Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

19587 vulnerabilities reference this CWE, most recent first.

GHSA-243P-F3CV-C5WH

Vulnerability from github – Published: 2026-09-11 20:47 – Updated: 2026-09-11 20:47

Summary

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Details

Summary

Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the ->authorize(...) permission gate, while their per-record sibling actions (and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and Pages/Discount/Index.php) correctly chain ->authorize(...). Each affected page's mount() only requires the read-only browse_* permission, so a low-privilege staff user holding only the read permission can drive the bulk endpoint via the standard Livewire callTableBulkAction flow and execute state-mutating operations they were never granted. The vulnerability is the same class as GHSA-f946-9qp6-vgch and GHSA-j328-xmgp-j4q3 (read-only permission gating a write action), just on a different surface (Filament 4 groupedBulkActions rather than top-level Livewire methods).

A staff user holding only browse_attributes can permanently delete every product attribute in the catalog (cascading break of every dependent product variant). A user holding only browse_tags can permanently delete every product tag. Users holding browse_brands, browse_categories, or browse_suppliers can flip the visibility (is_enabled) of every brand/category/supplier in bulk, sabotaging storefront catalog visibility.

CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = 8.1 High. CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization). The attacker has low privilege (browse-only staff role), no user interaction, network reachable.

Vulnerable components (paths relative to repo root)

All references are HEAD = commit ac9a760 on master (the very commit that closed the previous wave of authorization-drift bugs from GHSA-j328-xmgp-j4q3).

1) `packages/admin/src/Livewire/Pages/Attribute/Browse.php`

Mount at line 36–39 requires only browse_attributes.

Lines 106–122: DeleteBulkAction::make() has NO ->authorize(...) chain (the surrounding per-record delete action at lines 95–104 correctly does ->authorize('delete_attributes')).
Lines 123–138: BulkAction::make('enabled') has NO ->authorize(...).
Lines 139–155: BulkAction::make('disabled') has NO ->authorize(...).

Net effect: a browse_attributes-only user can delete every row in the attributes table, and toggle is_enabled on every attribute in one request. Deleting an attribute cascades into every product variant that references it via the attribute_product pivot.

2) `packages/admin/src/Livewire/Pages/Tag/Index.php`

Mount at line 39 requires only browse_tags.

Lines 96–108: DeleteBulkAction::make() has NO ->authorize(...) chain (the per-record delete action at lines 79–94 correctly does ->authorize('delete_tags')).

Net effect: a browse_tags-only user can delete every ProductTag row.

3) `packages/admin/src/Livewire/Pages/Brand/Index.php`

Mount at line 37–40 requires only browse_brands.

Lines 97–112: BulkAction::make('enabled') has NO ->authorize(...).
Lines 113–129: BulkAction::make('disabled') has NO ->authorize(...).

Net effect: a browse_brands-only user can flip is_enabled on every brand. Disabling all brands removes them from the storefront catalog. The per-record edit/delete actions and the DeleteBulkAction at lines 130–148 are correctly ->authorize(...) gated — only the visibility bulk actions were missed.

4) `packages/admin/src/Livewire/Pages/Category/Index.php`

Mount at line 38–41 requires only browse_categories.

Lines 102–117: BulkAction::make('enabled') has NO ->authorize(...).
Lines 118–133: BulkAction::make('disabled') has NO ->authorize(...).

Net effect: a browse_categories-only user can flip is_enabled on every category. Same shape as Brand.

5) `packages/admin/src/Livewire/Pages/Supplier/Index.php`

Mount at line 38 requires only browse_suppliers.

Lines 93–108: BulkAction::make('enabled') has NO ->authorize(...).
Lines 109–125: BulkAction::make('disabled') has NO ->authorize(...).

Net effect: a browse_suppliers-only user can flip is_enabled on every supplier.

