CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
19587 vulnerabilities reference this CWE, most recent first.
GHSA-3CJ5-24C9-H5RW
Vulnerability from github – Published: 2025-06-06 15:30 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Raychat: from n/a through 2.1.0.
{
"affected": [],
"aliases": [
"CVE-2025-49236"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T13:15:40Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Raychat: from n/a through 2.1.0.",
"id": "GHSA-3cj5-24c9-h5rw",
"modified": "2026-04-01T18:35:21Z",
"published": "2025-06-06T15:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49236"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/raychat/vulnerability/wordpress-raychat-2-1-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3CJX-7CJ6-QVQ3
Vulnerability from github – Published: 2022-09-25 00:00 – Updated: 2022-09-28 00:00An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
{
"affected": [],
"aliases": [
"CVE-2022-32220"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-23T19:15:00Z",
"severity": "MODERATE"
},
"details": "An information disclosure vulnerability exists in Rocket.Chat \u003cv5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.",
"id": "GHSA-3cjx-7cj6-qvq3",
"modified": "2022-09-28T00:00:24Z",
"published": "2022-09-25T00:00:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32220"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1410246"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3CM4-CCVW-6XR6
Vulnerability from github – Published: 2026-10-05 17:32 – Updated: 2026-10-05 17:32Summary
GHSA-c8r8-95hg-mp34 added a centralized guard,
util.IsForbiddenAbsPath(), specifically to block access to a small
set of sensitive files: conf/conf.json (plaintext
accessAuthCode/API token/cookie key), data/snippets/conf.json,
the entire data/templates/ directory, and
data/.siyuan/publishAccess.json (plaintext publish-mode passwords).
It was applied to kernel/api/file.go and kernel/mcp/tools/file.go.
Two other routes in the same server that serve arbitrary files by path,
/history/*path and /repo/diff/*path, construct their target paths
independently and were not updated to call this new guard. Since the
repo/history snapshot system's tracked root is data/ (confirmed by
getSyncIgnoreLines(), whose ignore file lives at
data/.siyuan/syncignore with entries relative to data/), both
data/.siyuan/publishAccess.json and data/templates/* fall within
the scope that can legitimately be captured in historical snapshots,
meaning a prior version of either file can exist in
util.HistoryDir/the repo-diff temp checkout even after the live file
has been protected by the new guard. This is CWE-862 (Missing
Authorization) applied to a very recently introduced protection
mechanism.
Details
kernel/server/serve.go, /history/*path (around line 994):
ginServer.GET("/history/*path", model.CheckAuth, model.CheckAdminRole, func(context *gin.Context) {
p := filepath.Join(util.HistoryDir, context.Param("path"))
// 加密笔记本的历史是密文（.sy/assets/AV），需先解密再输出
if serveEncryptedHistory(context, p) {
return
}
secureAssetContentHeaders(context, p, p)
http.ServeFile(context.Writer, context.Request, p)
})
No call to util.IsForbiddenAbsPath(p) anywhere in this handler.
kernel/server/serve.go, /repo/diff/*path (around line 1241):
ginServer.GET("/repo/diff/*path", model.CheckAuth, model.CheckAdminRole, func(context *gin.Context) {
requestPath := filepath.Clean(context.Param("path"))
if strings.Contains(requestPath, "..") {
context.Status(http.StatusUnauthorized)
return
}
...
p := filepath.Join(repoDiffBaseDir, requestPath)
if !gulu.File.IsSubPath(repoDiffBaseDir, p) {
context.Status(http.StatusUnauthorized)
return
}
http.ServeFile(context.Writer, context.Request, p)
})
This route does have its own traversal protection (.. rejection and
IsSubPath containment within repoDiffBaseDir), but that only
prevents escaping the diff-checkout directory, it does nothing to
prevent retrieving a legitimately checked-out historical copy of
publishAccess.json or a templates file from within that directory,
which is exactly what the new guard exists to prevent regardless of
which directory the copy currently sits in.
