Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5641 vulnerabilities reference this CWE, most recent first.
GHSA-9H55-298F-39QV
Vulnerability from github – Published: 2024-08-22 03:31 – Updated: 2024-08-22 03:31
VLAI
Details
The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn't be accessible to them.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-7836"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T03:15:04Z",
"severity": "MODERATE"
},
"details": "The Themify Builder plugin for WordPress is vulnerable to unauthorized post duplication due to missing checks on the duplicate_page_ajaxify function in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate and view private or draft posts created by other users that otherwise shouldn\u0027t be accessible to them.",
"id": "GHSA-9h55-298f-39qv",
"modified": "2024-08-22T03:31:34Z",
"published": "2024-08-22T03:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7836"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/themify-builder/tags/7.6.1/classes/class-builder-duplicate-page.php#L41"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31dfc46c-a673-41f1-b701-aa832f004ebc?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9H5H-VQJ6-GF88
Vulnerability from github – Published: 2023-10-12 06:30 – Updated: 2024-04-04 08:35
VLAI
Details
There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-40829"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-12T05:15:46Z",
"severity": "HIGH"
},
"details": "There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000.",
"id": "GHSA-9h5h-vqj6-gf88",
"modified": "2024-04-04T08:35:07Z",
"published": "2023-10-12T06:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40829"
},
{
"type": "WEB",
"url": "https://gist.github.com/wwwziziyu/85bdf8d56b415974c4827a5668f493e9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9H63-7QF6-MV6R
Vulnerability from github – Published: 2021-05-18 18:33 – Updated: 2021-05-07 22:01
VLAI
Summary
Improper Authorization in github.com/containers/libpod
Details
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Severity
7.0 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/libpod"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-20188"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T22:01:02Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
"id": "GHSA-9h63-7qf6-mv6r",
"modified": "2021-05-07T22:01:02Z",
"published": "2021-05-18T18:33:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20188"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/commit/2c7b579fe7328dc6db48bdaf60d0ddd9136b1e24"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/commit/c8bd4746151e6ae37d49c4688f2f64e03db429fc"
},
{
"type": "WEB",
"url": "https://github.com/containers/podman/commit/dcf3c742b1ac4d641d66810113f3d17441a412f4"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1915734"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Authorization in github.com/containers/libpod"
}
GHSA-9H64-2846-7X7F
Vulnerability from github – Published: 2026-05-06 23:13 – Updated: 2026-05-06 23:13
VLAI
Summary
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
Details
Summary
Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-tenant isolation, access-control, and policy-enforcement defects in the AxonFlow platform. They are filed as a single consolidated advisory because the recommended remediation is a single platform upgrade.
Affected versions
< 7.5.0. Specific items affect different earlier minors; see Impact below.
Patched versions
>= 7.5.0.
Impact
| # | Item | Affected | Patched | CWE |
|---|---|---|---|---|
| 1 | MAP execution multi-tenant isolation. A body-supplied org_id could override the Basic-auth-derived org for both execution recording and policy evaluation. In multi-tenant deployments with shared agents, this could record one tenant's request under another tenant's audit log and evaluate it under the wrong tenant's policy set. |
< 7.4.5 |
>= 7.4.5 |
CWE-863 |
| 2 | Cross-tenant audit-log leak via evidence/explain handlers. The handlers behind /api/v1/evidence/* and /api/v1/decisions/*/explain failed open when the tenant context was missing, returning data scoped to a different tenant or returning data without scope. |
< 7.2.0 |
>= 7.2.0 |
CWE-200, CWE-863 |
| 3 | License-validation bypass on onboard-customer. The portal customer-onboard endpoint lacked authentication and license-key validation, allowing unauthenticated callers to invoke the onboard flow. |
< 7.2.0 |
>= 7.2.0 |
CWE-862 |
| 4 | Tenant-scope fail-open on evidence/explain. Distinct from item 2: when tenant headers were absent, the handler defaulted to a permissive read scope rather than refusing the request. | < 7.2.0 |
>= 7.2.0 |
CWE-862 |
| 5 | Internal-service auth fallback bypass in non-Community modes. Evaluation/Enterprise builds carried an auth fallback path that, under specific request shapes, could be exploited to bypass apiAuthMiddleware. |
< 7.2.0 |
>= 7.2.0 |
CWE-863 |
| 6 | Login timing / org-existence disclosure on the portal. The login handler returned different timing and response bodies for invalid-org vs invalid-password, allowing org enumeration. | < 7.1.3 |
>= 7.1.3 |
CWE-208 |
| 7 | Portal DoS via unbounded request body. The portal accepted unbounded request bodies, allowing memory-exhaustion attacks. Capped at 1 MiB. | < 7.1.5 |
>= 7.1.5 |
CWE-770 |
| 8 | SQL-injection enforcement regression on try.getaxonflow.com. The Community SaaS hosted endpoint inherited the warn SQLi default introduced in v6.2.0, allowing SQL-injection-shaped requests to pass governance to the LLM. Self-hosted deployments were unaffected unless they manually changed the default. |
< 7.5.0 (try.getaxonflow.com only) |
>= 7.5.0 |
CWE-89 |
Remediation
Upgrade to AxonFlow platform v7.5.0 or later. No configuration changes required — the platform is purely additive and existing API/SDK callers continue to work.