Reference comparison: places that ARE correctly gated

For reference, here is what the same pattern looks like in files that DID get the fix:

packages/admin/src/Livewire/Pages/Settings/Currencies.php lines 90–129: every BulkAction chains ->authorize('access_setting').
packages/admin/src/Livewire/Pages/Reviews/Index.php lines 105–119: DeleteBulkAction chains ->authorize('delete_reviews').
packages/admin/src/Livewire/Pages/Collection/Index.php lines 109–128: DeleteBulkAction chains ->authorize('delete_collections').
packages/admin/src/Livewire/Pages/Discount/Index.php lines 126–145: DeleteBulkAction chains ->authorize('delete_discounts').

The convention is established and applied elsewhere — these five files just missed it.

Proof of Concept

The attached file tests/Admin/Livewire/Pages/Brand/AuthBypassPocTest.php (added in this report) contains seven Pest tests, each acting as a browse_*-only staff user and invoking the bulk endpoint. All seven pass on master @ ac9a760:

   PASS  Tests\Admin\Livewire\Pages\Brand\AuthBypassPocTest
  ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all brands via unguarded BulkAction
  ✓ it SHOPPER-2 PoC: read-only viewer can mass-ENABLE all brands via unguarded BulkAction
  ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all categories via unguarded BulkAction
  ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all suppliers via unguarded BulkAction
  ✓ it SHOPPER-2 PoC: read-only viewer can DELETE all attributes via unguarded DeleteBulkAction
  ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all attributes via unguarded BulkAction
  ✓ it SHOPPER-2 PoC: browse_tags viewer can DELETE all product tags via unguarded DeleteBulkAction

  Tests:    7 passed (32 assertions)

Each test seeds three records, signs in a user holding only the corresponding browse_* permission, calls Livewire::test(<Page>::class)->callTableBulkAction(...), and asserts the side effect (records flipped or deleted). For example, the attribute mass-delete test:

$this->viewer = User::factory()->create();
$this->viewer->givePermissionTo('browse_attributes');
$this->actingAs($this->viewer);

Attribute::factory()->count(3)->create();
expect($this->viewer->can('delete_attributes'))->toBeFalse();

Livewire::test(AttributeBrowse::class)
    ->callTableBulkAction(\Filament\Actions\DeleteBulkAction::class, Attribute::pluck('id')->toArray())
    ->assertHasNoErrors();

expect(Attribute::count())->toBe(0);

The call uses the same callTableBulkAction helper Shopper's own test suite uses everywhere, which in turn drives the same Livewire update payload the browser would emit — so this is a faithful HTTP-level reproduction.

Suggested fix

Add ->authorize(<correct_permission>) to each of the five vulnerable groups, mirroring the pattern already used elsewhere:

 // Pages/Attribute/Browse.php
 ->groupedBulkActions([
     DeleteBulkAction::make()
+        ->authorize('delete_attributes')
         ->label(__('shopper::forms.actions.delete'))
         ->requiresConfirmation()
         ->action(function (Collection $records): void { /* ... */ }),
     BulkAction::make('enabled')
+        ->authorize('edit_attributes')
         ->label(__('shopper::forms.actions.enable'))
         ->action(function (Collection $records): void { /* ... */ }),
     BulkAction::make('disabled')
+        ->authorize('edit_attributes')
         ->label(__('shopper::forms.actions.disable'))
         ->action(function (Collection $records): void { /* ... */ }),
 ])

Apply the equivalent change to Pages/Tag/Index.php (delete_tags), Pages/Brand/Index.php (edit_brands for enable/disable), Pages/Category/Index.php (edit_categories), and Pages/Supplier/Index.php (edit_suppliers).

A regression test for each file (acting as a browse_*-only user and expecting assertHasErrors/AuthorizationException) would lock in the fix, matching the regression tests added for #514.

Resources

Prior advisories of the same class (read-only permission gating a write action): GHSA-f946-9qp6-vgch, GHSA-j328-xmgp-j4q3 / GHSA-vw82-3966-f9mr.
Same-shape fix: commit ac9a760 (PR #514). Five Filament bulk-action groups did not receive the corresponding ->authorize(...) chain.
CWE-285 Improper Authorization, CWE-862 Missing Authorization.

