Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7155 vulnerabilities reference this CWE, most recent first.
GHSA-H5RX-J572-XRP9
Vulnerability from github – Published: 2023-07-13 00:30 – Updated: 2024-04-04 06:05
VLAI
Details
In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-21256"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-13T00:15:24Z",
"severity": "HIGH"
},
"details": "In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.\n\n",
"id": "GHSA-h5rx-j572-xrp9",
"modified": "2024-04-04T06:05:29Z",
"published": "2023-07-13T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21256"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/62fc1d269f5e754fc8f00b6167d79c3933b4c1f4"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-07-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H5V5-8746-G7MM
Vulnerability from github – Published: 2026-07-22 23:13 – Updated: 2026-07-22 23:13
VLAI
Summary
JupyterLab PluginManager lock-rule enforcement bypass
Details
JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins.
Impact
Users could workaround the plugin manager lock rules via direct API access for either: - child plugins of extensions covering multiple plugins - when "lock all" was issued by the administrator
The integrity of data can be impacted, and any hardening or restrictions on permitted user actions (e.g. download/upload limits) within the single-user server can be circumvented if those were implemented with plugins that were locked using the faulty mechanisms.
Patches
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.
Workarounds
Manually lock all plugins that should be locked. The core plugin identifiers can be found in the documentation and identifiers for all installed extensions are listed in the Plugin Manager.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.6.1"
},
"package": {
"ecosystem": "PyPI",
"name": "jupyterlab"
},
"ranges": [
{
"events": [
{
"introduced": "4.6.0"
},
{
"fixed": "4.6.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.5.9"
},
"package": {
"ecosystem": "PyPI",
"name": "jupyterlab"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.5.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-602",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T23:13:34Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "JupyterLab\u0027s plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to `/lab/api/plugins`.\n\n### Impact\n\nUsers could workaround the plugin manager lock rules via direct API access for either:\n- child plugins of extensions covering multiple plugins\n- when \"lock all\" was issued by the administrator\n\nThe integrity of data can be impacted, and any hardening or restrictions on permitted user actions (e.g. download/upload limits) within the single-user server can be circumvented if those were implemented with plugins that were locked using the faulty mechanisms.\n\n### Patches\n\nJupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.\n\nUsers of applications that depend on JupyterLab, such as Notebook v7+, should update `jupyterlab` package too.\n\n### Workarounds\n\nManually lock all plugins that should be locked. The core plugin identifiers can be found in [the documentation](https://jupyterlab.readthedocs.io/en/latest/extension/extension_points.html#core-plugins) and identifiers for all installed extensions are listed in the [Plugin Manager](https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#managing-plugins-with-plugin-manager).",
"id": "GHSA-h5v5-8746-g7mm",
"modified": "2026-07-22T23:13:34Z",
"published": "2026-07-22T23:13:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
},
{
"type": "PACKAGE",
"url": "https://github.com/jupyterlab/jupyterlab"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "JupyterLab PluginManager lock-rule enforcement bypass"
}
GHSA-H5V9-XW2G-7HRQ
Vulnerability from github – Published: 2025-03-21 09:30 – Updated: 2025-03-21 22:37
VLAI
Summary
Mattermost allows members with permission to convert public channels to private and convert private to public
Details
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.
Severity
5.4 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.4.0"
},
{
"fixed": "10.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "9.11.0"
},
{
"fixed": "9.11.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.11.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0-20250218135018-e644e3c8e393"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-27933"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T22:37:03Z",
"nvd_published_at": "2025-03-21T09:15:13Z",
"severity": "MODERATE"
},
"details": "Mattermost versions 10.4.x \u003c= 10.4.2, 10.3.x \u003c= 10.3.3, 9.11.x \u003c= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.",
"id": "GHSA-h5v9-xw2g-7hrq",
"modified": "2025-03-21T22:37:04Z",
"published": "2025-03-21T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27933"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost allows members with permission to convert public channels to private and convert private to public"
}
GHSA-H5WH-487C-MRJG
Vulnerability from github – Published: 2022-04-23 00:40 – Updated: 2022-04-23 00:40
VLAI
Details
cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system
{
"affected": [],
"aliases": [
"CVE-2012-6094"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-20T15:15:00Z",
"severity": "MODERATE"
},
"details": "cups (Common Unix Printing System) \u0027Listen localhost:631\u0027 option not honored correctly which could provide unauthorized access to the system",
"id": "GHSA-h5wh-487c-mrjg",
"modified": "2022-04-23T00:40:25Z",
"published": "2022-04-23T00:40:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6094"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2012-6094"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6094"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2012-6094"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82451"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2012-6094"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/01/04/5"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/57158"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H66J-QWJ8-P6M9
Vulnerability from github – Published: 2024-02-02 15:30 – Updated: 2024-02-02 15:30
VLAI
Details
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-47142"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-02T14:15:54Z",
"severity": "HIGH"
},
"details": "IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization\u0027s local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267.",
"id": "GHSA-h66j-qwj8-p6m9",
"modified": "2024-02-02T15:30:28Z",
"published": "2024-02-02T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47142"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/270267"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7105139"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H67H-6HV5-VFG2
Vulnerability from github – Published: 2025-11-26 18:31 – Updated: 2025-12-02 18:30
VLAI
Details
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-55469"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-26T18:15:48Z",
"severity": "CRITICAL"
},
"details": "Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.",
"id": "GHSA-h67h-6hv5-vfg2",
"modified": "2025-12-02T18:30:29Z",
"published": "2025-11-26T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55469"
},
{
"type": "WEB",
"url": "https://gist.github.com/old6ma/d6e19c9efbe28431f4c27c063cc9cbb8"
},
{
"type": "WEB",
"url": "https://gitee.com/youlaiorg/youlai-boot"
},
{
"type": "WEB",
"url": "https://gitee.com/youlaiorg/youlai-boot/issues/ICFCOK"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H68G-FQF5-WF74
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2022-05-24 17:19
VLAI
Details
Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc.
