface; no race conditions, special timing, or complex manipulation are required. AT:N: No attack-target manipulation is needed. PR:L: The attacker must be an authenticated MISP user with at least read permission on the event; no administrative privileges are required. UI:N: No victim interaction beyond the attacker\u0027s own viewing action. VC:H: Sensitive threat-intelligence report content (IOCs, analysis, context) is disclosed to a user the report\u0027s distribution explicitly excludes. VI:N, VA:N: No integrity or availability impact. SC:N, SI:N, SA:N: The impact is confined to the MISP instance\u0027s own data; no cross-system impact is evidenced.",
                "fixSummary": "The report fetch in the Overmind event enrichment now applies the caller\u0027s ACL via EventReport::buildACLConditions($user), enforcing the report\u0027s own distribution policy in addition to the event-level access. A condition on EventReport.deleted = 0 is also added to exclude soft-deleted reports. The query is further hardened with recursive = -1 and an explicit contain clause to limit the data retrieved.",
                "generatedAt": "2026-09-22T13:58:09.551694Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 6,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 4
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                "patchSummary": "In app/Controller/EventsController.php, the __enrichEvent() method\u0027s report lookup is changed from a simple event_id condition to a composite condition built from EventReport::buildACLConditions($user) combined with EventReport.event_id and EventReport.deleted = 0. The find() call is updated to use the new $reportConditions array, adds \u0027contain\u0027 =\u003e EventReport::DEFAULT_CONTAIN, and sets \u0027recursive\u0027 =\u003e -1 to prevent unnecessary eager-loading of associated models.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "6932aace844520526819253ea285def97e48189e",
                    "patchSha256": "d3472acf034e415d9322bc1f5f399efb811afbb547bc230fe69d2e83c2975dd2",
                    "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                    "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/6932aace8.patch",
                "subject": "fix: [security] Apply the caller\u0027s ACL to the event view\u0027s",
                "tagVersionBoundary": {
                  "commits_after_fix": 57,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The report\u0027s own ACL/distribution check was entirely absent from the Overmind event-view enrichment path. The code fetched the report by event ID without invoking buildACLConditions(), so the report-level authorization policy was never enforced for this code path."
                  },
                  {
                    "cweId": "CWE-639",
                    "rationale": "The event ID, which is a user-controllable identifier in the request, was used as the sole key to retrieve a report resource whose access should be independently governed by the report\u0027s distribution. This allowed bypass of the report\u0027s authorization by leveraging the event-level access."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20285"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95683",
    "datePublished": "2026-09-22T14:06:59.969Z",
    "dateReserved": "2026-09-22T14:06:57.011Z",
    "dateUpdated": "2026-09-22T15:28:07.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95671 (GCVE-0-2026-95671)

Vulnerability from cvelistv5 – Published: 2026-09-22 13:20 – Updated: 2026-09-22 15:32

Title

MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add

Summary

In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT requests. As a result, an authenticated user could issue a PUT request to the collections/add endpoint, bypassing the sharing-group authorization check entirely. This allowed the creation of a collection with distribution=4 (shared with a specific sharing group) targeting a sharing group that the user was not authorized to use. The bypassed check would normally verify that the current user has access to the specified sharing group before allowing the collection to be associated with it. The security impact is that an authenticated user can place collection data into a sharing group context they do not have legitimate access to, potentially exposing that data to all members of the unauthorized sharing group and violating the intended access-control boundaries of the MISP instance. The vulnerability requires an authenticated session and knowledge of a valid sharing group identifier; no user interaction or special tooling is needed beyond sending a PUT request instead of a POST request to the same endpoint.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 15:32 UTC

CWE

CWE-862 - Missing Authorization
CWE-285 - Improper Authorization

Assigner

CIRCL CNA under the ENISA root

CNA scorecard A 90/100 over 244 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/c20f5a836	patch