Credits

Reported by Vishal Shukla(@shukla304) using sechub.dev AI Agent

Support

If this disclosure was useful and userswould like to support continued open-source security research and responsible-disclosure work, they can sponsor at https://github.com/sponsors/therawdev — Shopper is thankful for those keeping open source safe.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopper/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T20:47:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nFive Filament `groupedBulkActions` blocks across the Shopper admin Livewire pages omit the `-\u003eauthorize(...)` permission gate, while their per-record sibling actions (and other Shopper Index pages such as `Pages/Settings/Currencies.php`, `Pages/Reviews/Index.php`, `Pages/Collection/Index.php`, and `Pages/Discount/Index.php`) correctly chain `-\u003eauthorize(...)`. Each affected page\u0027s `mount()` only requires the read-only `browse_*` permission, so a low-privilege staff user holding only the read permission can drive the bulk endpoint via the standard Livewire `callTableBulkAction` flow and execute state-mutating operations they were never granted. The vulnerability is the same class as GHSA-f946-9qp6-vgch and GHSA-j328-xmgp-j4q3 (read-only permission gating a write action), just on a different surface (Filament 4 `groupedBulkActions` rather than top-level Livewire methods).\n\nA staff user holding only `browse_attributes` can permanently delete every product attribute in the catalog (cascading break of every dependent product variant). A user holding only `browse_tags` can permanently delete every product tag. Users holding `browse_brands`, `browse_categories`, or `browse_suppliers` can flip the visibility (`is_enabled`) of every brand/category/supplier in bulk, sabotaging storefront catalog visibility.\n\nCVSS 3.1: `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H` = 8.1 High. CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization). The attacker has low privilege (browse-only staff role), no user interaction, network reachable.\n\n## Vulnerable components (paths relative to repo root)\n\nAll references are HEAD = commit `ac9a760` on `master` (the very commit that closed the previous wave of authorization-drift bugs from GHSA-j328-xmgp-j4q3).\n\n### 1) `packages/admin/src/Livewire/Pages/Attribute/Browse.php`\n\nMount at line 36\u201339 requires only `browse_attributes`.\n\n- Lines 106\u2013122: `DeleteBulkAction::make()` has NO `-\u003eauthorize(...)` chain (the surrounding per-record `delete` action at lines 95\u2013104 correctly does `-\u003eauthorize(\u0027delete_attributes\u0027)`).\n- Lines 123\u2013138: `BulkAction::make(\u0027enabled\u0027)` has NO `-\u003eauthorize(...)`.\n- Lines 139\u2013155: `BulkAction::make(\u0027disabled\u0027)` has NO `-\u003eauthorize(...)`.\n\nNet effect: a `browse_attributes`-only user can **delete every row in the attributes table**, and toggle `is_enabled` on every attribute in one request. Deleting an attribute cascades into every product variant that references it via the `attribute_product` pivot.\n\n### 2) `packages/admin/src/Livewire/Pages/Tag/Index.php`\n\nMount at line 39 requires only `browse_tags`.\n\n- Lines 96\u2013108: `DeleteBulkAction::make()` has NO `-\u003eauthorize(...)` chain (the per-record `delete` action at lines 79\u201394 correctly does `-\u003eauthorize(\u0027delete_tags\u0027)`).\n\nNet effect: a `browse_tags`-only user can delete every `ProductTag` row.