Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7173 vulnerabilities reference this CWE, most recent first.

GHSA-HGC9-X857-7QX4

Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2025-05-30 18:30
VLAI
Details

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-38617"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-07T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user account with a defined password. This directly leads to privilege escalation.",
  "id": "GHSA-hgc9-x857-7qx4",
  "modified": "2025-05-30T18:30:40Z",
  "published": "2022-05-24T19:13:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38617"
    },
    {
      "type": "WEB",
      "url": "https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38617"
    },
    {
      "type": "WEB",
      "url": "https://eigentech.com"
    },
    {
      "type": "WEB",
      "url": "https://excellium-services.com/cert-xlm-advisory"
    },
    {
      "type": "WEB",
      "url": "https://excellium-services.com/cert-xlm-advisory/CVE-2021-38617"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HGFG-J9PG-43XW

Vulnerability from github – Published: 2026-10-01 14:39 – Updated: 2026-10-01 14:39
VLAI
Summary
SiYuan discloses an administrator's open documents and search terms to anonymous readers
Details

Summary

/api/system/getConf serves Conf.UILayout to publish readers after passing it through FilterConfByPublishIgnore, whose only function is to filter that layout. The layout is written exclusively by setUILayout, which is administrator-gated, so what readers receive is the administrator's own live workspace state, re-saved on every tab open, close and focus change.

The filter that is supposed to protect it, filterLayoutItemByPublishIgnore, has four separate defects. Together they mean a single unauthenticated POST with no arguments returns the titles and identifiers of the administrator's open password-protected documents, the titles of documents in locked or closed notebooks, their recent search terms and the paths those searches were scoped to, and the paths of private assets they have open.

This report concerns FilterConfByPublishIgnore and its layout walker. It is distinct from the previously reported getConf issues, which concern configuration fields surviving HideConfSecret's blocklist. Restructuring the secret-masking path would not affect this, because UILayout is not a secret to be stripped. It is a field intended to be served and filtered.

Details

Route and writer asymmetry. kernel/api/router.go:70 registers POST /api/system/getConf with model.CheckAuth only, so it is reachable by the publish RoleReader token and anonymously when Publish.Auth.Enable is false. The corresponding writer, setUILayout at kernel/api/router.go:67, carries CheckAuth, CheckAdminRole and CheckReadonly. Only an administrator can write this state, and any reader can read it.

The filter exists and is intended to work. HideConfSecret never touches UILayout (zero matches on both refs). Instead the reader branch runs:

if model.IsReadOnlyRoleContext(c) {
    publishIgnore := model.GetInvisiblePublishAccess(publishAccess)
    maskedConf = model.FilterConfByPublishIgnore(publishIgnore, maskedConf)
}

FilterConfByPublishIgnore does exactly one thing, which is filter UILayout. The intent that readers must not see the administrator's private tabs is therefore already established in the code. The four defects below are failures of that filter, not an argument that it should exist.

filterLayoutItemByPublishIgnore is byte-identical at eef105683 and v3.7.4-alpha.1 and has not changed since 3facc37df (#16041).

Defect 1: the password tier is not checked. GetPathPasswordByPublishAccess and CheckPublishAuthCookie appear zero times in the walker. Of the five access levels defined in publishAccess.ts, only the protected level is {visible: true, password: ...}. A password-protected document therefore never matches the invisible list, and there is no password check to catch it afterwards. Its tab survives intact, carrying title (the document title), docIcon, notebookId, rootId and blockId.

To be precise about scope: the forbidden level sets visible: false, so forbidden documents are correctly filtered. The leak is specific to the password tier.

This is the same class of defect as the recently fixed tag-label filter, on a different function that the tag fix does not touch.

Defect 2: fail-open on an unresolvable document. The walker does:

bt := treenode.GetBlockTree(rootId)
if bt == nil {
    return
}

and the tab is retained. Compare CheckBlockIdAccessableByPublishAccess, which fails closed on the same condition. A rootId is unresolvable when its notebook is a locked encrypted notebook or a closed notebook, which are precisely the notebooks a reader must not learn about. Their tab titles pass through.

