CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6714 vulnerabilities reference this CWE, most recent first.
GHSA-52FH-662W-2PG3
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-07-13 00:01Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, which would result in limited denial of service.
{
"affected": [],
"aliases": [
"CVE-2021-34396"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-22T22:15:00Z",
"severity": "LOW"
},
"details": "Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, which would result in limited denial of service.",
"id": "GHSA-52fh-662w-2pg3",
"modified": "2022-07-13T00:01:26Z",
"published": "2022-05-24T19:06:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34396"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5205"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-52FW-7FW2-FMV5
Vulnerability from github – Published: 2026-06-23 22:12 – Updated: 2026-07-20 21:22Impact
A user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser — for example assets.view, assets.create, reports.view, import, etc.
Patches
Patched in https://github.com/grokability/snipe-it/pull/19024
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48493"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T22:12:11Z",
"nvd_published_at": "2026-06-23T23:16:49Z",
"severity": "MODERATE"
},
"details": "### Impact\nA user with only users.edit AND api permissions can send a PATCH to /api/v1/users/{their_own_id} and grant themselves any permission except admin and superuser \u2014 for example `assets.view`, `assets.create`, `reports.view`, import, etc.\n\n### Patches\nPatched in https://github.com/grokability/snipe-it/pull/19024",
"id": "GHSA-52fw-7fw2-fmv5",
"modified": "2026-07-20T21:22:29Z",
"published": "2026-06-23T22:12:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-52fw-7fw2-fmv5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48493"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/pull/19024"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Snipe-IT Vulnerable to Privilege Escalation for self via API Permissions Assignment"
}
GHSA-52GF-6RPQ-FGMX
Vulnerability from github – Published: 2026-09-02 23:44 – Updated: 2026-09-02 23:44Summary
The OpenChoreo API server (openchoreo-api) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the authorization engine decided purely from the caller-supplied resource hierarchy — the component's real owning project was never checked. As a result, an authenticated user who holds a project-scoped exec or log-viewing grant on any single project could run commands in, and read the wirelogs of, components owned by other projects in the same namespace.
Impact
An authenticated tenant holding a project-scoped component:exec grant on just one project can execute arbitrary commands — including an interactive shell — inside the running pods of components owned by any other project in the same namespace. This exposes those workloads' environment variables and mounted Secrets (such as database credentials, API keys, and tokens), allows tampering with the workload, and enables further pivoting using the workload's own network position and credentials. The same flaw in the wirelogs endpoint lets a project-scoped wirelogs:view grant read any component's wirelogs in the namespace.
The blast radius is every component in the namespace, reachable from a single legitimate project grant. The boundary crossed is project-within-namespace: the request still pins the namespace, so the issue does not cross namespace boundaries. In effect this is a cross-project (cross-team) remote command-execution and data-access primitive available to any low-privileged tenant.
Patches
Fixed in 1.2.3 and 1.1.6. The fix aligns the exec and wirelogs endpoints with the pattern already used by other first-class component operations: the target component is fetched first and authorization is evaluated against its real owning project (comp.Spec.Owner.ProjectName) instead of the caller-supplied project query parameter.
Workarounds
If you cannot upgrade immediately:
- Restrict
component:execandwirelogs:viewgrants to trusted operators only. Any holder of such a grant on any project can reach every component in the same namespace. - Where stronger isolation is required, separate sensitive components into their own namespaces, since the flaw does not cross namespace boundaries.