\n\n### 3) `packages/admin/src/Livewire/Pages/Brand/Index.php`\n\nMount at line 37\u201340 requires only `browse_brands`.\n\n- Lines 97\u2013112: `BulkAction::make(\u0027enabled\u0027)` has NO `-\u003eauthorize(...)`.\n- Lines 113\u2013129: `BulkAction::make(\u0027disabled\u0027)` has NO `-\u003eauthorize(...)`.\n\nNet effect: a `browse_brands`-only user can flip `is_enabled` on every brand. Disabling all brands removes them from the storefront catalog. The per-record edit/delete actions and the `DeleteBulkAction` at lines 130\u2013148 are correctly `-\u003eauthorize(...)` gated \u2014 only the visibility bulk actions were missed.\n\n### 4) `packages/admin/src/Livewire/Pages/Category/Index.php`\n\nMount at line 38\u201341 requires only `browse_categories`.\n\n- Lines 102\u2013117: `BulkAction::make(\u0027enabled\u0027)` has NO `-\u003eauthorize(...)`.\n- Lines 118\u2013133: `BulkAction::make(\u0027disabled\u0027)` has NO `-\u003eauthorize(...)`.\n\nNet effect: a `browse_categories`-only user can flip `is_enabled` on every category. Same shape as Brand.\n\n### 5) `packages/admin/src/Livewire/Pages/Supplier/Index.php`\n\nMount at line 38 requires only `browse_suppliers`.\n\n- Lines 93\u2013108: `BulkAction::make(\u0027enabled\u0027)` has NO `-\u003eauthorize(...)`.\n- Lines 109\u2013125: `BulkAction::make(\u0027disabled\u0027)` has NO `-\u003eauthorize(...)`.\n\nNet effect: a `browse_suppliers`-only user can flip `is_enabled` on every supplier.\n\n## Reference comparison: places that ARE correctly gated\n\nFor reference, here is what the same pattern looks like in files that DID get the fix:\n\n- `packages/admin/src/Livewire/Pages/Settings/Currencies.php` lines 90\u2013129: every `BulkAction` chains `-\u003eauthorize(\u0027access_setting\u0027)`.\n- `packages/admin/src/Livewire/Pages/Reviews/Index.php` lines 105\u2013119: `DeleteBulkAction` chains `-\u003eauthorize(\u0027delete_reviews\u0027)`.\n- `packages/admin/src/Livewire/Pages/Collection/Index.php` lines 109\u2013128: `DeleteBulkAction` chains `-\u003eauthorize(\u0027delete_collections\u0027)`.\n- `packages/admin/src/Livewire/Pages/Discount/Index.php` lines 126\u2013145: `DeleteBulkAction` chains `-\u003eauthorize(\u0027delete_discounts\u0027)`.\n\nThe convention is established and applied elsewhere \u2014 these five files just missed it.\n\n## Proof of Concept\n\nThe attached file `tests/Admin/Livewire/Pages/Brand/AuthBypassPocTest.php` (added in this report) contains seven Pest tests, each acting as a `browse_*`-only staff user and invoking the bulk endpoint. All seven pass on master @ `ac9a760`:\n\n```\n   PASS  Tests\\Admin\\Livewire\\Pages\\Brand\\AuthBypassPocTest\n  \u2713 it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all brands via unguarded BulkAction\n  \u2713 it SHOPPER-2 PoC: read-only viewer can mass-ENABLE all brands via unguarded BulkAction\n  \u2713 it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all categories via unguarded BulkAction\n  \u2713 it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all suppliers via unguarded BulkAction\n  \u2713 it SHOPPER-2 PoC: read-only viewer can DELETE all attributes via unguarded DeleteBulkAction\n  \u2713 it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all attributes via unguarded BulkAction\n  \u2713 it SHOPPER-2 PoC: browse_tags viewer can DELETE all product tags via unguarded DeleteBulkAction\n\n  Tests:    7 passed (32 assertions)\n```\n\nEach test seeds three records, signs in a user holding only the corresponding `browse_*` permission, calls `Livewire::test(\u003cPage\u003e::class)-\u003ecallTableBulkAction(...)