CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
19587 vulnerabilities reference this CWE, most recent first.
GHSA-36P9-3C3R-22PP
Vulnerability from github – Published: 2024-12-13 15:30 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2.
{
"affected": [],
"aliases": [
"CVE-2023-34381"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-13T15:15:15Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Gesundheit Bewegt GmbH Zippy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zippy: from n/a through 1.6.2.",
"id": "GHSA-36p9-3c3r-22pp",
"modified": "2026-04-28T21:35:23Z",
"published": "2024-12-13T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34381"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/zippy/vulnerability/wordpress-zippy-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-36Q7-7PF9-HWJ2
Vulnerability from github – Published: 2025-07-16 12:30 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in Bill Minozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin: from n/a through 4.48.
{
"affected": [],
"aliases": [
"CVE-2025-48150"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-16T11:15:24Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Bill Minozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin: from n/a through 4.48.",
"id": "GHSA-36q7-7pf9-hwj2",
"modified": "2026-04-01T18:35:46Z",
"published": "2025-07-16T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48150"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/real-estate-right-now/vulnerability/wordpress-real-estate-property-2024-create-your-own-fields-and-search-bar-wp-plugin-plugin-4-48-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-36V8-MPJM-8J5R
Vulnerability from github – Published: 2026-09-03 21:21 – Updated: 2026-09-03 21:21CVE: This vulnerability corresponds to CVE-2026-68586.
Summary
The backlink API splits into list endpoints (which documents reference a block) and content endpoints (the rendered text of those referencing blocks). The list endpoints apply a publish-access filter, the content endpoints do not. As a result, /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc return the rendered DOM of blocks belonging to a publish-forbidden document to an anonymous reader, with no access check.
Both content endpoints are gated by CheckAuth only, reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.
Details
The asymmetry between the list and content sides is the tell that this is an oversight, not intended behavior:
| Endpoint | Returns | Publish-access filter | Route |
|---|---|---|---|
getBacklink |
list (*Path) |
FilterPathsByPublishAccess - present |
CheckAuth |
getBacklink2 |
list (*Path) |
FilterPathsByPublishAccess - present |
CheckAuth |
getBacklinkDoc |
rendered DOM | none | CheckAuth |
getBackmentionDoc |
rendered DOM | none | CheckAuth |
model/backlink.go contains no publish-access reference anywhere, and Backlink.DOM is the rendered HTML of the referencing blocks. getBacklinkDoc(defID, refTreeID) returns the rendered content of blocks in refTreeID - including a publish-forbidden, publish-disabled, or password-protected document with no access check. The filtered list siblings (getBacklink/getBacklink2) demonstrate that the publish boundary is meant to apply to this data; the content endpoints simply omit it.
A reader is not limited to the filtered backlink list, they call getBacklinkDoc directly with any refTreeID. This also yields a reference-existence oracle: the response reveals whether the forbidden document refTreeID references the block defID.
Proof of Concept
Reproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled). Setup: a publish-forbidden document D (REFTREEID) whose body contains the unique marker SECRET_MARKER_77 and which references a block DEFID in a separate known document.
1. Mark the target document publish-forbidden (admin action, the boundary that should block reads):
POST http://127.0.0.1:6806/api/filetree/setPublishAccess
Authorization: Token <admin-token>
{"id":"REFTREEID","visible":false,"password":"","disable":true}
2. Baseline: the list endpoint correctly hides the forbidden doc from the reader (anonymous, port 6808):
POST http://127.0.0.1:6808/api/ref/getBacklink2
{"id":"DEFID","k":"","mk":""}
The returned backlinks do not include the forbidden document D, the list side is filtered.
3. Disclosure: the content endpoint returns the forbidden doc's blocks anyway (anonymous, port 6808):
POST http://127.0.0.1:6808/api/ref/getBacklinkDoc
{"defID":"DEFID","refTreeID":"REFTREEID","keyword":""}
Returns HTTP 200; data.backlinks[].dom contains SECRET_MARKER_77, the rendered content of the publish-forbidden document, returned to an anonymous reader. getBackmentionDoc behaves identically for mention-type references.
Impact
An anonymous reader (publish mode with auth disabled) or any publish RoleReader, can read the rendered content of a publish-forbidden document's referencing blocks, defeating a boundary the administrator explicitly configured, and can determine whether a forbidden document references a given block (a reference-existence oracle).
Precondition (stated honestly): the request requires refTreeID (the forbidden document's ID) and defID (a block it references). defID may be any published/known block, so if the forbidden document references any public content, defID is known and only refTreeID need be supplied. Block/document IDs for forbidden documents are also obtainable from other CheckAuth-only endpoints that lack the publish-access filter (reported separately). This endpoint alone does not enumerate arbitrary documents; it discloses content once an ID is known.