This survives the recent change that appends encrypted boxes to the invisible and disable ignore lists, because that change only takes effect once bt resolves. The nil branch returns before any ignore list is consulted.

Defect 3: non-editor tabs are never inspected. The walker examines one key, children["rootId"]. Editor tabs and Backlink/Graph tabs carry it. Other tab types do not, and pass through entirely unexamined:

  • Asset{path, page} discloses the path of a private PDF or other asset the administrator has open.
  • Outline{blockId} discloses a block identifier.
  • Search{config} discloses k (the search text), r (replace text), name, hPath (a human-readable list of paths) and idPath (the notebook and document identifiers the search was scoped to).
  • Custom{customModelData} discloses arbitrary plugin state.

The Search case is the sharpest, because it discloses what the administrator was looking for and where, in their own words. Search text frequently contains the exact terms a private document is about.

Defect 4: the docks are not filtered. IUiLayout is {layout, left, right, bottom, hideDock} and the walker enters only ["layout"]. Dock entries carry type, size and localized titles, so this is low value on its own, noted for completeness rather than as part of the impact claim.

Proof of Concept

Precondition: publish mode enabled (default port 6808), anonymous when Publish.Auth.Enable is false, otherwise any publish reader account. An administrator with the desktop client open, having at some point opened a password-protected document, a document in a locked or closed notebook, an asset, and run a search.

POST http://127.0.0.1:6808/api/system/getConf
{}

→ 200. conf.uiLayout.layout contains, for the administrator's session:
     - Editor tabs for password-protected documents, with title, docIcon,
       notebookId, rootId and blockId intact
     - Editor tabs whose rootId does not resolve, retained with their titles,
       corresponding to locked encrypted or closed notebooks
     - Asset tabs carrying private asset paths
     - Search tabs carrying the search text, replace text, hPath and idPath

No arguments and no authentication are required. Repeating the request after the administrator opens or closes a tab returns updated state, since setUILayout persists on every such event.

Impact

An anonymous reader in publish mode, or any publish RoleReader, receives a live view of the administrator's working session. The disclosed material includes the titles and identifiers of documents the administrator protected with a publish password, the titles of documents in notebooks that are locked or closed and therefore should not be known to exist, the administrator's search terms together with the human-readable paths those searches covered, and the filesystem paths of private assets.

Titles and search terms are author-written free text and routinely describe the subject matter of the documents they refer to. Because the layout is re-persisted on every tab event, repeated polling yields a running record of what the administrator is working on. Confidentiality only, with no integrity or availability impact.

Suggested fix

Four changes, corresponding to the four defects:

  1. Replace the invisible-only check with checkBlockTreeAccessableByPublishAccess, so the password tier is honoured.
  2. Make the bt == nil branch fail closed, matching CheckBlockIdAccessableByPublishAccess.
  3. Drop or scrub Asset, Outline, Search and Custom instances rather than passing through anything without a rootId.
  4. Walk left, right and bottom in addition to layout.