util.IsForbiddenAbsPath() itself (kernel/util/path_guard.go,
introduced by the referenced fix) confirms the intended scope:
// 禁止访问 data/.siyuan/publishAccess.json（含发布模式明文访问密码）
publishAccessPath := NormalizeAndResolve(filepath.Join(DataDir, ".siyuan", "publishAccess.json"))
if fileNorm == publishAccessPath {
return true
}
and
// 禁止访问 data/templates 目录（含目录本身及其全部子路径）
templatesBase := NormalizeAndResolve(filepath.Join(DataDir, "templates"))
if fileNorm == templatesBase || gulu.File.IsSubPath(templatesBase, fileNorm) {
return true
}
Both are paths within data/, the same root the sync/history/repo
system tracks.
Step-by-step reproduction
- As the workspace admin, enable Publish with a password on at least
one notebook (creating
data/.siyuan/publishAccess.jsonwith a plaintext password), then let a sync/backup snapshot capture this state (or check whether local history capture already coversdata/.siyuan/in the deployed version). - Change or remove the publish password, so the live
publishAccess.jsonno longer contains the old plaintext password the new guard is meant to hide, going forward. - As the admin, request the historical/diff version instead of the
live file:
bash curl -s http://<target>:6806/history/<snapshot-path-to-publishAccess.json> \ -u "<workspaceName>:<accessAuthCode>" curl -s http://<target>:6806/repo/diff/<diff-path-to-publishAccess.json> \ -u "<workspaceName>:<accessAuthCode>" - Expected if consistently protected, matching the behavior the new
guard already provides on the live-file endpoints: rejected.
Observed: neither handler calls
IsForbiddenAbsPath, so the historical copy is served if it exists in that location.
(Not run against a live compiled kernel, same sandbox limitation noted
throughout this review; both handlers are read directly from source at
the reviewed commit, and IsForbiddenAbsPath's scope, plus the
sync-root confirmation via getSyncIgnoreLines(), are quoted directly
above. Whether these specific files are captured by history/repo
snapshots in a given deployment depends on the workspace's actual
usage history and was not independently verified against a live
instance in this review.)
Impact
An admin-authenticated request to either route can potentially retrieve
a historical copy of data/.siyuan/publishAccess.json (disclosing a
plaintext publish-mode password even after it has been changed or the
live file has been protected) or a data/templates/* file, directly
undermining the protection GHSA-c8r8-95hg-mp34 was written four days
prior to this review specifically to provide, via two routes that
predate that fix and were not updated alongside it.
```
Affected products
| Field | Value |
|---|---|
| Ecosystem | Go |
| Package name | github.com/siyuan-note/siyuan/kernel |
| Affected versions | Present as of commit 251596f (2026-08-12, the version this review confirmed), i.e. postdates and was not covered by the GHSA-c8r8-95hg-mp34 fix (commit 3542530, 2026-08-08) |
| Patched versions | (none yet, leave blank until a fix is released) |
Severity
| Field | Value |
|---|---|
| Vector string | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:M/I:N/A:N |
| Score | ~5.9 (Medium), PR:H since admin authentication is required at the HTTP layer, confidentiality impact scoped to whatever sensitive historical content happens to exist in the tracked snapshots for a given deployment (a real but deployment-dependent condition, honestly reflected as Medium rather than assumed to always be present), no integrity/availability impact since both are read-only. |
Weaknesses (CWE)
- CWE-862: Missing Authorization (primary)
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Notes for filing
- Direct, narrow follow-up to
GHSA-c8r8-95hg-mp34; recommend referencing that advisory directly when filing, since this is precisely the "sibling caller missed" pattern that fix's own centralization (moving the check into a sharedutilfunction) was presumably intended to prevent, just for two callers that existed before the shared function did and weren't migrated to it. - Suggested fix: add