`, and asserts the side effect (records flipped or deleted). For example, the attribute mass-delete test:\n\n```php\n$this-\u003eviewer = User::factory()-\u003ecreate();\n$this-\u003eviewer-\u003egivePermissionTo(\u0027browse_attributes\u0027);\n$this-\u003eactingAs($this-\u003eviewer);\n\nAttribute::factory()-\u003ecount(3)-\u003ecreate();\nexpect($this-\u003eviewer-\u003ecan(\u0027delete_attributes\u0027))-\u003etoBeFalse();\n\nLivewire::test(AttributeBrowse::class)\n    -\u003ecallTableBulkAction(\\Filament\\Actions\\DeleteBulkAction::class, Attribute::pluck(\u0027id\u0027)-\u003etoArray())\n    -\u003eassertHasNoErrors();\n\nexpect(Attribute::count())-\u003etoBe(0);\n```\n\nThe call uses the same `callTableBulkAction` helper Shopper\u0027s own test suite uses everywhere, which in turn drives the same Livewire `update` payload the browser would emit \u2014 so this is a faithful HTTP-level reproduction.\n\n## Suggested fix\n\nAdd `-\u003eauthorize(\u003ccorrect_permission\u003e)` to each of the five vulnerable groups, mirroring the pattern already used elsewhere:\n\n```diff\n // Pages/Attribute/Browse.php\n -\u003egroupedBulkActions([\n     DeleteBulkAction::make()\n+        -\u003eauthorize(\u0027delete_attributes\u0027)\n         -\u003elabel(__(\u0027shopper::forms.actions.delete\u0027))\n         -\u003erequiresConfirmation()\n         -\u003eaction(function (Collection $records): void { /* ... */ }),\n     BulkAction::make(\u0027enabled\u0027)\n+        -\u003eauthorize(\u0027edit_attributes\u0027)\n         -\u003elabel(__(\u0027shopper::forms.actions.enable\u0027))\n         -\u003eaction(function (Collection $records): void { /* ... */ }),\n     BulkAction::make(\u0027disabled\u0027)\n+        -\u003eauthorize(\u0027edit_attributes\u0027)\n         -\u003elabel(__(\u0027shopper::forms.actions.disable\u0027))\n         -\u003eaction(function (Collection $records): void { /* ... */ }),\n ])\n```\n\nApply the equivalent change to `Pages/Tag/Index.php` (`delete_tags`), `Pages/Brand/Index.php` (`edit_brands` for enable/disable), `Pages/Category/Index.php` (`edit_categories`), and `Pages/Supplier/Index.php` (`edit_suppliers`).\n\nA regression test for each file (acting as a `browse_*`-only user and expecting `assertHasErrors`/`AuthorizationException`) would lock in the fix, matching the regression tests added for #514.\n\n## Resources\n\n- Prior advisories of the same class (read-only permission gating a write action): GHSA-f946-9qp6-vgch, GHSA-j328-xmgp-j4q3 / GHSA-vw82-3966-f9mr.\n- Same-shape fix: commit `ac9a760` (PR #514). Five Filament bulk-action groups did not receive the corresponding `-\u003eauthorize(...)` chain.\n- CWE-285 Improper Authorization, CWE-862 Missing Authorization.\n\n### Credits\n\nReported by Vishal Shukla(@shukla304) using sechub.dev AI Agent\n\n### Support\n\nIf this disclosure was useful and userswould like to support continued open-source security research and responsible-disclosure work, they can sponsor at https://github.com/sponsors/therawdev \u2014 Shopper is thankful for those keeping open source safe.",
  "id": "GHSA-243p-f3cv-c5wh",
  "modified": "2026-09-11T20:47:17Z",
  "published": "2026-09-11T20:47:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopperlabs/shopper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers"
}

