CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5678 vulnerabilities reference this CWE, most recent first.
GHSA-5567-C6HM-CGJH
Vulnerability from github – Published: 2025-08-28 18:30 – Updated: 2025-08-28 18:30Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user role which incorrectly has the ability to access all Kibana Spaces.
{
"affected": [],
"aliases": [
"CVE-2025-25010"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-28T16:15:34Z",
"severity": "MODERATE"
},
"details": "Incorrect authorization in Kibana can lead to privilege escalation via the built-in reporting_user\u00a0role which incorrectly has the ability to access all Kibana Spaces.",
"id": "GHSA-5567-c6hm-cgjh",
"modified": "2025-08-28T18:30:38Z",
"published": "2025-08-28T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25010"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/kibana-9-0-6-9-1-3-security-update-esa-2025-13/381426"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-556J-5CHH-24CP
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead to integrity and confidentiality loss or information disclosure. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior to 8.7).
{
"affected": [],
"aliases": [
"CVE-2021-1086"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-29T19:15:00Z",
"severity": "HIGH"
},
"details": "NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it allows guests to control unauthorized resources, which may lead to integrity and confidentiality loss or information disclosure. This affects vGPU version 12.x (prior to 12.2), version 11.x (prior to 11.4) and version 8.x (prior to 8.7).",
"id": "GHSA-556j-5chh-24cp",
"modified": "2022-05-24T17:49:13Z",
"published": "2022-05-24T17:49:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1086"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5172"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-55GC-6FMC-FPX9
Vulnerability from github – Published: 2026-05-06 21:59 – Updated: 2026-05-14 20:53Summary
A missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG.
This issue has been patched in v0.83.39. Hatchet Cloud has been patched and requires no action from users. Self-hosted users should upgrade.
Impact
Who is affected. Multi-tenant Hatchet instances reachable by an attacker who can obtain an account on that instance. On Hatchet Cloud, account creation is open by default. On self-hosted instances, the API must be reachable by the attacker and the hostname known; instances deployed inside a VPC or with signup restricted are not exposed to arbitrary external actors.
Prerequisites for exploitation. An attacker needed:
- An account on the target Hatchet instance.
- The victim tenant's UUID.
- At least one DAG UUID (
external_id) belonging to that tenant.
The two UUIDs are not treated as secrets — they appear in URLs, API responses, audit logs, invitation flows, shared run links, and dashboard screenshots — but an attacker does need to learn them through some out-of-band channel before exploitation is possible.
What could be disclosed. For each child task of a targeted DAG, the endpoint returned:
display_name,action_id,step_idworkflow_id,workflow_version_id,workflow_run_id,task_external_idtenant_id,retry_count,status, timestampsadditional_metadata(JSON)
The additional_metadata field is the most sensitive: Hatchet workflows commonly use it to carry domain context such as user identifiers, customer IDs, feature flags, or correlation tokens. Its contents vary by deployment.
What was not disclosed. The raw task input payload is not part of this endpoint's response shape and was not exposed through this issue. The scope is limited to task metadata, not task arguments or results.
Exploitation status. We have no evidence that this vulnerability was exploited prior to the patch.
Root cause
Hatchet's multi-tenant authorization relies on an OpenAPI-driven middleware pipeline. Each authenticated operation declares x-resources: ["tenant", ...] in its spec. The populator middleware reads the declared resources, looks up the corresponding entities from request parameters, and stores them on the request context. The authz middleware then verifies that the authenticated user is a member of the tenant found on the context.
The listTasksByDAGIds operation accepted a tenant UUID as a query parameter, but its OpenAPI definition did not declare x-resources: ["tenant"]. As a result:
- The populator, which early-returns when no resources are declared, did not populate the tenant onto the request context.
- The authz middleware, which runs its membership check only when a tenant is present on the context, silently passed the request through.
- The handler read the tenant UUID directly from the query parameter and used it as the filter in the downstream OLAP query.
The SQL query itself correctly filters by tenant_id, so it returned only rows matching the supplied UUID — but the UUID came from the caller rather than from an authorization-validated context, so the filter bounded the response to the attacker-named tenant rather than to a tenant the caller was authorized to read.
Every other authenticated operation in the same path file (tasks.yaml) correctly declared x-resources. This endpoint was the only authenticated operation in the file that did not.
Patch
The fix adds the missing resource authz checks inline on the handler, enforcing valid tenant membership before the handler runs.
Shipped in v0.83.39.
Remediation
Hatchet Cloud. No action required. The patch was deployed on April 23, 2026 within the same day it was reported.