Impact is confidentiality-only: content disclosure plus a reference-existence oracle, no modification. No admin role, CSRF token, or write permission is required. Encrypted notebooks are out of scope.
Suggested fix
Apply the same publish-access check the list siblings use. In getBacklinkDoc/getBackmentionDoc, filter each Backlink by its source document's box/path via CheckPathAccessableByPublishIgnore plus the publish-password cookie check consistent with FilterPathsByPublishAccess in getBacklink/getBacklink2. Any endpoint returning rendered block DOM should enforce the same publish boundary as the corresponding list endpoint.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan/kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260721014413-f45749a7ef6e"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-68586"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-03T21:21:19Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "**CVE:** This vulnerability corresponds to [CVE-2026-68586](https://nvd.nist.gov/vuln/detail/CVE-2026-68586).\n\n### Summary\n\nThe backlink API splits into list endpoints (which documents reference a block) and content endpoints (the rendered text of those referencing blocks). The list endpoints apply a publish-access filter, the content endpoints do not. As a result, `/api/ref/getBacklinkDoc` and `/api/ref/getBackmentionDoc` return the rendered DOM of blocks belonging to a publish-forbidden document to an anonymous reader, with no access check.\n\nBoth content endpoints are gated by `CheckAuth` only, reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`.\n\n### Details\n\nThe asymmetry between the list and content sides is the tell that this is an oversight, not intended behavior:\n\n| Endpoint | Returns | Publish-access filter | Route |\n|---|---|---|---|\n| `getBacklink` | list (`*Path`) | `FilterPathsByPublishAccess` - present | `CheckAuth` |\n| `getBacklink2` | list (`*Path`) | `FilterPathsByPublishAccess` - present | `CheckAuth` |\n| `getBacklinkDoc` | rendered DOM | none | `CheckAuth` |\n| `getBackmentionDoc` | rendered DOM | none | `CheckAuth` |\n\n`model/backlink.go` contains no publish-access reference anywhere, and `Backlink.DOM` is the rendered HTML of the referencing blocks. `getBacklinkDoc(defID, refTreeID)` returns the rendered content of blocks in `refTreeID` - including a publish-forbidden, publish-disabled, or password-protected document with no access check. The filtered list siblings (`getBacklink`/`getBacklink2`) demonstrate that the publish boundary is meant to apply to this data; the content endpoints simply omit it.\n\nA reader is not limited to the filtered backlink list, they call `getBacklinkDoc` directly with any `refTreeID`. This also yields a reference-existence oracle: the response reveals whether the forbidden document `refTreeID` references the block `defID`.\n\n### Proof of Concept\n\nReproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled). Setup: a publish-forbidden document `D` (`REFTREEID`) whose body contains the unique marker `SECRET_MARKER_77` and which references a block `DEFID` in a separate known document.\n\n**1. Mark the target document publish-forbidden (admin action, the boundary that should block reads):**\n```\nPOST http://127.0.0.1:6806/api/filetree/setPublishAccess\nAuthorization: Token \u003cadmin-token\u003e\n{\"id\":\"REFTREEID\",\"visible\":false,\"password\":\"\",\"disable\":true}\n```\n\n**2. Baseline: the list endpoint correctly hides the forbidden doc from the reader (anonymous, port 6808):**\n```\nPOST http://127.0.0.1:6808/api/ref/getBacklink2\n{\"id\":\"DEFID\",\"k\":\"\",\"mk\":\"\"}\n```\nThe returned backlinks do not include the forbidden document `D`, the list side is filtered.\n\n**3. Disclosure: the content endpoint returns the forbidden doc\u0027s blocks anyway (anonymous, port 6808):**\n```\nPOST http://127.0.0.1:6808/api/ref/getBacklinkDoc\n{\"defID\":\"DEFID\",\"refTreeID\":\"REFTREEID\",\"keyword\":\"\"}\n```\nReturns HTTP 200; `data.backlinks[].dom` contains `SECRET_MARKER_77`, the rendered content of the publish-forbidden document, returned to an anonymous reader. `getBackmentionDoc` behaves identically for mention-type references.\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader`, can read the rendered content of a publish-forbidden document\u0027s referencing blocks, defeating a boundary the administrator explicitly configured, and can determine whether a forbidden document references a given block (a reference-existence oracle).\n\n**Precondition (stated honestly):** the request requires `refTreeID` (the forbidden document\u0027s ID) and `defID` (a block it references). `defID` may be any published/known block, so if the forbidden document references any public content, `defID` is known and only `refTreeID` need be supplied. Block/document IDs for forbidden documents are also obtainable from other `CheckAuth`-only endpoints that lack the publish-access filter (reported separately). This endpoint alone does not enumerate arbitrary documents; it discloses content once an ID is known.\n\nImpact is confidentiality-only: content disclosure plus a reference-existence oracle, no modification. No admin role, CSRF token, or write permission is required. Encrypted notebooks are out of scope.\n\n### Suggested fix\n\nApply the same publish-access check the list siblings use. In `getBacklinkDoc`/`getBackmentionDoc`, filter each `Backlink` by its source document\u0027s box/path via `CheckPathAccessableByPublishIgnore` plus the publish-password cookie check consistent with `FilterPathsByPublishAccess` in `getBacklink`/`getBacklink2`. Any endpoint returning rendered block DOM should enforce the same publish boundary as the corresponding list endpoint.",