if util.IsForbiddenAbsPath(p) { ... reject ... }to both handlers, matching the pattern already applied inkernel/api/file.goandkernel/mcp/tools/file.go.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan/kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260816034002-035bf9a8c311"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T17:32:44Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n`GHSA-c8r8-95hg-mp34` added a centralized guard,\n`util.IsForbiddenAbsPath()`, specifically to block access to a small\nset of sensitive files: `conf/conf.json` (plaintext\n`accessAuthCode`/API token/cookie key), `data/snippets/conf.json`,\nthe entire `data/templates/` directory, and\n`data/.siyuan/publishAccess.json` (plaintext publish-mode passwords).\nIt was applied to `kernel/api/file.go` and `kernel/mcp/tools/file.go`.\nTwo other routes in the same server that serve arbitrary files by path,\n`/history/*path` and `/repo/diff/*path`, construct their target paths\nindependently and were not updated to call this new guard. Since the\nrepo/history snapshot system\u0027s tracked root is `data/` (confirmed by\n`getSyncIgnoreLines()`, whose ignore file lives at\n`data/.siyuan/syncignore` with entries relative to `data/`), both\n`data/.siyuan/publishAccess.json` and `data/templates/*` fall within\nthe scope that can legitimately be captured in historical snapshots,\nmeaning a prior version of either file can exist in\n`util.HistoryDir`/the repo-diff temp checkout even after the live file\nhas been protected by the new guard. This is CWE-862 (Missing\nAuthorization) applied to a very recently introduced protection\nmechanism.\n\n### Details\n`kernel/server/serve.go`, `/history/*path` (around line 994):\n```go\nginServer.GET(\"/history/*path\", model.CheckAuth, model.CheckAdminRole, func(context *gin.Context) {\n p := filepath.Join(util.HistoryDir, context.Param(\"path\"))\n // \u52a0\u5bc6\u7b14\u8bb0\u672c\u7684\u5386\u53f2\u662f\u5bc6\u6587\uff08.sy/assets/AV\uff09\uff0c\u9700\u5148\u89e3\u5bc6\u518d\u8f93\u51fa\n if serveEncryptedHistory(context, p) {\n return\n }\n secureAssetContentHeaders(context, p, p)\n http.ServeFile(context.Writer, context.Request, p)\n})\n```\nNo call to `util.IsForbiddenAbsPath(p)` anywhere in this handler.\n\n`kernel/server/serve.go`, `/repo/diff/*path` (around line 1241):\n```go\nginServer.GET(\"/repo/diff/*path\", model.CheckAuth, model.CheckAdminRole, func(context *gin.Context) {\n requestPath := filepath.Clean(context.Param(\"path\"))\n if strings.Contains(requestPath, \"..\") {\n context.Status(http.StatusUnauthorized)\n return\n }\n ...\n p := filepath.Join(repoDiffBaseDir, requestPath)\n if !gulu.File.IsSubPath(repoDiffBaseDir, p) {\n context.Status(http.StatusUnauthorized)\n return\n }\n http.ServeFile(context.Writer, context.Request, p)\n})\n```\nThis route does have its own traversal protection (`..` rejection and\n`IsSubPath` containment within `repoDiffBaseDir`), but that only\nprevents escaping the diff-checkout directory, it does nothing to\nprevent retrieving a *legitimately checked-out historical copy* of\n`publishAccess.json` or a templates file from within that directory,\nwhich is exactly what the new guard exists to prevent regardless of\nwhich directory the copy currently sits in.\n\n`util.IsForbiddenAbsPath()` itself (`kernel/util/path_guard.go`,\nintroduced by the referenced fix) confirms the intended scope:\n```go\n// \u7981\u6b62\u8bbf\u95ee data/.siyuan/publishAccess.json\uff08\u542b\u53d1\u5e03\u6a21\u5f0f\u660e\u6587\u8bbf\u95ee\u5bc6\u7801\uff09\npublishAccessPath := NormalizeAndResolve(filepath.Join(DataDir, \".siyuan\", \"publishAccess.json\"))\nif fileNorm == publishAccessPath {\n return true\n}\n```\nand\n```go\n// \u7981\u6b62\u8bbf\u95ee data/templates \u76ee\u5f55\uff08\u542b\u76ee\u5f55\u672c\u8eab\u53ca\u5176\u5168\u90e8\u5b50\u8def\u5f84\uff09\ntemplatesBase := NormalizeAndResolve(filepath.Join(DataDir, \"templates\"))\nif fileNorm == templatesBase || gulu.File.IsSubPath(templatesBase, fileNorm) {\n return true\n}\n```\nBoth are paths within `data/`, the same root the sync/history/repo\nsystem tracks.