Self-hosted — recommended. Upgrade to v0.83.39 or later.
Self-hosted — if you cannot upgrade immediately. Either of the following reduces exposure until you can upgrade:
- Restrict account creation by setting
SERVER_AUTH_RESTRICTED_EMAIL_DOMAINSto an allowlist of domains you control. This prevents arbitrary users from registering an account on your instance, which removes the most common path to the prerequisite account. - Ensure the Hatchet API is not exposed to untrusted networks. We generally recommend running Hatchet inside a VPC and fronting the API with authenticated network controls; deployments configured this way were not reachable by arbitrary external attackers.
Timeline
All times April 23, 2026.
- 14:05 — Reported to Hatchet.
- 16:28 — Patch deployed to Hatchet Cloud and released as v0.83.39.
- Public disclosure — this advisory.
Credit
Reported by @sajdakabir.
Hatchet thanks the reporter for responsibly disclosing this issue and for the clear, reproducible writeup.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.83.38"
},
"package": {
"ecosystem": "Go",
"name": "github.com/hatchet-dev/hatchet"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.83.39"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42572"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T21:59:05Z",
"nvd_published_at": "2026-05-14T18:16:47Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nA missing authorization directive on the `GET /api/v1/stable/dags/tasks` endpoint caused Hatchet\u0027s tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant\u0027s UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG.\n\nThis issue has been patched in **v0.83.39**. Hatchet Cloud has been patched and requires no action from users. Self-hosted users should upgrade.\n\n## Impact\n\n**Who is affected.** Multi-tenant Hatchet instances reachable by an attacker who can obtain an account on that instance. On Hatchet Cloud, account creation is open by default. On self-hosted instances, the API must be reachable by the attacker and the hostname known; instances deployed inside a VPC or with signup restricted are not exposed to arbitrary external actors.\n\n**Prerequisites for exploitation.** An attacker needed:\n\n1. An account on the target Hatchet instance.\n2. The victim tenant\u0027s UUID.\n3. At least one DAG UUID (`external_id`) belonging to that tenant.\n\nThe two UUIDs are not treated as secrets \u2014 they appear in URLs, API responses, audit logs, invitation flows, shared run links, and dashboard screenshots \u2014 but an attacker does need to learn them through some out-of-band channel before exploitation is possible.\n\n**What could be disclosed.** For each child task of a targeted DAG, the endpoint returned:\n\n- `display_name`, `action_id`, `step_id`\n- `workflow_id`, `workflow_version_id`, `workflow_run_id`, `task_external_id`\n- `tenant_id`, `retry_count`, `status`, timestamps\n- `additional_metadata` (JSON)\n\nThe `additional_metadata` field is the most sensitive: Hatchet workflows commonly use it to carry domain context such as user identifiers, customer IDs, feature flags, or correlation tokens. Its contents vary by deployment.\n\n**What was not disclosed.** The raw task `input` payload is not part of this endpoint\u0027s response shape and was not exposed through this issue. The scope is limited to task metadata, not task arguments or results.\n\n**Exploitation status.** We have no evidence that this vulnerability was exploited prior to the patch.\n\n## Root cause\n\nHatchet\u0027s multi-tenant authorization relies on an OpenAPI-driven middleware pipeline. Each authenticated operation declares `x-resources: [\"tenant\", ...]` in its spec. The `populator` middleware reads the declared resources, looks up the corresponding entities from request parameters, and stores them on the request context. The `authz` middleware then verifies that the authenticated user is a member of the tenant found on the context.\n\nThe `listTasksByDAGIds` operation accepted a `tenant` UUID as a query parameter, but its OpenAPI definition did not declare `x-resources: [\"tenant\"]`. As a result:\n\n1. The populator, which early-returns when no resources are declared, did not populate the tenant onto the request context.\n2. The authz middleware, which runs its membership check only when a tenant is present on the context, silently passed the request through.\n3. The handler read the tenant UUID directly from the query parameter and used it as the filter in the downstream OLAP query.\n\nThe SQL query itself correctly filters by `tenant_id`, so it returned only rows matching the supplied UUID \u2014 but the UUID came from the caller rather than from an authorization-validated context, so the filter bounded the response to the *attacker-named* tenant rather than to a tenant the caller was authorized to read.