Impacted products

1 product

Vendor	Product	Version
MISP	MISP	Affected: 0 , < 2.5.47 (semver)

Credits

Jeroen Pinoy iglocska Claude Opus 4.8

GCVE extensions

AI-generated Human-reviewed Confidence: medium Model qwen3.8:27b advisory bcp-05-x-01bcp-05-x-02

bcp-05-x-01

AI-assisted vulnerability information annotation

GCVE-BCP-05-X-01

Whole record AI-generated Human-reviewed GNA-1

Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.

ai-computer-assisted:llm-generatedai-computer-assisted:classification

Model	Source	Identifier
qwen3.8:27b	ollama	`qwen3.8:27b`

bcp-05-x-02

Patch-to-vulnerability generation provenance

GCVE-BCP-05-X-02

Generator: patch2vuln.py on 2026-09-22 13:13
Model: qwen3.8:27b
Input: https://github.com/MISP/MISP/commit/c20f5a836.patch a49bc540d446…
Confidence: medium

Commit	Subject	Patch SHA-256
`c20f5a83621d`	fix: [security] Authorise the collection sharing group on PUT	`a49bc540d446…`

Fix summary

The authorization guard in CollectionsController::add() was extended to cover PUT requests in addition to POST requests. The sharing-group usability check (which validates that the current user can use the target sharing group) and the element capture logic now execute regardless of whether the request arrives as POST or PUT, ensuring that CRUDComponent::add() cannot persist a collection with an unauthorized sharing group via either HTTP verb.

Patch summary

In app/Controller/CollectionsController.php, the condition guarding the sharing-group authorization check and element capture was changed from 'if ($this->request->is('post'))' to 'if ($this->request->is('post') || $this->request->is('put'))'. A comment was added explaining that CRUDComponent::add() persists on either verb, so the guard must cover both. Four lines inserted, one line deleted in total.

CVSS rationale

AV:N - MISP is a web application accessible over the network. AC:L - The attack requires only changing the HTTP method from POST to PUT; no race conditions, complex payloads, or special conditions are needed. AT:N - No attack target manipulation is required. PR:L - An authenticated MISP user is required; the vulnerability is in the authorization layer, not authentication. UI:N - No victim interaction is needed. VC:N - The primary data in the collection is user-created; the vulnerability does not directly expose other users' data to the attacker. VI:L - The attacker can create a collection in a sharing group they are not authorized to use, violating the integrity of the sharing-group access model. VA:N - No availability impact. SC:N - No secondary confidentiality impact identified. SI:L - Secondary integrity impact: data is placed in an unauthorized sharing-group context, potentially visible to that group's members. SA:N - No secondary availability impact.

Weakness rationale

CWE-862 The sharing-group usability authorization check was present for POST but entirely absent for PUT requests to the same endpoint. The authorization logic was not missing in design; it was simply not applied to one of the HTTP methods that triggers the same persistence path, resulting in a missing authorization enforcement for PUT.
CWE-285 The application performed an authorization check (sharing-group usability) but applied it conditionally based on the HTTP method, allowing an attacker to bypass the check by selecting a different method. This is an improper authorization implementation where the check is not consistently enforced across all code paths that lead to the sensitive operation.

Attack pattern rationale

CAPEC-114 The attacker manipulates the HTTP method parameter (changing POST to PUT) to bypass the authorization check that is keyed on the method. The HTTP method acts as a routing parameter that the application uses to decide whether to enforce authorization; tampering with it causes the check to be skipped. This is the closest CAPEC to the observed bypass technique, though the pattern is more specifically an authorization bypass via method selection rather than classic parameter tampering. Uncertainty: no CAPEC specifically covers 'bypassing authorization by altering the HTTP verb'; CAPEC-114 is the best available match.

