CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2020-13303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-09-15T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private repository within a public project.",
  "id": "GHSA-jqf5-5c3v-wj97",
  "modified": "2022-05-24T17:28:16Z",
  "published": "2022-05-24T17:28:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13303"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/962231"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13303.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/238887"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.2.22"
            },
            {
              "last_affected": "2026.2.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T13:55:52Z",
    "nvd_published_at": "2026-03-19T02:16:05Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-gw85-xp4q-5gp9. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions 2026.2.22 and 2026.2.23 contain an authorization bypass vulnerability in the synology-chat channel plugin where dmPolicy set to allowlist with empty allowedUserIds fails open. Attackers with Synology sender access can bypass authorization checks and trigger unauthorized agent dispatch and downstream tool actions.",
  "id": "GHSA-jqpf-vj28-9v7r",
  "modified": "2026-03-20T13:55:52Z",
  "published": "2026-03-19T03:30:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-gw85-xp4q-5gp9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31998"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/7655c0cb3a47d0647cbbf5284e177f90b4b82ddb"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-in-synology-chat-plugin-via-empty-alloweduserids"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch",
  "withdrawn": "2026-03-20T13:55:52Z"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1110"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1220",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-22T14:16:02Z",
    "severity": "LOW"
  },
  "details": "An issue has been discovered in GitLab CE/EE affecting all versions from 18.0 before 18.0.1. In certain circumstances, a user with limited permissions could access Job Data via a crafted GraphQL query.",
  "id": "GHSA-jqqw-x8w5-v4hh",
  "modified": "2025-05-22T15:34:50Z",
  "published": "2025-05-22T15:34:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1110"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2972576"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/517693"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-39903"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-08T16:15:00Z",
    "severity": "LOW"
  },
  "details": "Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number.",
  "id": "GHSA-jqxp-vjx4-h9pv",
  "modified": "2022-12-12T18:30:29Z",
  "published": "2022-12-08T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39903"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=12"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-34046"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-20T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].",
  "id": "GHSA-jr5r-25mv-wfhm",
  "modified": "2022-07-28T00:00:41Z",
  "published": "2022-07-21T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34046"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sulu/sulu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sulu/sulu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.0-alpha1"
            },
            {
              "fixed": "2.5.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-27915"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-04T20:45:08Z",
    "nvd_published_at": "2024-03-06T20:15:47Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\n_What kind of vulnerability is it? Who is impacted?_\n\nAccess to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue.\n\n### Patches\n\nHas the problem been patched? What versions should users upgrade to?\n\nThe problem is patched with Version `2.4.17` and `2.5.13`.\n\n### Workarounds\n\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nRemove  following lines from `vendor/symfony/security-http/HttpUtils.php`:\n\n```\n-            // Shortcut if request has already been matched before\n-            if ($request-\u003eattributes-\u003ehas(\u0027_route\u0027)) {\n-                return $path === $request-\u003eattributes-\u003eget(\u0027_route\u0027);\n -           }\n```\n\nOr do not install `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`.\n\n### References\n\n_Are there any links users can visit to find out more?_\n\nCurrently no references.\n",
  "id": "GHSA-jr83-m233-gg6p",
  "modified": "2024-03-06T21:37:49Z",
  "published": "2024-03-04T20:45:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sulu/sulu/security/advisories/GHSA-jr83-m233-gg6p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27915"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sulu/sulu/commit/ec9c3f99e15336dc4f6877f512300f231c17c6da"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sulu/sulu"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sulu grants access to pages regardless of role permissions"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-29213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-18T23:15:03Z",
    "severity": "HIGH"
  },
  "details": "Ivanti DSM \u003c version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.",
  "id": "GHSA-jr8x-r7fp-7rp4",
  "modified": "2024-10-19T00:31:54Z",
  "published": "2024-10-19T00:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29213"
    },
    {
      "type": "WEB",
      "url": "https://forums.ivanti.com/s/article/SA-2024-07-12-CVE-2024-29213"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "thorsten/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.1"
            },
            {
              "fixed": "4.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.1"
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmyfaq/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.1"
            },
            {