For users who can't upgrade immediately, item-specific mitigations:
- Items 1–5: ensure the agent middleware sets
X-Org-ID/X-Tenant-IDfrom authenticated identity at the ingress, never accepting body-supplied identity. - Item 8 (Community SaaS):
SQLI_ACTION=blockcan be set explicitly via the agent task definition; v7.5.0 makes this the default.
Resources
- AxonFlow v7.5.0 CHANGELOG entry: https://github.com/getaxonflow/axonflow/blob/main/CHANGELOG.md
- AxonFlow v7.5.0 GitHub Release: https://github.com/getaxonflow/axonflow/releases/tag/v7.5.0
Credit
Identified by AxonFlow internal security review during the April 2026 quality-freeze epic.
Severity
9.1 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/getaxonflow/axonflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-208",
"CWE-770",
"CWE-862",
"CWE-863",
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T23:13:27Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Summary\n\nEight independently-filed bug fixes in the v7.1.3 \u2192 v7.5.0 release window collectively close a set of multi-tenant isolation, access-control, and policy-enforcement defects in the AxonFlow platform. They are filed as a single consolidated advisory because the recommended remediation is a single platform upgrade.\n\n## Affected versions\n\n`\u003c 7.5.0`. Specific items affect different earlier minors; see Impact below.\n\n## Patched versions\n\n`\u003e= 7.5.0`.\n\n## Impact\n\n| # | Item | Affected | Patched | CWE |\n|---|---|---|---|---|\n| 1 | **MAP execution multi-tenant isolation.** A body-supplied `org_id` could override the Basic-auth-derived org for both execution recording and policy evaluation. In multi-tenant deployments with shared agents, this could record one tenant\u0027s request under another tenant\u0027s audit log and evaluate it under the wrong tenant\u0027s policy set. | `\u003c 7.4.5` | `\u003e= 7.4.5` | CWE-863 |\n| 2 | **Cross-tenant audit-log leak via evidence/explain handlers.** The handlers behind `/api/v1/evidence/*` and `/api/v1/decisions/*/explain` failed open when the tenant context was missing, returning data scoped to a different tenant or returning data without scope. | `\u003c 7.2.0` | `\u003e= 7.2.0` | CWE-200, CWE-863 |\n| 3 | **License-validation bypass on `onboard-customer`.** The portal customer-onboard endpoint lacked authentication and license-key validation, allowing unauthenticated callers to invoke the onboard flow. | `\u003c 7.2.0` | `\u003e= 7.2.0` | CWE-862 |\n| 4 | **Tenant-scope fail-open on evidence/explain.** Distinct from item 2: when tenant headers were absent, the handler defaulted to a permissive read scope rather than refusing the request. | `\u003c 7.2.0` | `\u003e= 7.2.0` | CWE-862 |\n| 5 | **Internal-service auth fallback bypass in non-Community modes.** Evaluation/Enterprise builds carried an auth fallback path that, under specific request shapes, could be exploited to bypass `apiAuthMiddleware`. | `\u003c 7.2.0` | `\u003e= 7.2.0` | CWE-863 |\n| 6 | **Login timing / org-existence disclosure on the portal.** The login handler returned different timing and response bodies for invalid-org vs invalid-password, allowing org enumeration. | `\u003c 7.1.3` | `\u003e= 7.1.3` | CWE-208 |\n| 7 | **Portal DoS via unbounded request body.** The portal accepted unbounded request bodies, allowing memory-exhaustion attacks. Capped at 1 MiB. | `\u003c 7.1.5` | `\u003e= 7.1.5` | CWE-770 |\n| 8 | **SQL-injection enforcement regression on `try.getaxonflow.com`.** The Community SaaS hosted endpoint inherited the `warn` SQLi default introduced in v6.2.0, allowing SQL-injection-shaped requests to pass governance to the LLM. Self-hosted deployments were unaffected unless they manually changed the default. | `\u003c 7.5.0` (try.getaxonflow.com only) | `\u003e= 7.5.0` | CWE-89 |\n\n## Remediation\n\nUpgrade to AxonFlow platform **v7.5.0** or later. No configuration changes required \u2014 the platform is purely additive and existing API/SDK callers continue to work.\n\nFor users who can\u0027t upgrade immediately, item-specific mitigations:\n\n- **Items 1\u20135:** ensure the agent middleware sets `X-Org-ID` / `X-Tenant-ID` from authenticated identity at the ingress, never accepting body-supplied identity.\n- **Item 8 (Community SaaS):** `SQLI_ACTION=block` can be set explicitly via the agent task definition; v7.5.0 makes this the default.\n\n## Resources\n\n- AxonFlow v7.5.0 CHANGELOG entry: https://github.com/getaxonflow/axonflow/blob/main/CHANGELOG.md\n- AxonFlow v7.5.0 GitHub Release: https://github.com/getaxonflow/axonflow/releases/tag/v7.5.0\n\n## Credit\n\nIdentified by AxonFlow internal security review during the April 2026 quality-freeze epic.",