\n\nEvery other authenticated operation in the same path file (`tasks.yaml`) correctly declared `x-resources`. This endpoint was the only authenticated operation in the file that did not.\n\n## Patch\n\nThe fix adds the missing resource authz checks inline on the handler, enforcing valid tenant membership before the handler runs.\n\nShipped in **v0.83.39**.\n\n## Remediation\n\n**Hatchet Cloud.** No action required. The patch was deployed on April 23, 2026 within the same day it was reported.\n\n**Self-hosted \u2014 recommended.** Upgrade to **v0.83.39** or later.\n\n**Self-hosted \u2014 if you cannot upgrade immediately.** Either of the following reduces exposure until you can upgrade:\n\n- Restrict account creation by setting `SERVER_AUTH_RESTRICTED_EMAIL_DOMAINS` to an allowlist of domains you control. This prevents arbitrary users from registering an account on your instance, which removes the most common path to the prerequisite account.\n- Ensure the Hatchet API is not exposed to untrusted networks. We generally recommend running Hatchet inside a VPC and fronting the API with authenticated network controls; deployments configured this way were not reachable by arbitrary external attackers.\n\n## Timeline\n\nAll times April 23, 2026.\n\n- **14:05** \u2014 Reported to Hatchet.\n- **16:28** \u2014 Patch deployed to Hatchet Cloud and released as v0.83.39.\n- Public disclosure \u2014 this advisory.\n\n## Credit\n\nReported by @sajdakabir.\n\nHatchet thanks the reporter for responsibly disclosing this issue and for the clear, reproducible writeup.",
"id": "GHSA-55gc-6fmc-fpx9",
"modified": "2026-05-14T20:53:43Z",
"published": "2026-05-06T21:59:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-55gc-6fmc-fpx9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42572"
},
{
"type": "PACKAGE",
"url": "https://github.com/hatchet-dev/hatchet"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Hatchet affected by cross-tenant information disclosure in `listTasksByDAGIds`"
}
GHSA-55QQ-X3MF-MHR9
Vulnerability from github – Published: 2023-05-31 15:30 – Updated: 2024-04-04 04:25In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible
{
"affected": [],
"aliases": [
"CVE-2023-34218"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-31T14:15:10Z",
"severity": "CRITICAL"
},
"details": "In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible",
"id": "GHSA-55qq-x3mf-mhr9",
"modified": "2024-04-04T04:25:45Z",
"published": "2023-05-31T15:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34218"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-564F-J4MM-773M
Vulnerability from github – Published: 2022-05-13 01:37 – Updated: 2022-05-13 01:37Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission checks for directories in POSIX mode.
{
"affected": [],
"aliases": [
"CVE-2017-16773"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-05T13:29:00Z",
"severity": "HIGH"
},
"details": "Improper authorization vulnerability in Highlight Preview in Synology Universal Search before 1.0.5-0135 allows remote authenticated users to bypass permission checks for directories in POSIX mode.",
"id": "GHSA-564f-j4mm-773m",
"modified": "2022-05-13T01:37:19Z",
"published": "2022-05-13T01:37:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16773"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/support/security/Synology_SA_18_27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-564F-WX8X-878H
Vulnerability from github – Published: 2026-03-20 17:25 – Updated: 2026-03-20 17:25Summary
The DELETE /api/v1/projects/:project/background endpoint checks CanRead permission instead of CanUpdate, allowing any user with read-only access to a project to permanently delete its background image.
Details
The RemoveProjectBackground handler (pkg/modules/background/handler/background.go) reuses checkProjectBackgroundRights, a helper originally written for the read-only GetProjectBackground endpoint. This helper only verifies CanRead permission. In contrast, the handler for setting a background (setBackgroundPreparations) correctly checks CanUpdate.
As a result, destructive write operations (deleting the background file from storage and clearing the project's background_file_id and background_blur_hash fields) are gated behind a read-only permission check.
Impact
A user with read-only access to a project — via direct sharing, team membership, link share tokens with read permission, or read-scoped API tokens — can permanently delete the project's background image. The background file is removed from storage and cannot be recovered. This constitutes unauthorized data destruction.
Reproduction
- User A creates a project and sets a background image.
- User A shares the project with User B with read-only permission.
- User B sends:
DELETE /api/v1/projects/{project_id}/backgroundwith a valid auth token. - The request succeeds. The background image is permanently deleted.