Assumptions to verify

The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47 with 54 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch and may differ.
The CVSS assumes the primary impact is integrity (unauthorized placement of data in a sharing group) rather than confidentiality, since the data in the collection is user-created. If the collection grants read access to other data in the sharing group, the confidentiality impact could be higher.
CAPEC-114 (Parameter Tampering) is the closest available CAPEC for bypassing an authorization check by altering the HTTP method; no CAPEC specifically models HTTP-verb-based authorization bypass.
The patch does not include version tags or release notes; affected version ranges are approximate.
The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer.

Model comparison

Selected qwen3.8:27b by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.

Model	Score	Agreement	Confidence	Assumptions
`qwen3.8:27b`	5	9	medium	5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95671",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T15:32:15.165861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T15:32:21.567Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "CollectionsController"
          ],
          "product": "MISP",
          "programFiles": [
            "app/Controller/CollectionsController.php"
          ],
          "repo": "https://github.com/MISP/MISP",
          "vendor": "MISP",
          "versions": [
            {
              "lessThan": "2.5.47",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "iglocska"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 4.8"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT requests. As a result, an authenticated user could issue a PUT request to the collections/add endpoint, bypassing the sharing-group authorization check entirely. This allowed the creation of a collection with distribution=4 (shared with a specific sharing group) targeting a sharing group that the user was not authorized to use. The bypassed check would normally verify that the current user has access to the specified sharing group before allowing the collection to be associated with it.\u003c/p\u003e\u003cp\u003eThe security impact is that an authenticated user can place collection data into a sharing group context they do not have legitimate access to, potentially exposing that data to all members of the unauthorized sharing group and violating the intended access-control boundaries of the MISP instance.\u003c/p\u003e\u003cp\u003eThe vulnerability requires an authenticated session and knowledge of a valid sharing group identifier; no user interaction or special tooling is needed beyond sending a PUT request instead of a POST request to the same endpoint.\u003c/p\u003e"
            }
          ],
          "value": "In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT requests. As a result, an authenticated user could issue a PUT request to the collections/add endpoint, bypassing the sharing-group authorization check entirely. This allowed the creation of a collection with distribution=4 (shared with a specific sharing group) targeting a sharing group that the user was not authorized to use. The bypassed check would normally verify that the current user has access to the specified sharing group before allowing the collection to be associated with it.\n\nThe security impact is that an authenticated user can place collection data into a sharing group context they do not have legitimate access to, potentially exposing that data to all members of the unauthorized sharing group and violating the intended access-control boundaries of the MISP instance.\n\nThe vulnerability requires an authenticated session and knowledge of a valid sharing group identifier; no user interaction or special tooling is needed beyond sending a PUT request instead of a POST request to the same endpoint."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114 Parameter Tampering"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T13:20:25.683Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/c20f5a836"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe authorization guard in CollectionsController::add() was extended to cover PUT requests in addition to POST requests. The sharing-group usability check (which validates that the current user can use the target sharing group) and the element capture logic now execute regardless of whether the request arrives as POST or PUT, ensuring that CRUDComponent::add() cannot persist a collection with an unauthorized sharing group via either HTTP verb.\u003c/p\u003e"
            }
          ],
          "value": "The authorization guard in CollectionsController::add() was extended to cover PUT requests in addition to POST requests. The sharing-group usability check (which validates that the current user can use the target sharing group) and the element capture logic now execute regardless of whether the request arrives as POST or PUT, ensuring that CRUDComponent::add() cannot persist a collection with an unauthorized sharing group via either HTTP verb."
        }
      ],
      "title": "MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "full",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.47 with 54 commits after fix); the exact last affected version and first fixed version are not explicitly stated in the patch and may differ.",
                  "The CVSS assumes the primary impact is integrity (unauthorized placement of data in a sharing group) rather than confidentiality, since the data in the collection is user-created. If the collection grants read access to other data in the sharing group, the confidentiality impact could be higher.",