Related advisories
GHSA-rh53-xvx2-j327— the cluster-gateway internal proxy applies no caller authorization, so this API-layer authorization bypass reaches the data-plane Kubernetes API with no compensating control: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327GHSA-c5f6-2rm9-2w8g— reported together as part of the same review.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/openchoreo/openchoreo"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0-m.1"
},
{
"fixed": "1.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/openchoreo/openchoreo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73841"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T23:44:51Z",
"nvd_published_at": "2026-08-13T22:17:28Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe OpenChoreo API server (`openchoreo-api`) authorized requests to its exec and wirelogs endpoints against the project supplied by the caller in the request, rather than against the project that actually owns the target component. The target component was resolved by name only, and the authorization engine decided purely from the caller-supplied resource hierarchy \u2014 the component\u0027s real owning project was never checked. As a result, an authenticated user who holds a project-scoped exec or log-viewing grant on any single project could run commands in, and read the wirelogs of, components owned by other projects in the same namespace.\n\n### Impact\n\nAn authenticated tenant holding a project-scoped `component:exec` grant on just one project can execute arbitrary commands \u2014 including an interactive shell \u2014 inside the running pods of components owned by any other project in the same namespace. This exposes those workloads\u0027 environment variables and mounted Secrets (such as database credentials, API keys, and tokens), allows tampering with the workload, and enables further pivoting using the workload\u0027s own network position and credentials. The same flaw in the wirelogs endpoint lets a project-scoped `wirelogs:view` grant read any component\u0027s wirelogs in the namespace.\n\nThe blast radius is every component in the namespace, reachable from a single legitimate project grant. The boundary crossed is project-within-namespace: the request still pins the namespace, so the issue does not cross namespace boundaries. In effect this is a cross-project (cross-team) remote command-execution and data-access primitive available to any low-privileged tenant.\n\n### Patches\n\nFixed in **1.2.3** and **1.1.6**. The fix aligns the exec and wirelogs endpoints with the pattern already used by other first-class component operations: the target component is fetched first and authorization is evaluated against its real owning project (`comp.Spec.Owner.ProjectName`) instead of the caller-supplied `project` query parameter.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Restrict `component:exec` and `wirelogs:view` grants to trusted operators only. Any holder of such a grant on any project can reach every component in the same namespace.\n- Where stronger isolation is required, separate sensitive components into their own namespaces, since the flaw does not cross namespace boundaries.\n\n### Related advisories\n\n- `GHSA-rh53-xvx2-j327` \u2014 the cluster-gateway internal proxy applies no caller authorization, so this API-layer authorization bypass reaches the data-plane Kubernetes API with no compensating control: https://github.com/openchoreo/openchoreo/security/advisories/GHSA-rh53-xvx2-j327\n- `GHSA-c5f6-2rm9-2w8g` \u2014 reported together as part of the same review.",
"id": "GHSA-52gf-6rpq-fgmx",
"modified": "2026-09-02T23:44:51Z",
"published": "2026-09-02T23:44:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/security/advisories/GHSA-52gf-6rpq-fgmx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73841"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/pull/4251"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/pull/4516"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/pull/4538"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/commit/4d372eaf1f07525663dcca5257062f4b051b9820"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/commit/9d77b64f747eba89247c47ebfeffec591c4cd2d8"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/commit/c9390e4fcb9953f43b07cb48197576182301593d"
},
{
"type": "PACKAGE",
"url": "https://github.com/openchoreo/openchoreo"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.1.6"
},
{
"type": "WEB",
"url": "https://github.com/openchoreo/openchoreo/releases/tag/v1.2.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints"
}
GHSA-52J8-P7R3-733M
Vulnerability from github – Published: 2022-02-12 00:00 – Updated: 2022-03-30 00:01cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.
{
"affected": [],
"aliases": [
"CVE-2022-23773"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-11T01:15:00Z",
"severity": "HIGH"
},
"details": "cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.",
"id": "GHSA-52j8-p7r3-733m",
"modified": "2022-03-30T00:01:42Z",
"published": "2022-02-12T00:00:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23773"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220225-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-52Q4-3XJC-6778
Vulnerability from github – Published: 2026-03-29 15:48 – Updated: 2026-04-18 00:48Summary
Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName
Affected Packages / Versions
- Package:
openclaw - Affected versions:
<= 2026.3.24 - First patched version:
2026.3.25 - Latest published npm version at verification time:
2026.3.24
Details
Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit 11ea1f67863d88b6cbcb229dd368a45e07094bff requires stable group IDs for access decisions.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit 11ea1f67863d88b6cbcb229dd368a45e07094bff.
Fix Commit(s)
11ea1f67863d88b6cbcb229dd368a45e07094bff
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.24"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.28"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35617"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-807",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-29T15:48:15Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "## Summary\n\nGoogle Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `\u003c= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nGoogle Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit `11ea1f67863d88b6cbcb229dd368a45e07094bff` requires stable group IDs for access decisions.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `11ea1f67863d88b6cbcb229dd368a45e07094bff`.\n\n## Fix Commit(s)\n\n- `11ea1f67863d88b6cbcb229dd368a45e07094bff`",
"id": "GHSA-52q4-3xjc-6778",
"modified": "2026-04-18T00:48:38Z",
"published": "2026-03-29T15:48:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-52q4-3xjc-6778"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35617"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/11ea1f67863d88b6cbcb229dd368a45e07094bff"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-group-policy-rebinding-with-mutable-space-displayname"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName"
}
GHSA-52QH-2823-96FV
Vulnerability from github – Published: 2023-03-24 21:30 – Updated: 2023-03-30 03:30In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-184847040
{
"affected": [],
"aliases": [
"CVE-2023-21035"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-24T20:15:00Z",
"severity": "HIGH"
},
"details": "In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-184847040",
"id": "GHSA-52qh-2823-96fv",
"modified": "2023-03-30T03:30:38Z",
"published": "2023-03-24T21:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21035"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2023-03-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-52W5-6RQQ-MWQ5
Vulnerability from github – Published: 2023-01-26 21:30 – Updated: 2023-02-01 18:30An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .
