Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6991 vulnerabilities reference this CWE, most recent first.
GHSA-FC29-RQ2P-4H73
Vulnerability from github – Published: 2023-03-06 15:30 – Updated: 2023-03-11 03:30
VLAI
Details
The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-0328"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-06T14:15:00Z",
"severity": "MODERATE"
},
"details": "The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication (such as update and delete the auth key).",
"id": "GHSA-fc29-rq2p-4h73",
"modified": "2023-03-11T03:30:13Z",
"published": "2023-03-06T15:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0328"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/3c4318a9-a3c5-409b-a52e-edd8583c3c43"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FC2H-VHWJ-9V22
Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 15:34
VLAI
Details
Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-87509"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T01:17:07Z",
"severity": "HIGH"
},
"details": "Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)",
"id": "GHSA-fc2h-vhwj-9v22",
"modified": "2026-09-09T15:34:58Z",
"published": "2026-09-09T03:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87509"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/535718578"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FC33-6W3Q-538H
Vulnerability from github – Published: 2026-08-28 17:57 – Updated: 2026-08-28 17:57
VLAI
Summary
Snipe-IT has an authorization bypass on print inventory page
Details
Impact
An authenticated user with only users.view can open another user's detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license names, purchase order/order values, accessory and consumable names, assignment notes, and purchase costs.
Attacker Model
Authenticated user with only:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json {"users.view":"1"}
The attacker does not have:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json
{
"licenses.view": "1",
"accessories.view": "1",
"consumables.view": "1",
"assets.view": "1"
}
Affected Component
-
app/Http/Controllers/Users/UsersController.php -
resources/views/users/view.blade.php -
resources/views/users/print.blade.php -
Endpoints:
-
GET /users/{user} -
GET /users/{user}/print
-
Root Cause
UsersController::show() authorizes only viewing the user, then loads inventory relationships:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ php $this->authorize('view', $user);
$user = User::with([ 'consumables', 'accessories', 'licenses', 'userloc', 'groups', ])
`resources/views/users/view.blade.php` renders those relationships without checking the corresponding module permissions. The license table renders name, purchase cost, purchase order, and order number. The accessory and consumable tables render item names, notes, and unit costs.
`UsersController::printInventory()` similarly authorizes only `view` on `User::class` and the target user, then renders `resources/views/users/print.blade.php`, which outputs assigned inventory names.
### Proof of Concept
1. Create a user with only `users.view`.
2. Create a target user with assigned license/accessory/consumable records containing recognizable test values.
3. Log in as the `users.view`-only user.
4. Confirm direct module access is denied:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http
GET /licenses
GET /accessories
GET /consumables
Observed for each:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http HTTP/1.1 403 Forbidden
1. Request the target user's page:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http
GET /users/<target-user-id> HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>
Observed:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http HTTP/1.1 200 OK
The response contained assigned inventory data from modules the attacker could not directly access, including license name, purchase order/order values, accessory name/note/cost, and consumable name/note/cost.
1. Request the print view:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http
GET /users/<target-user-id>/print HTTP/1.1
Host: <snipe-it-host>
Cookie: snipeit_session=<attacker-session>
Observed:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http HTTP/1.1 200 OK
The response contained assigned inventory names.
### Evidence
The `users.view`-only test account was confirmed to lack direct inventory permissions:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json
{
"has_users_view": true,
"has_licenses_view": false,
"has_accessories_view": false,
"has_consumables_view": false,
"has_assets_view": false
}
Direct access to /licenses, /accessories, and /consumables returned 403 Forbidden.
The same account received 200 OK from /users/<target-user-id> and the response included assigned inventory data that should have been protected by the corresponding inventory module permissions.
Negative Controls
Denied direct module responses did not include the test inventory strings. The same data was only disclosed through the user detail and user print views.
Impact
Organizations may use separate permissions to allow HR/helpdesk-style users to view people records without exposing license, accessory, or consumable inventories and cost/order metadata. This issue bypasses those module-specific permissions and leaks assigned inventory information through the user view.