"id": "GHSA-36v8-mpjm-8j5r",
"modified": "2026-09-03T21:21:20Z",
"published": "2026-09-03T21:21:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68586"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/commit/f45749a7ef6e385f6e2af6b7dd12429d56d46f32"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/siyuan-before-content-disclosure-via-getbacklinkdoc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered"
}
GHSA-36VW-5FHV-QWCQ
Vulnerability from github – Published: 2026-10-15 18:32 – Updated: 2026-10-15 18:32Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.
{
"affected": [],
"aliases": [
"CVE-2026-110367"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-15T18:17:25Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.",
"id": "GHSA-36vw-5fhv-qwcq",
"modified": "2026-10-15T18:32:44Z",
"published": "2026-10-15T18:32:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110367"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-7-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-36W5-3R66-PM2C
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31Missing Authorization vulnerability in raratheme JobScout jobscout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobScout: from n/a through <= 1.1.7.
{
"affected": [],
"aliases": [
"CVE-2026-32334"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:54:43Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in raratheme JobScout jobscout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobScout: from n/a through \u003c= 1.1.7.",
"id": "GHSA-36w5-3r66-pm2c",
"modified": "2026-03-13T21:31:47Z",
"published": "2026-03-13T21:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32334"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Theme/jobscout/vulnerability/wordpress-jobscout-theme-1-1-7-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-36W5-5R4M-F2M6
Vulnerability from github – Published: 2025-02-18 06:35 – Updated: 2025-02-18 06:35The GetBookingsWP – Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
{
"affected": [],
"aliases": [
"CVE-2024-13677"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-18T05:15:17Z",
"severity": "HIGH"
},
"details": "The GetBookingsWP \u2013 Appointments Booking Calendar Plugin For WordPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.27. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like email. This makes it possible for authenticated attackers, with subscriber-level access and above, to change arbitrary user\u0027s email addresses, including administrators, and leverage that to reset the user\u0027s password and gain access to their account.",
"id": "GHSA-36w5-5r4m-f2m6",
"modified": "2025-02-18T06:35:39Z",
"published": "2025-02-18T06:35:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13677"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/get-bookings-wp/trunk/classes/user.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6b0dc03-3715-41f8-8888-1cccddb39c0b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-36XF-458C-932H
Vulnerability from github – Published: 2024-12-13 15:30 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5.
{
"affected": [],
"aliases": [
"CVE-2022-45840"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-13T15:15:08Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5.",
"id": "GHSA-36xf-458c-932h",
"modified": "2026-04-28T21:35:22Z",
"published": "2024-12-13T15:30:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45840"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-auto-affiliate-links/vulnerability/wordpress-auto-affiliate-links-plugin-6-2-1-5-unauth-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-36XX-7VF6-7MV3
Vulnerability from github – Published: 2023-07-31 22:00 – Updated: 2023-10-04 17:11When a new Member record was created in the cms it was possible to set a blank password. If an attacker knows the email address of the user with the blank password then they can attempt to log in using an empty password. The default member authenticator, login form and basic auth all require a non-empty password, however if a custom authentication method is used it may allow a successful login with the empty password. Starting with this release, blank passwords are no no longer allowed when members are created in the CMS. Programatically created Member records, such as those used in unit tests, still allow blank passwords. You may have some Member records in your system already which have empty passwords. To detect these, you can loop over all Member records with Member::get() and pass each record into the below method. It might be sensible to create a BuildTask for this purpose.
php
private function memberHasBlankPassword(Member $member): bool
{
// skip default admin as this is created programatically
if ($member->isDefaultAdmin()) {
return false;
}
// return true if a blank password is valid for this member
$authenticator = new MemberAuthenticator();
return $authenticator->checkPassword($member, '')->isValid();
}
Once you have identified the records with empty passwords, it's up to you how to handle this. The most sensible way to resolve this is probably to generate a new secure password for each of these members, mark it as immediately expired, and email each affected member (assuming they have a valid email address in the system).