\n\n### Step-by-step reproduction\n1. As the workspace admin, enable Publish with a password on at least\n one notebook (creating `data/.siyuan/publishAccess.json` with a\n plaintext password), then let a sync/backup snapshot capture this\n state (or check whether local history capture already covers\n `data/.siyuan/` in the deployed version).\n2. Change or remove the publish password, so the live\n `publishAccess.json` no longer contains the old plaintext password\n the new guard is meant to hide, going forward.\n3. As the admin, request the historical/diff version instead of the\n live file:\n ```bash\n curl -s http://\u003ctarget\u003e:6806/history/\u003csnapshot-path-to-publishAccess.json\u003e \\\n -u \"\u003cworkspaceName\u003e:\u003caccessAuthCode\u003e\"\n curl -s http://\u003ctarget\u003e:6806/repo/diff/\u003cdiff-path-to-publishAccess.json\u003e \\\n -u \"\u003cworkspaceName\u003e:\u003caccessAuthCode\u003e\"\n ```\n4. Expected if consistently protected, matching the behavior the new\n guard already provides on the live-file endpoints: rejected.\n Observed: neither handler calls `IsForbiddenAbsPath`, so the\n historical copy is served if it exists in that location.\n\n*(Not run against a live compiled kernel, same sandbox limitation noted\nthroughout this review; both handlers are read directly from source at\nthe reviewed commit, and `IsForbiddenAbsPath`\u0027s scope, plus the\nsync-root confirmation via `getSyncIgnoreLines()`, are quoted directly\nabove. Whether these specific files are captured by history/repo\nsnapshots in a given deployment depends on the workspace\u0027s actual\nusage history and was not independently verified against a live\ninstance in this review.)*\n\n### Impact\nAn admin-authenticated request to either route can potentially retrieve\na historical copy of `data/.siyuan/publishAccess.json` (disclosing a\nplaintext publish-mode password even after it has been changed or the\nlive file has been protected) or a `data/templates/*` file, directly\nundermining the protection `GHSA-c8r8-95hg-mp34` was written four days\nprior to this review specifically to provide, via two routes that\npredate that fix and were not updated alongside it.\n```\n\n## Affected products\n\n| Field | Value |\n|---|---|\n| Ecosystem | **Go** |\n| Package name | `github.com/siyuan-note/siyuan/kernel` |\n| Affected versions | Present as of commit `251596f` (2026-08-12, the version this review confirmed), i.e. postdates and was not covered by the `GHSA-c8r8-95hg-mp34` fix (commit `3542530`, 2026-08-08) |\n| Patched versions | *(none yet, leave blank until a fix is released)* |\n\n## Severity\n\n| Field | Value |\n|---|---|\n| Vector string | `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:M/I:N/A:N` |\n| Score | **~5.9 (Medium)**, `PR:H` since admin authentication is required at the HTTP layer, confidentiality impact scoped to whatever sensitive historical content happens to exist in the tracked snapshots for a given deployment (a real but deployment-dependent condition, honestly reflected as Medium rather than assumed to always be present), no integrity/availability impact since both are read-only. |\n\n## Weaknesses (CWE)\n\n- **CWE-862**: Missing Authorization (primary)\n- **CWE-200**: Exposure of Sensitive Information to an Unauthorized Actor\n\n## Notes for filing\n- Direct, narrow follow-up to `GHSA-c8r8-95hg-mp34`; recommend\n referencing that advisory directly when filing, since this is\n precisely the \"sibling caller missed\" pattern that fix\u0027s own\n centralization (moving the check into a shared `util` function) was\n presumably intended to prevent, just for two callers that existed\n before the shared function did and weren\u0027t migrated to it.\n- Suggested fix: add `if util.IsForbiddenAbsPath(p) { ... reject ... }`\n to both handlers, matching the pattern already applied in\n `kernel/api/file.go` and `kernel/mcp/tools/file.go`.",