                  "CAPEC-114 (Parameter Tampering) is the closest available CAPEC for bypassing an authorization check by altering the HTTP method; no CAPEC specifically models HTTP-verb-based authorization bypass.",
                  "The patch does not include version tags or release notes; affected version ranges are approximate.",
                  "The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-114",
                    "rationale": "The attacker manipulates the HTTP method parameter (changing POST to PUT) to bypass the authorization check that is keyed on the method. The HTTP method acts as a routing parameter that the application uses to decide whether to enforce authorization; tampering with it causes the check to be skipped. This is the closest CAPEC to the observed bypass technique, though the pattern is more specifically an authorization bypass via method selection rather than classic parameter tampering. Uncertainty: no CAPEC specifically covers \u0027bypassing authorization by altering the HTTP verb\u0027; CAPEC-114 is the best available match."
                  }
                ],
                "commit": "c20f5a83621de6c534847e1728a1f5af843079b7",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Jeroen Pinoy"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "iglocska"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 4.8"
                  }
                ],
                "cvssRationale": "AV:N - MISP is a web application accessible over the network. AC:L - The attack requires only changing the HTTP method from POST to PUT; no race conditions, complex payloads, or special conditions are needed. AT:N - No attack target manipulation is required. PR:L - An authenticated MISP user is required; the vulnerability is in the authorization layer, not authentication. UI:N - No victim interaction is needed. VC:N - The primary data in the collection is user-created; the vulnerability does not directly expose other users\u0027 data to the attacker. VI:L - The attacker can create a collection in a sharing group they are not authorized to use, violating the integrity of the sharing-group access model. VA:N - No availability impact. SC:N - No secondary confidentiality impact identified. SI:L - Secondary integrity impact: data is placed in an unauthorized sharing-group context, potentially visible to that group\u0027s members. SA:N - No secondary availability impact.",
                "fixSummary": "The authorization guard in CollectionsController::add() was extended to cover PUT requests in addition to POST requests. The sharing-group usability check (which validates that the current user can use the target sharing group) and the element capture logic now execute regardless of whether the request arrives as POST or PUT, ensuring that CRUDComponent::add() cannot persist a collection with an unauthorized sharing group via either HTTP verb.",
                "generatedAt": "2026-09-22T13:13:03.522587Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 9,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 5
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a49bc540d4465370f1ecbf71f09c9aa51e3a77f3c196f60ddea7210f17f8b1a7",
                "patchSummary": "In app/Controller/CollectionsController.php, the condition guarding the sharing-group authorization check and element capture was changed from \u0027if ($this-\u003erequest-\u003eis(\u0027post\u0027))\u0027 to \u0027if ($this-\u003erequest-\u003eis(\u0027post\u0027) || $this-\u003erequest-\u003eis(\u0027put\u0027))\u0027. A comment was added explaining that CRUDComponent::add() persists on either verb, so the guard must cover both. Four lines inserted, one line deleted in total.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "c20f5a83621de6c534847e1728a1f5af843079b7",
                    "patchSha256": "a49bc540d4465370f1ecbf71f09c9aa51e3a77f3c196f60ddea7210f17f8b1a7",
                    "source": "https://github.com/MISP/MISP/commit/c20f5a836.patch",
                    "sourceUrl": "https://github.com/MISP/MISP/commit/c20f5a836.patch",
                    "subject": "fix: [security] Authorise the collection sharing group on PUT"
                  }
                ],
                "source": "https://github.com/MISP/MISP/commit/c20f5a836.patch",
                "subject": "fix: [security] Authorise the collection sharing group on PUT",
                "tagVersionBoundary": {
                  "commits_after_fix": 54,
                  "repository": "https://github.com/MISP/MISP",
                  "tag": "v2.5.47",
                  "version": "2.5.47",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-862",
                    "rationale": "The sharing-group usability authorization check was present for POST but entirely absent for PUT requests to the same endpoint. The authorization logic was not missing in design; it was simply not applied to one of the HTTP methods that triggers the same persistence path, resulting in a missing authorization enforcement for PUT."
                  },
                  {
                    "cweId": "CWE-285",
                    "rationale": "The application performed an authorization check (sharing-group usability) but applied it conditionally based on the HTTP method, allowing an attacker to bypass the check by selecting a different method. This is an improper authorization implementation where the check is not consistently enforced across all code paths that lead to the sensitive operation."
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20271"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-95671",
    "datePublished": "2026-09-22T13:20:25.683Z",
    "dateReserved": "2026-09-22T13:20:20.466Z",
    "dateUpdated": "2026-09-22T15:32:21.567Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95604 (GCVE-0-2026-95604)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:14 – Updated: 2026-09-23 18:46