{
"affected": [],
"aliases": [
"CVE-2020-11680"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-04T19:15:00Z",
"severity": "MODERATE"
},
"details": "Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc.",
"id": "GHSA-h68g-fqf5-wf74",
"modified": "2022-05-24T17:19:16Z",
"published": "2022-05-24T17:19:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11680"
},
{
"type": "WEB",
"url": "https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Jun/8"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H699-694R-9XXF
Vulnerability from github – Published: 2026-09-02 15:34 – Updated: 2026-09-02 15:34
VLAI
Details
Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-78609"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T15:17:41Z",
"severity": "MODERATE"
},
"details": "Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in the Elasticsearch client trust bundle managed by ECK in a separate namespace.",
"id": "GHSA-h699-694r-9xxf",
"modified": "2026-09-02T15:34:50Z",
"published": "2026-09-02T15:34:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78609"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-H69V-MVH9-HFRQ
Vulnerability from github – Published: 2023-09-29 12:30 – Updated: 2023-10-03 21:16
VLAI
Summary
Mattermost Incorrect Authorization vulnerability
Details
Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.1.0"
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.8.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-5194"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-29T22:05:48Z",
"nvd_published_at": "2023-09-29T10:15:10Z",
"severity": "MODERATE"
},
"details": "Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a\u00a0system/user manager to demote / deactivate another manager\n\n",
"id": "GHSA-h69v-mvh9-hfrq",
"modified": "2023-10-03T21:16:24Z",
"published": "2023-09-29T12:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5194"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost Incorrect Authorization vulnerability"
}
GHSA-H6CX-GJXX-V25C
Vulnerability from github – Published: 2026-09-02 14:57 – Updated: 2026-09-02 14:57
VLAI
Summary
Sulu: Media move/update authorization bypass (IDOR)
Details
Impact
A media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.
The media move endpoint resolves its permission check from the collection value in the request rather than from the media's real collection. MediaManager::move() then reassigns the media without re-checking its actual source collection. A user who has edit rights on collection A but no rights on a restricted collection B can move a media that lives in B by naming A in the request. The move succeeds, the media ends up in A, and the user can then view and download content they were never allowed to see.
This only affects installations that use per-collection (object level) permissions to restrict some collections. Exploitation requires an authenticated backend user with edit rights on at least one collection, and knowledge of the target media id.
Patches
Fixed in 2.6.25 and 3.0.8. MediaManager::move() now verifies edit permission on the media's real source collection and on the destination collection before moving it.
Workarounds
If you cannot upgrade immediately:
- Restrict the media edit permission to trusted users, so untrusted users cannot trigger a move.
- Apply the fix manually by adding an edit permission check on the media's real source collection (and the destination) inside
MediaManager::move().
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.6.24"
},
"package": {
"ecosystem": "Packagist",
"name": "sulu/sulu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.6.25"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "sulu/sulu"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0-alpha1"
},
{
"fixed": "3.0.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-82395"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T14:57:25Z",
"nvd_published_at": "2026-08-31T22:17:22Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nA media move authorization bypass (IDOR) lets a backend user move a media out of a collection they have no access to.\n\nThe media move endpoint resolves its permission check from the `collection` value in the request rather than from the media\u0027s real collection. `MediaManager::move()` then reassigns the media without re-checking its actual source collection. A user who has edit rights on collection A but no rights on a restricted collection B can move a media that lives in B by naming A in the request. The move succeeds, the media ends up in A, and the user can then view and download content they were never allowed to see.\n\nThis only affects installations that use per-collection (object level) permissions to restrict some collections. Exploitation requires an authenticated backend user with edit rights on at least one collection, and knowledge of the target media id.\n\n### Patches\n\nFixed in **2.6.25** and **3.0.8**. `MediaManager::move()` now verifies edit permission on the media\u0027s real source collection and on the destination collection before moving it.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Restrict the media edit permission to trusted users, so untrusted users cannot trigger a move.\n- Apply the fix manually by adding an edit permission check on the media\u0027s real source collection (and the destination) inside `MediaManager::move()`.",
"id": "GHSA-h6cx-gjxx-v25c",
"modified": "2026-09-02T14:57:25Z",
"published": "2026-09-02T14:57:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sulu/sulu/security/advisories/GHSA-h6cx-gjxx-v25c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82395"
},
{
"type": "WEB",
"url": "https://github.com/sulu/sulu/commit/2b959de75d61b98433e42db462c246ed9e4ce793"
},
{
"type": "PACKAGE",
"url": "https://github.com/sulu/sulu"
},
{
"type": "WEB",
"url": "https://github.com/sulu/sulu/releases/tag/2.6.25"
},
{
"type": "WEB",
"url": "https://github.com/sulu/sulu/releases/tag/3.0.8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Sulu: Media move/update authorization bypass (IDOR)"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.