              "fixed": "4.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.1.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45009"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T20:37:42Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA review of `phpMyFAQ-main` uncovered an authorization issue in the `admin-api` routes.\n\nSeveral backend endpoints only check whether the caller is logged in. They do not verify that the caller actually has backend or administrative privileges. As a result, a normal frontend user can access API endpoints that are clearly intended for administrative use.\n\nDuring local reproduction, a regular user account was able to request `/admin/api/index.php/dashboard/versions` and receive a successful response from the backend management API.\n\nThis issue does not appear to give direct write access in the affected paths that were confirmed, so it should be treated as a backend information disclosure and privilege boundary failure rather than full admin compromise.\n\n### Details\n\nThe access control split is visible in the controller base class:\n\n```php\npublic function userIsAuthenticated(): void\n{\n    if (!$this-\u003ecurrentUser-\u003eisLoggedIn()) {\n        throw new UnauthorizedHttpException(\u0027Unauthorized access.\u0027);\n    }\n}\n\nprotected function userHasPermission(PermissionType $permissionType): void\n{\n    // permission-based check\n}\n```\n\nThe problem is that several `Administration\\Api` controllers use the weaker check even though the routes sit under the backend API namespace.\n\nFor example, `phpmyfaq/src/phpMyFAQ/Controller/Administration/Api/DashboardController.php` exposes:\n\n```php\n#[Route(path: \u0027dashboard/versions\u0027, name: \u0027admin.api.dashboard.versions\u0027, methods: [\u0027GET\u0027])]\npublic function versions(): JsonResponse\n{\n    $this-\u003euserIsAuthenticated();\n    ...\n}\n```\n\nThe same pattern appears in other backend-facing controllers, including:\n\n- `LdapController`\n- `ElasticsearchController`\n- `OpenSearchController`\n- `UpdateController`\n\nThat matters because these endpoints are not part of the normal frontend feature set. They expose backend operational data such as version checks, upgrade state, LDAP configuration, health checks, and search backend status.\n\nThree examples that stand out from an impact perspective are:\n\n1. `GET /admin/api/index.php/ldap/configuration`\n\n   This can expose LDAP server configuration, mapping settings, group settings, and general authentication-related options. Even with secrets masked, this is still useful internal infrastructure information.\n\n2. `GET /admin/api/index.php/elasticsearch/statistics`\n\n   If Elasticsearch is enabled, this can expose index names and search backend statistics that should normally stay in the admin area.\n\n3. `GET /admin/api/index.php/health-check`\n\n   This is part of the update and maintenance workflow and can reveal operational state that ordinary users should not be able to inspect.\n\nIn other words, the issue is not that guests can reach the backend. The issue is that any ordinary authenticated user can cross the frontend/backend privilege boundary.\n\n### PoC\n\nI reproduced this against a local Docker deployment of the project.\n\nFirst, an unauthenticated request to the backend API is rejected:\n\n```http\nGET /admin/api/index.php/dashboard/versions HTTP/1.1\nHost: 127.0.0.1\nAccept: application/json\n```\n\nResponse:\n\n```http\nHTTP/1.0 401 Unauthorized\nContent-Type: application/problem+json\n\n{\n  \"type\": \"http://127.0.0.1/problems/unauthorized\",\n  \"title\": \"Unauthorized\",\n  \"status\": 401,\n  \"detail\": \"Unauthorized access.\",\n  \"instance\": \"/dashboard/versions\"\n}\n```\n\nLogged in with a normal frontend account:\n\n- username: `user1`\n- password: `User12345!`\n\nAfter login, the same request was sent with the user session cookie:\n\n```http\nGET /admin/api/index.php/dashboard/versions HTTP/1.1\nHost: 127.0.0.1\nCookie: PHPSESSID=\u003cregular-user-session\u003e\nAccept: application/json\n```\n\nResponse:\n\n```http\nHTTP/1.0 200 OK\nContent-Type: application/json\n\n{\"success\":\"Latest version available: phpMyFAQ 4.1.1\"}\n```\n\nThat is enough to show that a non-admin account can call at least one backend management endpoint successfully.\n\n### Impact\n\nThe main impact is unauthorized access to backend-only operational information.\n\nDepending on which optional features are enabled in a real deployment, this may let a normal user learn:\n\n- upgrade and version status\n- maintenance or health-check information\n- LDAP environment details\n- Elasticsearch or OpenSearch backend status and statistics\n- internal administrative diagnostics\n\nThis was rated as **Medium** severity.\n\nIt was not categorized as **High** severity because the testing done did not confirm a direct administrative state change through the affected read-oriented endpoints. Still, this is a real privilege separation failure. A frontend account should not be able to query backend admin APIs simply because it has a valid session.\n\n### Remediation\n\nThe suggested approach should fix this in two layers.\n\n1. Replace `userIsAuthenticated()` with explicit permission checks on backend endpoints that are intended for administrators only.\n2. Review all `Administration\\Api` controllers for similar cases and make the access model consistent.\n3. Keep backend operational endpoints separated from ordinary user sessions unless there is a strong business reason to expose them.\n4. Add regression tests that log in as a low-privileged user and verify that backend routes return `403` or `401` where appropriate.",
  "id": "GHSA-jrc5-w569-h7h5",
  "modified": "2026-06-09T00:01:48Z",
  "published": "2026-05-06T20:37:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-jrc5-w569-h7h5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45009"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thorsten/phpMyFAQ"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/phpmyfaq-insufficient-authorization-check-in-admin-api-endpoints"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpMyFAQ: Ordinary Authenticated User Can Access Admin-Only API Endpoints Due to Insufficient Authorization Check in phpMyFAQ"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22244"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-25T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data",
  "id": "GHSA-jrrv-jm33-8jrv",
  "modified": "2022-05-24T19:12:10Z",
  "published": "2022-05-24T19:12:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22244"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1047140"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22244.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/299039"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-20864"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-19T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in Mattermost Plugins before 5.13.0. The GitHub plugin allows an attacker to attach his Mattermost account to a different person\u0027s GitHub account.",
  "id": "GHSA-jrx5-rpf5-27w3",
  "modified": "2022-05-24T17:21:12Z",
  "published": "2022-05-24T17:21:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20864"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}