{
"affected": [],
"aliases": [
"CVE-2022-3740"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-26T21:15:00Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys .",
"id": "GHSA-52w5-6rqq-mwq5",
"modified": "2023-02-01T18:30:24Z",
"published": "2023-01-26T21:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3740"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1602904"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3740.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/368416"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-533R-F5FC-H9GV
Vulnerability from github – Published: 2022-05-13 01:21 – Updated: 2022-05-13 01:21In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, with System privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android-9.0 Android ID: A-110107376.
{
"affected": [],
"aliases": [
"CVE-2018-9488"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-06T17:29:00Z",
"severity": "HIGH"
},
"details": "In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, with System privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android-9.0 Android ID: A-110107376.",
"id": "GHSA-533r-f5fc-h9gv",
"modified": "2022-05-13T01:21:06Z",
"published": "2022-05-13T01:21:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9488"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2018-09-01"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/45379"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-534W-2VM4-89XR
Vulnerability from github – Published: 2026-03-03 23:18 – Updated: 2026-03-03 23:18A missing group-sender authorization check in the Zalo plugin allowed unauthorized GROUP messages to enter agent dispatch paths in configurations intended to restrict group traffic.
Impact
When Zalo group handling was configured with allowlist-style controls, a sender not present in the intended group allowlist could still trigger agent processing through the GROUP message path.
Root Cause
Group access checks were not consistently enforced before dispatch for Zalo GROUP messages. The fix adds explicit runtime group-policy evaluation (groupPolicy, groupAllowFrom, fallback to allowFrom) and fail-closed behavior for missing provider config.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published vulnerable version:
2026.2.23(as of 2026-02-24) - Affected range:
<= 2026.2.23 - Planned patched version:
2026.2.24
Fix Commit(s)
b4010a0b627025c809c0e5dbdbd4770f3bc59ef8
OpenClaw thanks @tdjackey for reporting.
Publication Update (2026-02-25)
openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.2.23"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-03T23:18:26Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A missing group-sender authorization check in the Zalo plugin allowed unauthorized `GROUP` messages to enter agent dispatch paths in configurations intended to restrict group traffic.\n\n## Impact\nWhen Zalo group handling was configured with allowlist-style controls, a sender not present in the intended group allowlist could still trigger agent processing through the `GROUP` message path.\n\n## Root Cause\nGroup access checks were not consistently enforced before dispatch for Zalo `GROUP` messages. The fix adds explicit runtime group-policy evaluation (`groupPolicy`, `groupAllowFrom`, fallback to `allowFrom`) and fail-closed behavior for missing provider config.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published vulnerable version: `2026.2.23` (as of 2026-02-24)\n- Affected range: `\u003c= 2026.2.23`\n- Planned patched version: `2026.2.24`\n\n## Fix Commit(s)\n- `b4010a0b627025c809c0e5dbdbd4770f3bc59ef8`\n\nOpenClaw thanks @tdjackey for reporting.\n\n### Publication Update (2026-02-25)\n`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `\u003e= 2026.2.24` as patched.",
"id": "GHSA-534w-2vm4-89xr",
"modified": "2026-03-03T23:18:26Z",
"published": "2026-03-03T23:18:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-534w-2vm4-89xr"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/b4010a0b627025c809c0e5dbdbd4770f3bc59ef8"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw\u0027s Zalo group sender allowlist bypass permits unauthorized GROUP dispatch"
}
GHSA-5372-PCFG-3593
Vulnerability from github – Published: 2025-02-19 18:32 – Updated: 2025-02-19 18:32IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0
could allow an authenticated user to modify restricted content due to incorrect authorization checks.
{
"affected": [],
"aliases": [
"CVE-2024-45081"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-19T16:15:39Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 \n\n\n\ncould allow an authenticated user to modify restricted content due to incorrect authorization checks.",
"id": "GHSA-5372-pcfg-3593",
"modified": "2025-02-19T18:32:22Z",
"published": "2025-02-19T18:32:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45081"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7183597"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.