"id": "GHSA-9h64-2846-7x7f",
"modified": "2026-05-06T23:13:27Z",
"published": "2026-05-06T23:13:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getaxonflow/axonflow/security/advisories/GHSA-9h64-2846-7x7f"
},
{
"type": "PACKAGE",
"url": "https://github.com/getaxonflow/axonflow"
},
{
"type": "WEB",
"url": "https://github.com/getaxonflow/axonflow/blob/main/CHANGELOG.md"
},
{
"type": "WEB",
"url": "https://github.com/getaxonflow/axonflow/releases/tag/v7.5.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening"
}
GHSA-9H73-WM82-W5XF
Vulnerability from github – Published: 2023-01-31 18:30 – Updated: 2023-02-08 21:30
VLAI
Details
An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected by flaws in authorization logic, through which a malicious user (with no privileges) is able to perform privilege escalation to the administrator role, and steal the accounts of any users on the system.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-45172"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-31T18:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected by flaws in authorization logic, through which a malicious user (with no privileges) is able to perform privilege escalation to the administrator role, and steal the accounts of any users on the system.",
"id": "GHSA-9h73-wm82-w5xf",
"modified": "2023-02-08T21:30:21Z",
"published": "2023-01-31T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45172"
},
{
"type": "WEB",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9HFW-W3F4-C4P8
Vulnerability from github – Published: 2026-06-04 06:30 – Updated: 2026-07-14 19:45
VLAI
Summary
OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed
Details
OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
Severity
9.9 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mistral"
},
"ranges": [
{
"events": [
{
"introduced": "20.0.0"
},
{
"fixed": "20.1.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "mistral"
},
"versions": [
"21.0.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "mistral"
},
"versions": [
"22.0.0"
]
}
],
"aliases": [
"CVE-2026-41283"
],
"database_specific": {
"cwe_ids": [
"CWE-749",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-14T19:45:28Z",
"nvd_published_at": "2026-06-04T04:17:12Z",
"severity": "CRITICAL"
},
"details": "OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.",
"id": "GHSA-9hfw-w3f4-c4p8",
"modified": "2026-07-14T19:45:28Z",
"published": "2026-06-04T06:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41283"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-41283"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484607"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/mistral"
},
{
"type": "WEB",
"url": "https://github.com/openstack/mistral/tags"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41283.json"
},
{
"type": "WEB",
"url": "https://security.openstack.org/ossa/OSSA-2026-020.html"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2026/06/03/14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/03/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed"
}
GHSA-9HHF-XMCW-R3XG
Vulnerability from github – Published: 2024-02-05 20:21 – Updated: 2024-02-05 23:05
VLAI
Summary
phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes
Details
Summary
The 'sharing FAQ' functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets.
Details
The phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. The application will then send these 5 emails. However, there are no controls over what link and content are shared. Furthermore, any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once.
PoC
We send the following form and capture the request.
We now change the body to contain 50 email addresses instead of just 1, and send the request. The attacker can also change the body of the email to any phishing message.
Below are the logs of the email server, proving that all these emails were sent.
An attacker can also change the link that is sent in these emails. Making phishing even more possible.