GHSA-243V-5F97-VFQ3

Vulnerability from github – Published: 2026-06-04 15:30 – Updated: 2026-06-08 15:32

Details

An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the importing user belonged to the organization that owned the existing template. As a result, an authenticated user with access to the template import functionality could forcibly overwrite an event template owned by another organization.

Successful exploitation could allow unauthorized modification of another organization’s event template, potentially altering template structure, attributes, or metadata used for subsequent event creation or sharing workflows. Site administrators are not affected by this restriction, as they are explicitly allowed to overwrite templates across organizations.

The issue was fixed by enforcing an ownership check before overwrite: non-site-admin users may only overwrite templates owned by their own organization.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-10855"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T14:16:37Z",
    "severity": "MODERATE"
  },
  "details": "An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the importing user belonged to the organization that owned the existing template. As a result, an authenticated user with access to the template import functionality could forcibly overwrite an event template owned by another organization.\n\n\n\nSuccessful exploitation could allow unauthorized modification of another organization\u2019s event template, potentially altering template structure, attributes, or metadata used for subsequent event creation or sharing workflows. Site administrators are not affected by this restriction, as they are explicitly allowed to overwrite templates across organizations.\n\n\n\nThe issue was fixed by enforcing an ownership check before overwrite: non-site-admin users may only overwrite templates owned by their own organization.",
  "id": "GHSA-243v-5f97-vfq3",
  "modified": "2026-06-08T15:32:42Z",
  "published": "2026-06-04T15:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10855"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/7c2200d143bef86aaf58d701b6968a843097db69"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-243X-8MMP-F9JR

Vulnerability from github – Published: 2025-04-24 09:30 – Updated: 2026-04-08 18:33

Details

The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_settings() function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-3058"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-24T09:15:30Z",
    "severity": "HIGH"
  },
  "details": "The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwc_save_settings() function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.",
  "id": "GHSA-243x-8mmp-f9jr",
  "modified": "2026-04-08T18:33:52Z",
  "published": "2025-04-24T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3058"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/xelion-webchat/trunk//includes/class-xelion-webchat-ajax-admin.php#L119"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3282039%40xelion-webchat\u0026new=3282039%40xelion-webchat\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/250202d5-3a0d-494c-8386-1f4cd015ad7e?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2456-4748-M2M2

Vulnerability from github – Published: 2026-01-05 12:30 – Updated: 2026-04-28 21:35

Details

Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-31046"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-05T11:17:40Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor Pro: from n/a through 2.29.",
  "id": "GHSA-2456-4748-m2m2",
  "modified": "2026-04-28T21:35:53Z",
  "published": "2026-01-05T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31046"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/theme/anywhere-elementor-pro/vulnerability/wordpress-anywhere-elementor-pro-2-29-broken-access-control-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/wordpress/theme/anywhere-elementor-pro/vulnerability/wordpress-anywhere-elementor-pro-2-29-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-247F-FRVC-WQQM

Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31

Details

Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through <= 1.1.7.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-32370"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-13T19:54:51Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in raratheme Influencer influencer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Influencer: from n/a through \u003c= 1.1.7.",
  "id": "GHSA-247f-frvc-wqqm",
  "modified": "2026-03-13T21:31:48Z",
  "published": "2026-03-13T21:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32370"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/influencer/vulnerability/wordpress-influencer-theme-1-1-7-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2482-GR3V-F3F3

Vulnerability from github – Published: 2023-04-12 18:30 – Updated: 2023-04-12 22:18

Summary

Jenkins Fogbugz Plugin has missing permissions check

Details

Jenkins Fogbugz Plugin provides a webhook endpoint at /fbTrigger/ that can be used to trigger builds of any jobs.

In Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a jobname request parameter.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:fogbugz"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.2.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-30522"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-12T22:18:21Z",
    "nvd_published_at": "2023-04-12T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Fogbugz Plugin provides a webhook endpoint at `/fbTrigger/` that can be used to trigger builds of any jobs.\n\nIn Fogbugz Plugin 2.2.17 and earlier, this endpoint can be accessed by attackers with Item/Read permission, allowing them to trigger builds of jobs specified in a `jobname` request parameter.",
  "id": "GHSA-2482-gr3v-f3f3",
  "modified": "2023-04-12T22:18:21Z",
  "published": "2023-04-12T18:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30522"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2873"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/04/13/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins Fogbugz Plugin has missing permissions check"
}

GHSA-2484-XFXV-Q77X

Vulnerability from github – Published: 2024-10-16 09:30 – Updated: 2024-10-16 09:30

Details

The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery.