Users would need to opt-in to insecure behavior by using a configuration which allowed for empty passwords. These configurations are not expected and hence this advisory is primarily informational in nature.
Reported by: Sabina Talipova from Silverstripe and Christian Bünte
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/framework"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "4.13.14"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/framework"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-32302"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-31T22:00:58Z",
"nvd_published_at": "2023-08-01T11:15:09Z",
"severity": "LOW"
},
"details": "When a new `Member` record was created in the cms it was possible to set a blank password. If an attacker knows the email address of the user with the blank password then they can attempt to log in using an empty password. The default member authenticator, login form and basic auth all require a non-empty password, however if a custom authentication method is used it may allow a successful login with the empty password. Starting with this release, blank passwords are no no longer allowed when members are created in the CMS. Programatically created `Member` records, such as those used in unit tests, still allow blank passwords. You may have some `Member` records in your system already which have empty passwords. To detect these, you can loop over all `Member` records with `Member::get()` and pass each record into the below method. It might be sensible to create a [`BuildTask`](https://api.silverstripe.org/5/SilverStripe/Dev/BuildTask.html) for this purpose.\n ```php\n private function memberHasBlankPassword(Member $member): bool\n {\n // skip default admin as this is created programatically\n if ($member-\u003eisDefaultAdmin()) {\n return false;\n }\n // return true if a blank password is valid for this member\n $authenticator = new MemberAuthenticator();\n return $authenticator-\u003echeckPassword($member, \u0027\u0027)-\u003eisValid();\n }\n ```\n Once you have identified the records with empty passwords, it\u0027s up to you how to handle this. The most sensible way to resolve this is probably to generate a new secure password for each of these members, mark it as immediately expired, and email each affected member (assuming they have a valid email address in the system).\n\nUsers would need to opt-in to insecure behavior by using a configuration which allowed for empty passwords. These configurations are not expected and hence this advisory is primarily informational in nature.\n\nReported by: [Sabina Talipova](https://www.silverstripe.com/about-us/team/?member=sabina-talipova) from Silverstripe and [Christian B\u00fcnte](https://github.com/bimthebam)",
"id": "GHSA-36xx-7vf6-7mv3",
"modified": "2023-10-04T17:11:40Z",
"published": "2023-07-31T22:00:58Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-36xx-7vf6-7mv3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32302"
},
{
"type": "WEB",
"url": "https://github.com/github/advisory-database/pull/2575"
},
{
"type": "WEB",
"url": "https://github.com/silverstripe/silverstripe-framework/commit/7b21b38ac4532d06565dfcefad50540ebd2b50f4"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2023-32302.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/silverstripe/silverstripe-framework"
},
{
"type": "WEB",
"url": "https://github.com/silverstripe/silverstripe-framework/releases/tag/4.13.14"
},
{
"type": "WEB",
"url": "https://github.com/silverstripe/silverstripe-framework/releases/tag/5.0.13"
},
{
"type": "WEB",
"url": "https://www.silverstripe.org/download/security-releases/CVE-2023-32302"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Silverstripe Framework: Members with no password can be created and bypass custom login forms"
}
GHSA-372F-JC47-7GR5
Vulnerability from github – Published: 2022-02-16 00:01 – Updated: 2022-12-01 23:00Conjur Secrets Plugin 1.0.11 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.conjur.jenkins:conjur-credentials"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-25190"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-01T23:00:11Z",
"nvd_published_at": "2022-02-15T17:15:00Z",
"severity": "MODERATE"
},
"details": "Conjur Secrets Plugin 1.0.11 and earlier does not perform a permission check in an HTTP endpoint.\n\nThis allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.",
"id": "GHSA-372f-jc47-7gr5",
"modified": "2022-12-01T23:00:11Z",
"published": "2022-02-16T00:01:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25190"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/conjur-credentials-plugin/commit/eda06cde26cdf2d40ae4e2f4d2709e8174489068"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/conjur-credentials-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2350"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs"
}
GHSA-372G-Q4VH-MCFM
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through < 1.18.9.
{
"affected": [],
"aliases": [
"CVE-2026-32417"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:54:59Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through \u003c 1.18.9.",
"id": "GHSA-372g-q4vh-mcfm",
"modified": "2026-03-13T21:31:49Z",
"published": "2026-03-13T21:31:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32417"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/pochipp/vulnerability/wordpress-pochipp-plugin-1-18-9-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.