Impact
An attacker can utilize the target application's email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputational damages.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyfaq/phpmyfaq"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-22208"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-05T20:21:25Z",
"nvd_published_at": "2024-02-05T21:15:11Z",
"severity": "MODERATE"
},
"details": "### Summary\nThe \u0027sharing FAQ\u0027 functionality allows any unauthenticated actor to misuse the phpMyFAQ application to send arbitrary emails to a large range of targets.\n\n### Details\nThe phpMyFAQ application has a functionality where anyone can share a FAQ item to others. The front-end of this functionality allows any phpMyFAQ articles to be shared with 5 email addresses. The application will then send these 5 emails. However, there are no controls over what link and content are shared. Furthermore, any unauthenticated actor can perform this action. There is a CAPTCHA in place, however the amount of people you email with a single request is not limited to 5 by the backend. An attacker can thus solve a single CAPTCHA and send thousands of emails at once. \n\n### PoC\nWe send the following form and capture the request.\n\n\nWe now change the body to contain 50 email addresses instead of just 1, and send the request. The attacker can also change the body of the email to any phishing message.\n\n\nBelow are the logs of the email server, proving that all these emails were sent.\n\n\nAn attacker can also change the link that is sent in these emails. Making phishing even more possible.\n\n\n### Impact\nAn attacker can utilize the target application\u0027s email server to send phishing messages. This can get the server on a blacklist, causing all emails to end up in spam. It can also lead to reputational damages.\n",
"id": "GHSA-9hhf-xmcw-r3xg",
"modified": "2024-02-05T23:05:22Z",
"published": "2024-02-05T20:21:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9hhf-xmcw-r3xg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22208"
},
{
"type": "WEB",
"url": "https://github.com/thorsten/phpMyFAQ/commit/a34d94ab7b1be9256a9ef898f18ea6bfb63f6f1e"
},
{
"type": "PACKAGE",
"url": "https://github.com/thorsten/phpMyFAQ"
},
{
"type": "WEB",
"url": "https://www.phpmyfaq.de/security/advisory-2024-02-05"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes"
}
GHSA-9HJH-FR4F-GXC4
Vulnerability from github – Published: 2026-03-27 22:29 – Updated: 2026-04-10 17:28
VLAI
Summary
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
Details
Summary
Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
Affected Packages / Versions
- Package:
openclaw - Affected versions:
<= 2026.3.24 - First patched version:
2026.3.25 - Latest published npm version at verification time:
2026.3.24
Details
Backend-labeled reconnects could previously self-request broader scopes and bypass pairing, allowing non-admin operators to reconnect as operator.admin. Commit d3d8e316bd819d3c7e34253aeb7eccb2510f5f48 removes the backend self-pairing skip and requires pairing when requested scopes exceed the approved baseline.
Verified vulnerable on tag v2026.3.24 and fixed on main by commit d3d8e316bd819d3c7e34253aeb7eccb2510f5f48.
Fix Commit(s)
d3d8e316bd819d3c7e34253aeb7eccb2510f5f48
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2026.3.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35663"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-27T22:29:12Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "## Summary\n\nGateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `\u003c= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nBackend-labeled reconnects could previously self-request broader scopes and bypass pairing, allowing non-admin operators to reconnect as `operator.admin`. Commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48` removes the backend self-pairing skip and requires pairing when requested scopes exceed the approved baseline.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`.\n\n## Fix Commit(s)\n\n- `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`",
"id": "GHSA-9hjh-fr4f-gxc4",
"modified": "2026-04-10T17:28:06Z",
"published": "2026-03-27T22:29:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-9hjh-fr4f-gxc4"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/d3d8e316bd819d3c7e34253aeb7eccb2510f5f48"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin"
}
GHSA-9HMJ-M2Q2-X92G
Vulnerability from github – Published: 2021-12-31 00:00 – Updated: 2022-07-13 00:01
VLAI
Details
Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2021-45379"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-30T18:15:00Z",
"severity": "HIGH"
},
"details": "Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password.",
"id": "GHSA-9hmj-m2q2-x92g",
"modified": "2022-07-13T00:01:50Z",
"published": "2021-12-31T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45379"
},
{
"type": "WEB",
"url": "https://github.com/babelouest/glewlwyd/commit/125281f1c0d4b6a8b49f7e55a757205a2ef01fbe"
},
{
"type": "WEB",
"url": "https://github.com/babelouest/glewlwyd/releases/tag/v2.6.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9HW9-785H-9RMW
Vulnerability from github – Published: 2023-06-16 21:30 – Updated: 2024-04-04 04:55
VLAI
Details
An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating system (OS) resources.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-25185"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-16T19:15:14Z",
"severity": "HIGH"
},
"details": "An issue was discovered on NOKIA Airscale ASIKA Single RAN devices before 21B. A mobile network solution internal fault was found in Nokia Single RAN software releases. Certain software processes in the BTS internal software design have unnecessarily high privileges to BTS embedded operating system (OS) resources.",
"id": "GHSA-9hw9-785h-9rmw",
"modified": "2024-04-04T04:55:13Z",
"published": "2023-06-16T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25185"
},
{
"type": "WEB",
"url": "https://Nokia.com"
},
{
"type": "WEB",
"url": "https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/cve-2023-25185"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.