Patches
Patched in 374f426f0c
Severity
4.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 8.6.0"
},
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55462"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T17:57:40Z",
"nvd_published_at": "2026-07-10T20:16:46Z",
"severity": "MODERATE"
},
"details": "### Impact\nAn authenticated user with only `users.view` can open another user\u0027s detail page and see assigned license, accessory, and consumable data even though the same account is denied direct access to the Licenses, Accessories, and Consumables modules. The leaked data includes software license names, purchase order/order values, accessory and consumable names, assignment notes, and purchase costs.\n\n### Attacker Model\n\nAuthenticated user with only:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json\n{\"users.view\":\"1\"}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe attacker does not have:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json\n{\n \"licenses.view\": \"1\",\n \"accessories.view\": \"1\",\n \"consumables.view\": \"1\",\n \"assets.view\": \"1\"\n}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n### Affected Component\n\n- `app/Http/Controllers/Users/UsersController.php`\n\n- `resources/views/users/view.blade.php`\n\n- `resources/views/users/print.blade.php`\n\n- Endpoints:\n\n - `GET /users/{user}`\n\n - `GET /users/{user}/print`\n\n### Root Cause\n\n`UsersController::show()` authorizes only viewing the user, then loads inventory relationships:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ php\n$this-\u003eauthorize(\u0027view\u0027, $user);\n\n$user = User::with([\n \u0027consumables\u0027,\n \u0027accessories\u0027,\n \u0027licenses\u0027,\n \u0027userloc\u0027,\n \u0027groups\u0027,\n])\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n`resources/views/users/view.blade.php` renders those relationships without checking the corresponding module permissions. The license table renders name, purchase cost, purchase order, and order number. The accessory and consumable tables render item names, notes, and unit costs.\n\n`UsersController::printInventory()` similarly authorizes only `view` on `User::class` and the target user, then renders `resources/views/users/print.blade.php`, which outputs assigned inventory names.\n\n### Proof of Concept\n\n1. Create a user with only `users.view`.\n\n2. Create a target user with assigned license/accessory/consumable records containing recognizable test values.\n\n3. Log in as the `users.view`-only user.\n\n4. Confirm direct module access is denied:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nGET /licenses\nGET /accessories\nGET /consumables\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nObserved for each:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nHTTP/1.1 403 Forbidden\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n1. Request the target user\u0027s page:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nGET /users/\u003ctarget-user-id\u003e HTTP/1.1\nHost: \u003csnipe-it-host\u003e\nCookie: snipeit_session=\u003cattacker-session\u003e\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nObserved:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nHTTP/1.1 200 OK\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe response contained assigned inventory data from modules the attacker could not directly access, including license name, purchase order/order values, accessory name/note/cost, and consumable name/note/cost.\n\n1. Request the print view:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nGET /users/\u003ctarget-user-id\u003e/print HTTP/1.1\nHost: \u003csnipe-it-host\u003e\nCookie: snipeit_session=\u003cattacker-session\u003e\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nObserved:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http\nHTTP/1.1 200 OK\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nThe response contained assigned inventory names.\n\n### Evidence\n\nThe `users.view`-only test account was confirmed to lack direct inventory permissions:\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ json\n{\n \"has_users_view\": true,\n \"has_licenses_view\": false,\n \"has_accessories_view\": false,\n \"has_consumables_view\": false,\n \"has_assets_view\": false\n}\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDirect access to `/licenses`, `/accessories`, and `/consumables` returned `403 Forbidden`.\n\nThe same account received `200 OK` from `/users/\u003ctarget-user-id\u003e` and the response included assigned inventory data that should have been protected by the corresponding inventory module permissions.\n\n### Negative Controls\n\nDenied direct module responses did not include the test inventory strings. The same data was only disclosed through the user detail and user print views.\n\n### Impact\n\nOrganizations may use separate permissions to allow HR/helpdesk-style users to view people records without exposing license, accessory, or consumable inventories and cost/order metadata. This issue bypasses those module-specific permissions and leaks assigned inventory information through the user view.\n\n\n### Patches\nPatched in 374f426f0c",
"id": "GHSA-fc33-6w3q-538h",
"modified": "2026-08-28T17:57:40Z",
"published": "2026-08-28T17:57:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-fc33-6w3q-538h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55462"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/commit/374f426f0c6bb7a4f129f7b85051cc1da753a0f5"