"id": "GHSA-3cm4-ccvw-6xr6",
"modified": "2026-10-05T17:32:44Z",
"published": "2026-10-05T17:32:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/commit/035bf9a8c311c6f8468f2f1054b4d5e1711787e2"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*"
}
GHSA-3CPQ-R4VF-HXWG
Vulnerability from github – Published: 2026-11-04 21:32 – Updated: 2026-11-04 21:32WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
{
"affected": [],
"aliases": [
"CVE-2026-122224"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-11-04T21:18:10Z",
"severity": "HIGH"
},
"details": "WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permission_classes are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests to /api/v1/migrate/ or the compute instance create endpoint to migrate or undefine other users\u0027 virtual machines and create volumes and domains on any compute host.",
"id": "GHSA-3cpq-r4vf-hxwg",
"modified": "2026-11-04T21:32:32Z",
"published": "2026-11-04T21:32:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122224"
},
{
"type": "WEB",
"url": "https://github.com/retspen/webvirtcloud/issues/689"
},
{
"type": "WEB",
"url": "https://github.com/catborise/webvirtcloud/commit/1227674d8f5a5230e5c654267773aca4ebc5c717"
},
{
"type": "WEB",
"url": "https://github.com/retspen/webvirtcloud"
},
{
"type": "WEB",
"url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L125-L162"
},
{
"type": "WEB",
"url": "https://github.com/retspen/webvirtcloud/blob/bb920b0a7ffdf00c09e994dc2e45f05bc9ec1bb3/instances/api/viewsets.py#L174-L183"
},
{
"type": "WEB",
"url": "https://hackmd.io/@hieuPenguinnn/webvirtcloud-api-missing-authz-migrate-create"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/webvirtcloud-through-commit-bb920b0-missing-authorization-in-rest-api-migrate-and-create-endpoints"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3CRP-M98R-RM3Q
Vulnerability from github – Published: 2024-12-13 15:30 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2.
{
"affected": [],
"aliases": [
"CVE-2023-35777"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-13T15:15:16Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in The Events Calendar The Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.1.2.2.",
"id": "GHSA-3crp-m98r-rm3q",
"modified": "2026-04-28T21:35:23Z",
"published": "2024-12-13T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35777"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-1-2-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3CVG-JFMM-2MW4
Vulnerability from github – Published: 2023-08-20 03:30 – Updated: 2023-08-20 03:30Missing Authorization in GitHub repository hamza417/inure prior to build88.
{
"affected": [],
"aliases": [
"CVE-2023-4434"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-20T01:15:10Z",
"severity": "MODERATE"
},
"details": "Missing Authorization in GitHub repository hamza417/inure prior to build88.",
"id": "GHSA-3cvg-jfmm-2mw4",
"modified": "2023-08-20T03:30:25Z",
"published": "2023-08-20T03:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4434"
},
{
"type": "WEB",
"url": "https://github.com/hamza417/inure/commit/2176af74ca3a81fd001e6cc8eea5a8306f484fbb"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/19e68377-e071-4a8e-aa4c-cd84a426602e"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3CW3-5VXW-G2H3
Vulnerability from github – Published: 2026-03-31 23:51 – Updated: 2026-05-08 18:13Summary
Remote onboarding accepted discovered gateway endpoints without an explicit trust confirmation before persisting the remote URL and connection details.