Title

WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

Summary

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 18:36 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3017 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
Tangible	Loops & Logic	Affected: n/a , ≤ 4.2.4 (custom)

Credits

K. Sorrachat | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:36:30.159320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:46:50.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "tangible-loops-and-logic",
          "product": "Loops \u0026 Logic",
          "vendor": "Tangible",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.3.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.2.4",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "K. Sorrachat | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Broken Access Control in Loops \u0026 Logic \u003c= 4.2.4 versions."
            }
          ],
          "value": "Unauthenticated Broken Access Control in Loops \u0026 Logic \u003c= 4.2.4 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:14:50.570Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/tangible-loops-and-logic/vulnerability/wordpress-loops-logic-plugin-4-2-4-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Loops \u0026 Logic Plugin to the latest available version (at least 4.3.0)."
            }
          ],
          "value": "Update the WordPress Loops \u0026 Logic Plugin to the latest available version (at least 4.3.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Loops \u0026 Logic plugin \u003c= 4.2.4 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-95604",
    "datePublished": "2026-09-23T18:14:50.570Z",
    "dateReserved": "2026-09-22T09:18:20.380Z",
    "dateUpdated": "2026-09-23T18:46:50.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95597 (GCVE-0-2026-95597)

Vulnerability from cvelistv5 – Published: 2026-10-09 10:00 – Updated: 2026-10-11 12:13 X_Open Source

Title

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability

Summary

Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 워드프레스 결제 심플페이: from n/a through 5.5.17.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-11 12:00 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3017 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
codemstory	워드프레스 결제 심플페이	Affected: 0 , ≤ 5.5.17 (custom)

Date Public

2026-10-03 18:08

Credits

Mor Golan | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95597",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:00:53.689988Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:13:42.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "pgall-for-woocommerce",
          "product": "\uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774",
          "vendor": "codemstory",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.5.18",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.5.17",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mor Golan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-03T18:08:02.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in codemstory \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774: from n/a through 5.5.17.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in codemstory \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 pgall-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774: from n/a through 5.5.17."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T10:00:19.713Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/pgall-for-woocommerce/vulnerability/wordpress-plugin-5-5-17-settings-change-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 plugin to the latest available version (at least 5.5.18)."
            }
          ],
          "value": "Update the WordPress \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 plugin to the latest available version (at least 5.5.18)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress \uc6cc\ub4dc\ud504\ub808\uc2a4 \uacb0\uc81c \uc2ec\ud50c\ud398\uc774 plugin \u003c= 5.5.17 - Settings Change vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-95597",
    "datePublished": "2026-10-09T10:00:19.713Z",
    "dateReserved": "2026-09-22T09:18:20.379Z",
    "dateUpdated": "2026-10-11T12:13:42.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95589 (GCVE-0-2026-95589)

Vulnerability from cvelistv5 – Published: 2026-10-09 10:00 – Updated: 2026-10-09 20:10 X_Open Source

Title

WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 20:10 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3017 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
Magepeople inc.	Deposits and Partial Payments for WooCommerce	Affected: 0 , ≤ 4.0.1 (custom)