References
pkg/modules/background/handler/background.go—RemoveProjectBackground(line 416),checkProjectBackgroundRights(line 304),setBackgroundPreparations(line 106)pkg/routes/routes.goline 665 — route registration
Credits
This vulnerability was found using GitHub Security Lab Taskflows.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "code.vikunja.io/api"
},
"ranges": [
{
"events": [
{
"introduced": "0.20.2"
},
{
"fixed": "2.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33312"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-20T17:25:21Z",
"nvd_published_at": "2026-03-20T15:16:18Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nThe `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image.\n\n## Details\n\nThe `RemoveProjectBackground` handler (`pkg/modules/background/handler/background.go`) reuses `checkProjectBackgroundRights`, a helper originally written for the read-only `GetProjectBackground` endpoint. This helper only verifies `CanRead` permission. In contrast, the handler for *setting* a background (`setBackgroundPreparations`) correctly checks `CanUpdate`.\n\nAs a result, destructive write operations (deleting the background file from storage and clearing the project\u0027s `background_file_id` and `background_blur_hash` fields) are gated behind a read-only permission check.\n\n## Impact\n\nA user with read-only access to a project \u2014 via direct sharing, team membership, link share tokens with read permission, or read-scoped API tokens \u2014 can permanently delete the project\u0027s background image. The background file is removed from storage and cannot be recovered. This constitutes unauthorized data destruction.\n\n## Reproduction\n\n1. User A creates a project and sets a background image.\n2. User A shares the project with User B with **read-only** permission.\n3. User B sends: `DELETE /api/v1/projects/{project_id}/background` with a valid auth token.\n4. The request succeeds. The background image is permanently deleted.\n\n## References\n\n- `pkg/modules/background/handler/background.go` \u2014 `RemoveProjectBackground` (line 416), `checkProjectBackgroundRights` (line 304), `setBackgroundPreparations` (line 106)\n- `pkg/routes/routes.go` line 665 \u2014 route registration\n\n## Credits\n\nThis vulnerability was found using [GitHub Security Lab Taskflows](https://github.com/GitHubSecurityLab/seclab-taskflows).",
"id": "GHSA-564f-wx8x-878h",
"modified": "2026-03-20T17:25:21Z",
"published": "2026-03-20T17:25:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-564f-wx8x-878h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33312"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-vikunja/vikunja"
},
{
"type": "WEB",
"url": "https://vikunja.io/changelog/vikunja-v2.2.0-was-released"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Vikunja read-only users can delete project background images via broken object-level authorization"
}
GHSA-564W-J7MV-2V7Q
Vulnerability from github – Published: 2023-08-03 18:30 – Updated: 2024-04-04 06:31An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.
{
"affected": [],
"aliases": [
"CVE-2023-28468"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-03T15:15:20Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.",
"id": "GHSA-564w-j7mv-2v7q",
"modified": "2024-04-04T06:31:35Z",
"published": "2023-08-03T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28468"
},
{
"type": "WEB",
"url": "https://www.insyde.com/security-pledge"
},
{
"type": "WEB",
"url": "https://www.insyde.com/security-pledge/SA-2023039"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-567C-GXMX-3PQ9
Vulnerability from github – Published: 2024-12-27 21:30 – Updated: 2024-12-28 21:30An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submit reviews without verifying if they have purchased the product.
{
"affected": [],
"aliases": [
"CVE-2024-50945"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T19:15:08Z",
"severity": "HIGH"
},
"details": "An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submit reviews without verifying if they have purchased the product.",
"id": "GHSA-567c-gxmx-3pq9",
"modified": "2024-12-28T21:30:26Z",
"published": "2024-12-27T21:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50945"
},
{
"type": "WEB",
"url": "https://github.com/AbdullahAlmutawa/CVE-2024-50945"
},
{
"type": "WEB",
"url": "https://github.com/simplcommerce/SimplCommerce"
},
{
"type": "WEB",
"url": "https://www.simplcommerce.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-568F-HGVF-96X7
Vulnerability from github – Published: 2021-12-14 00:00 – Updated: 2022-07-13 00:01A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific hex read/write operations.
{
"affected": [],
"aliases": [
"CVE-2021-36169"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-13T14:15:00Z",
"severity": "MODERATE"
},
"details": "A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific hex read/write operations.",
"id": "GHSA-568f-hgvf-96x7",
"modified": "2022-07-13T00:01:29Z",
"published": "2021-12-14T00:00:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36169"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-091"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-568G-56P5-CJ7R
Vulnerability from github – Published: 2025-05-23 00:30 – Updated: 2025-05-23 00:30When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.
{
"affected": [],
"aliases": [
"CVE-2025-4975"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-22T22:15:31Z",
"severity": "MODERATE"
},
"details": "When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.",
"id": "GHSA-568g-56p5-cj7r",
"modified": "2025-05-23T00:30:19Z",
"published": "2025-05-23T00:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4975"
},
{
"type": "WEB",
"url": "https://play.google.com/store/apps/details?id=com.tplink.iot\u0026hl=en_US"
},
{
"type": "WEB",
"url": "https://www.tp-link.com/us/support/faq/4464"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.