Impact
A malicious or spoofed discovery endpoint could steer onboarding toward an attacker-controlled gateway and capture future gateway credentials or traffic.
Affected Component
src/commands/onboard-remote.ts
Fixed Versions
- Affected:
<= 2026.3.24 - Patched:
>= 2026.3.28 - Latest stable
2026.3.28contains the fix.
Fix
Fixed by commit d6affb17d8 (CLI: confirm discovered remote gateways before saving config).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.24"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.28"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41342"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-31T23:51:04Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nRemote onboarding accepted discovered gateway endpoints without an explicit trust confirmation before persisting the remote URL and connection details.\n\n## Impact\n\nA malicious or spoofed discovery endpoint could steer onboarding toward an attacker-controlled gateway and capture future gateway credentials or traffic.\n\n## Affected Component\n\n`src/commands/onboard-remote.ts`\n\n## Fixed Versions\n\n- Affected: `\u003c= 2026.3.24`\n- Patched: `\u003e= 2026.3.28`\n- Latest stable `2026.3.28` contains the fix.\n\n## Fix\n\nFixed by commit `d6affb17d8` (`CLI: confirm discovered remote gateways before saving config`).",
"id": "GHSA-3cw3-5vxw-g2h3",
"modified": "2026-05-08T18:13:29Z",
"published": "2026-03-31T23:51:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-3cw3-5vxw-g2h3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41342"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/d6affb17d85f5f5ab08ef9f2b994b257af12e75a"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-unauthenticated-discovery-endpoint-credential-exfiltration-via-remote-onboarding"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials"
}
GHSA-3CWP-WW6R-F893
Vulnerability from github – Published: 2024-10-23 18:33 – Updated: 2026-04-01 18:32Missing Authorization vulnerability in ReneeCussack 3D Work In Progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through 1.0.3.
{
"affected": [],
"aliases": [
"CVE-2024-49657"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-23T16:15:06Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in ReneeCussack 3D Work In Progress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D Work In Progress: from n/a through 1.0.3.",
"id": "GHSA-3cwp-ww6r-f893",
"modified": "2026-04-01T18:32:09Z",
"published": "2024-10-23T18:33:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49657"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/renee-work-in-progress/vulnerability/wordpress-3d-work-in-progress-plugin-1-0-3-arbitrary-file-deletion-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/renee-work-in-progress/wordpress-3d-work-in-progress-plugin-1-0-3-arbitrary-file-deletion-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3CXP-VV37-HXMM
Vulnerability from github – Published: 2025-11-21 15:31 – Updated: 2026-01-20 15:31Missing Authorization vulnerability in octolize Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cart Weight for WooCommerce: from n/a through <= 1.9.11.
{
"affected": [],
"aliases": [
"CVE-2025-66109"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-21T13:15:52Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in octolize Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cart Weight for WooCommerce: from n/a through \u003c= 1.9.11.",
"id": "GHSA-3cxp-vv37-hxmm",
"modified": "2026-01-20T15:31:57Z",
"published": "2025-11-21T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66109"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/woo-cart-weight/vulnerability/wordpress-cart-weight-for-woocommerce-plugin-1-9-11-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/woo-cart-weight/vulnerability/wordpress-cart-weight-for-woocommerce-plugin-1-9-11-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3F24-8WQG-CHHJ
Vulnerability from github – Published: 2024-11-01 15:31 – Updated: 2024-11-01 15:31Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.
{
"affected": [],
"aliases": [
"CVE-2024-38695"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-01T15:15:31Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.",
"id": "GHSA-3f24-8wqg-chhj",
"modified": "2024-11-01T15:31:57Z",
"published": "2024-11-01T15:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38695"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/wp-gotowebinar/wordpress-wp-gotowebinar-plugin-15-6-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.