Date Public

2026-10-04 07:36

Credits

sungbyeongchan | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T20:10:15.523080Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T20:10:23.743Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "advanced-partial-payment-or-deposit-for-woocommerce",
          "product": "Deposits and Partial Payments for WooCommerce",
          "vendor": "Magepeople inc.",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.0.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "sungbyeongchan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-04T07:36:30.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T10:00:33.945Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/advanced-partial-payment-or-deposit-for-woocommerce/vulnerability/wordpress-deposits-and-partial-payments-for-woocommerce-plugin-4-0-1-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Deposits and Partial Payments for WooCommerce plugin to the latest available version (at least 4.0.12)."
            }
          ],
          "value": "Update the WordPress Deposits and Partial Payments for WooCommerce plugin to the latest available version (at least 4.0.12)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress Deposits and Partial Payments for WooCommerce plugin \u003c= 4.0.1 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-95589",
    "datePublished": "2026-10-09T10:00:33.945Z",
    "dateReserved": "2026-09-22T09:18:20.378Z",
    "dateUpdated": "2026-10-09T20:10:23.743Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95587 (GCVE-0-2026-95587)

Vulnerability from cvelistv5 – Published: 2026-09-30 12:27 – Updated: 2026-09-30 13:27

Title

WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

Summary

Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 13:06 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3017 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
Hostinger	Hostinger Migrator	Affected: n/a , ≤ 1.0 (custom)

Credits

onecomputerguy | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95587",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T13:06:02.678786Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T13:27:10.763Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hostinger Migrator",
          "vendor": "Hostinger",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.1.0",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.0",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "onecomputerguy | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Broken Access Control in Hostinger Migrator \u003c= 1.0 versions."
            }
          ],
          "value": "Unauthenticated Broken Access Control in Hostinger Migrator \u003c= 1.0 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T12:38:15.532Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/migrator-plugin/vulnerability/wordpress-hostinger-migrator-plugin-1-0-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Hostinger Migrator plugin to the latest available version (at least 1.1.0)."
            }
          ],
          "value": "Update the WordPress Hostinger Migrator plugin to the latest available version (at least 1.1.0)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Hostinger Migrator plugin \u003c= 1.0 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-95587",
    "datePublished": "2026-09-30T12:27:17.181Z",
    "dateReserved": "2026-09-22T09:18:20.378Z",
    "dateUpdated": "2026-09-30T13:27:10.763Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95527 (GCVE-0-2026-95527)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:14 – Updated: 2026-09-23 18:46

Title

WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability

Summary

Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 18:36 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3017 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
Conekta Group	Conekta Payment Gateway	Affected: n/a , ≤ 6.2.4 (custom)

Credits

anhcd05 | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95527",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T18:36:58.773320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T18:46:51.553Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "conekta-payment-gateway",
          "product": "Conekta Payment Gateway",
          "vendor": "Conekta Group",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.2.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.2.4",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "anhcd05 | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Broken Access Control in Conekta Payment Gateway \u003c= 6.2.4 versions."
            }
          ],
          "value": "Unauthenticated Broken Access Control in Conekta Payment Gateway \u003c= 6.2.4 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:14:41.354Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/conekta-payment-gateway/vulnerability/wordpress-conekta-payment-gateway-plugin-6-2-4-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Conekta Payment Gateway plugin to the latest available version (at least 6.2.5)."
            }
          ],
          "value": "Update the WordPress Conekta Payment Gateway plugin to the latest available version (at least 6.2.5)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Conekta Payment Gateway plugin \u003c= 6.2.4 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-95527",
    "datePublished": "2026-09-23T18:14:41.354Z",
    "dateReserved": "2026-09-22T08:50:55.122Z",
    "dateUpdated": "2026-09-23T18:46:51.553Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95526 (GCVE-0-2026-95526)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:35 – Updated: 2026-10-06 10:31

Title

WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

Summary

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 10:10 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3017 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
RealMag777	BEAR	Affected: n/a , ≤ 1.2.2 (custom)