Severity

7.3 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-4444"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-16T07:15:09Z",
    "severity": "HIGH"
  },
  "details": "The Product Filter by WooBeWoo plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 1.4.9 due to missing authorization checks on various functions. This makes it possible for unauthenticated attackers to perform unauthorized actions such as creating new filters and injecting malicious javascript into a vulnerable site. This was actively exploited at the time of discovery.",
  "id": "GHSA-2484-xfxv-q77x",
  "modified": "2024-10-16T09:30:30Z",
  "published": "2024-10-16T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4444"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2527958%40woo-product-filter\u0026new=2527958%40woo-product-filter\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30b6b0bf-e632-4e83-89ee-a424382534da?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-248H-MPMP-3VWH

Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30

Details

Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-45438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-25T23:16:33Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization vulnerability in WebToffee Smart Coupons for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Smart Coupons for WooCommerce: from n/a before 2.3.0.",
  "id": "GHSA-248h-mpmp-3vwh",
  "modified": "2026-05-26T13:30:52Z",
  "published": "2026-05-26T13:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45438"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wt-smart-coupons-for-woocommerce/vulnerability/wordpress-smart-coupons-for-woocommerce-plugin-2-3-0-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2497-6PWJ-PWG7

Vulnerability from github – Published: 2026-06-26 22:12 – Updated: 2026-06-26 22:12

Summary

Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources

Details

Impact

An authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified.

Patches

This has been fixed in 5.73.23 and 6.20.0.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "statamic/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.73.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "statamic/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49288"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T22:12:21Z",
    "nvd_published_at": "2026-06-19T19:16:36Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAn authenticated Control Panel user could view metadata and content for resources they don\u0027t have permission to view, including entries, assets, users, roles, groups, and other configured resources. Depending on the resource, this could expose titles, custom field values, entry content, asset metadata, and the existence of users, roles, and groups. No data could be modified.\n\n### Patches\n\nThis has been fixed in 5.73.23 and 6.20.0.",
  "id": "GHSA-2497-6pwj-pwg7",
  "modified": "2026-06-26T22:12:21Z",
  "published": "2026-06-26T22:12:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/statamic/cms/security/advisories/GHSA-2497-6pwj-pwg7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49288"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/statamic/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources"
}

GHSA-249V-WCW9-X5FJ

Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30

Details

Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-24527"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-25T22:16:32Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Autoship Cloud for WooCommerce Subscription Products: from n/a through 2.14.0.",
  "id": "GHSA-249v-wcw9-x5fj",
  "modified": "2026-05-26T13:30:51Z",
  "published": "2026-05-26T13:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24527"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/autoship-cloud/vulnerability/wordpress-autoship-cloud-for-woocommerce-subscription-products-plugin-2-14-0-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Mitigation

Architecture and Design

Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

Mitigation

Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

Mitigation

Architecture and Design

For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

Mitigation

System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list

CWE-862

Missing Authorization

Summary

Vulnerable components (paths relative to repo root)

1) packages/admin/src/Livewire/Pages/Attribute/Browse.php

2) packages/admin/src/Livewire/Pages/Tag/Index.php

3) packages/admin/src/Livewire/Pages/Brand/Index.php

4) packages/admin/src/Livewire/Pages/Category/Index.php

5) packages/admin/src/Livewire/Pages/Supplier/Index.php

Reference comparison: places that ARE correctly gated

Proof of Concept

Suggested fix

Resources

Credits

Support

Impact

Patches

Mitigation

Mitigation

Mitigation MIT-4.4

Mitigation

Mitigation

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

1) `packages/admin/src/Livewire/Pages/Attribute/Browse.php`

2) `packages/admin/src/Livewire/Pages/Tag/Index.php`

3) `packages/admin/src/Livewire/Pages/Brand/Index.php`

4) `packages/admin/src/Livewire/Pages/Category/Index.php`

5) `packages/admin/src/Livewire/Pages/Supplier/Index.php`