},
{
"type": "PACKAGE",
"url": "https://github.com/grokability/snipe-it"
},
{
"type": "WEB",
"url": "https://github.com/grokability/snipe-it/releases/tag/v8.6.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Snipe-IT has an authorization bypass on print inventory page"
}
GHSA-FC3Q-VG8H-QRFP
Vulnerability from github – Published: 2026-02-24 21:31 – Updated: 2026-02-25 15:31
VLAI
Details
A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devolutions Server: before 2025.3.15.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-1768"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-24T20:27:46Z",
"severity": "MODERATE"
},
"details": "A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devolutions Server: before 2025.3.15.",
"id": "GHSA-fc3q-vg8h-qrfp",
"modified": "2026-02-25T15:31:37Z",
"published": "2026-02-24T21:31:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1768"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2026-0004"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FC43-XQX9-FHVJ
Vulnerability from github – Published: 2022-03-08 00:00 – Updated: 2022-03-17 00:02
VLAI
Details
Improper Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-0756"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-07T13:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.",
"id": "GHSA-fc43-xqx9-fhvj",
"modified": "2022-03-17T00:02:51Z",
"published": "2022-03-08T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0756"
},
{
"type": "WEB",
"url": "https://github.com/salesagility/suitecrm/commit/e93b269f637de313f45b32c58cef5ec012a34f58"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/55164a63-62e4-4fb6-b4ca-87eca14f6f31"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FC67-6VC9-R6M2
Vulnerability from github – Published: 2023-06-27 00:30 – Updated: 2024-04-04 05:11
VLAI
Details
An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This is a similar, but not identical vulnerability as CVE-2023-34146 and CVE-2023-34147.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-34148"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-26T22:15:11Z",
"severity": "HIGH"
},
"details": "An exposed dangerous function vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate privileges and write an arbitrary value to specific Trend Micro agent subkeys on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThis is a similar, but not identical vulnerability as CVE-2023-34146 and CVE-2023-34147.",
"id": "GHSA-fc67-6vc9-r6m2",
"modified": "2024-04-04T05:11:38Z",
"published": "2023-06-27T00:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34148"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/dcx/s/solution/000293322?language=en_US"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-834"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FC6R-7W85-4VGG
Vulnerability from github – Published: 2025-10-03 12:33 – Updated: 2025-10-08 15:32
VLAI
Details
A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-49641"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-03T12:15:44Z",
"severity": "MODERATE"
},
"details": "A regular Zabbix user with no permission to the Monitoring -\u003e Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.",
"id": "GHSA-fc6r-7w85-4vgg",
"modified": "2025-10-08T15:32:26Z",
"published": "2025-10-03T12:33:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49641"
},
{
"type": "WEB",
"url": "https://support.zabbix.com/browse/ZBX-27063"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FC7R-9282-58JR
Vulnerability from github – Published: 2023-08-22 21:30 – Updated: 2024-04-04 07:08
VLAI
Details
In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-48538"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-22T19:16:31Z",
"severity": "MODERATE"
},
"details": "In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.",
"id": "GHSA-fc7r-9282-58jr",
"modified": "2024-04-04T07:08:16Z",
"published": "2023-08-22T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48538"
},
{
"type": "WEB",
"url": "https://github.com/Cacti/cacti/issues/5189"
},
{
"type": "WEB",
"url": "https://docs.cacti.net/Settings-Auth-LDAP.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FC7V-85Q5-FV3M
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50
VLAI
Details
Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions.
Severity
6.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-15692"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-16T18:29:00Z",
"severity": "MODERATE"
},
"details": "Inova Partner 5.0.5-RELEASE, Build 0510-0906 and earlier allows authenticated users authorization bypass and data manipulation in certain functions.",
"id": "GHSA-fc7v-85q5-fv3m",
"modified": "2022-05-13T01:50:11Z",
"published": "2022-05-13T01:50:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15692"
},
{
"type": "WEB",
"url": "https://www.kpmg.de/noindex/advisories/KPMG-2018-002.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-FCC5-5HP3-GXP7
Vulnerability from github – Published: 2026-07-22 21:32 – Updated: 2026-07-22 21:32
VLAI
Details
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-13067"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-22T20:16:44Z",
"severity": "HIGH"
},
"details": "When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.",
"id": "GHSA-fcc5-5hp3-gxp7",
"modified": "2026-07-22T21:32:06Z",
"published": "2026-07-22T21:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13067"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-128387"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.