Credits

Sakri Koskimies | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95526",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T10:10:40.469844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T10:31:29.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "woo-bulk-editor",
          "product": "BEAR",
          "vendor": "RealMag777",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.2.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.2.2",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Sakri Koskimies | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Broken Access Control in BEAR \u003c= 1.2.2 versions."
            }
          ],
          "value": "Unauthenticated Broken Access Control in BEAR \u003c= 1.2.2 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T08:35:07.323Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/woo-bulk-editor/vulnerability/wordpress-bear-plugin-1-2-2-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress BEAR Plugin to the latest available version (at least 1.2.3)."
            }
          ],
          "value": "Update the WordPress BEAR Plugin to the latest available version (at least 1.2.3)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress BEAR plugin \u003c= 1.2.2 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-95526",
    "datePublished": "2026-10-06T08:35:07.323Z",
    "dateReserved": "2026-09-22T08:50:54.587Z",
    "dateUpdated": "2026-10-06T10:31:29.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-95513 (GCVE-0-2026-95513)

Vulnerability from cvelistv5 – Published: 2026-09-23 18:14 – Updated: 2026-09-23 19:42

Title

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability

Summary

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 19:06 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3017 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
vcita	Online Booking & Scheduling Calendar for WordPress by vcita	Affected: n/a , ≤ 4.6.0 (custom)

Credits

ParkHyunWoo | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95513",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T19:06:10.530489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T19:42:44.139Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "meeting-scheduler-by-vcita",
          "product": "Online Booking \u0026 Scheduling Calendar for WordPress by vcita",
          "vendor": "vcita",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.6.3",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.6.0",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "ParkHyunWoo | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Broken Access Control in Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.6.0 versions."
            }
          ],
          "value": "Unauthenticated Broken Access Control in Online Booking \u0026 Scheduling Calendar for WordPress by vcita \u003c= 4.6.0 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T18:14:36.285Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-6-0-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress Online Booking \u0026 Scheduling Calendar for WordPress by vcita plugin to the latest available version (at least 4.6.3)."
            }
          ],
          "value": "Update the WordPress Online Booking \u0026 Scheduling Calendar for WordPress by vcita plugin to the latest available version (at least 4.6.3)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Online Booking \u0026 Scheduling Calendar for WordPress by vcita plugin \u003c= 4.6.0 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-95513",
    "datePublished": "2026-09-23T18:14:36.285Z",
    "dateReserved": "2026-09-22T08:30:28.073Z",
    "dateUpdated": "2026-09-23T19:42:44.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CWE-862

Missing Authorization

CVE-2026-95685 (GCVE-0-2026-95685)

AI-assisted vulnerability information annotation

Patch-to-vulnerability generation provenance

Fix summary

Patch summary

CVSS rationale

Weakness rationale

Attack pattern rationale

Assumptions to verify

Model comparison

CVE-2026-95683 (GCVE-0-2026-95683)

AI-assisted vulnerability information annotation

Patch-to-vulnerability generation provenance

Fix summary

Patch summary

CVSS rationale

Weakness rationale

Attack pattern rationale

Assumptions to verify

Model comparison

CVE-2026-95671 (GCVE-0-2026-95671)

AI-assisted vulnerability information annotation

Patch-to-vulnerability generation provenance

Fix summary

Patch summary

CVSS rationale

Weakness rationale

Attack pattern rationale

Assumptions to verify

Model comparison

CVE-2026-95604 (GCVE-0-2026-95604)

CVE-2026-95597 (GCVE-0-2026-95597)

CVE-2026-95589 (GCVE-0-2026-95589)

CVE-2026-95587 (GCVE-0-2026-95587)

CVE-2026-95527 (GCVE-0-2026-95527)

CVE-2026-95526 (GCVE-0-2026-95526)

CVE-2026-95513 (GCVE-0-2026-95513)

Mitigation

Mitigation

Mitigation MIT-4.4

Mitigation

Mitigation

CAPEC-665: Exploitation of Thunderbolt Protection Flaws