The simpler and more robust option is to stop serving the administrator's layout to readers at all, and return a minimal default layout instead. Readers have no legitimate use for the administrator's tab arrangement, and a filter that must correctly classify every present and future tab type is a standing source of this class of defect. Defect 3 in particular will recur every time a new tab type is added.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260812083335-251596fc0de2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72788"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-01T14:39:32Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`/api/system/getConf` serves `Conf.UILayout` to publish readers after passing it through `FilterConfByPublishIgnore`, whose only function is to filter that layout. The layout is written exclusively by `setUILayout`, which is administrator-gated, so what readers receive is the administrator\u0027s own live workspace state, re-saved on every tab open, close and focus change.\n\nThe filter that is supposed to protect it, `filterLayoutItemByPublishIgnore`, has four separate defects. Together they mean a single unauthenticated POST with no arguments returns the titles and identifiers of the administrator\u0027s open password-protected documents, the titles of documents in locked or closed notebooks, their recent search terms and the paths those searches were scoped to, and the paths of private assets they have open.\n\nThis report concerns `FilterConfByPublishIgnore` and its layout walker. It is distinct from the previously reported `getConf` issues, which concern configuration fields surviving `HideConfSecret`\u0027s blocklist. Restructuring the secret-masking path would not affect this, because `UILayout` is not a secret to be stripped. It is a field intended to be served and filtered.\n\n### Details\n\n**Route and writer asymmetry.** `kernel/api/router.go:70` registers `POST /api/system/getConf` with `model.CheckAuth` only, so it is reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`. The corresponding writer, `setUILayout` at `kernel/api/router.go:67`, carries `CheckAuth`, `CheckAdminRole` and `CheckReadonly`. Only an administrator can write this state, and any reader can read it.\n\n**The filter exists and is intended to work.** `HideConfSecret` never touches `UILayout` (zero matches on both refs). Instead the reader branch runs:\n\n```go\nif model.IsReadOnlyRoleContext(c) {\n    publishIgnore := model.GetInvisiblePublishAccess(publishAccess)\n    maskedConf = model.FilterConfByPublishIgnore(publishIgnore, maskedConf)\n}\n```\n\n`FilterConfByPublishIgnore` does exactly one thing, which is filter `UILayout`. The intent that readers must not see the administrator\u0027s private tabs is therefore already established in the code. The four defects below are failures of that filter, not an argument that it should exist.\n\n`filterLayoutItemByPublishIgnore` is byte-identical at `eef105683` and `v3.7.4-alpha.1` and has not changed since `3facc37df` (#16041).\n\n---\n\n**Defect 1: the password tier is not checked.** `GetPathPasswordByPublishAccess` and `CheckPublishAuthCookie` appear zero times in the walker. Of the five access levels defined in `publishAccess.ts`, only the protected level is `{visible: true, password: ...}`. A password-protected document therefore never matches the invisible list, and there is no password check to catch it afterwards. Its tab survives intact, carrying `title` (the document title), `docIcon`, `notebookId`, `rootId` and `blockId`.\n\nTo be precise about scope: the forbidden level sets `visible: false`, so forbidden documents are correctly filtered. The leak is specific to the password tier.\n\nThis is the same class of defect as the recently fixed tag-label filter, on a different function that the tag fix does not touch.\n\n**Defect 2: fail-open on an unresolvable document.** The walker does:\n\n```go\nbt := treenode.GetBlockTree(rootId)\nif bt == nil {\n    return\n}\n```\n\nand the tab is retained. Compare `CheckBlockIdAccessableByPublishAccess`, which fails closed on the same condition. A `rootId` is unresolvable when its notebook is a locked encrypted notebook or a closed notebook, which are precisely the notebooks a reader must not learn about. Their tab titles pass through.\n\nThis survives the recent change that appends encrypted boxes to the invisible and disable ignore lists, because that change only takes effect once `bt` resolves. The nil branch returns before any ignore list is consulted.\n\n**Defect 3: non-editor tabs are never inspected.** The walker examines one key, `children[\"rootId\"]`. Editor tabs and Backlink/Graph tabs carry it. Other tab types do not, and pass through entirely unexamined:\n\n- `Asset{path, page}` discloses the path of a private PDF or other asset the administrator has open.\n- `Outline{blockId}` discloses a block identifier.\n- `Search{config}` discloses `k` (the search text), `r` (replace text), `name`, `hPath` (a human-readable list of paths) and `idPath` (the notebook and document identifiers the search was scoped to).\n- `Custom{customModelData}` discloses arbitrary plugin state.\n\nThe `Search` case is the sharpest, because it discloses what the administrator was looking for and where, in their own words. Search text frequently contains the exact terms a private document is about.\n\n**Defect 4: the docks are not filtered.** `IUiLayout` is `{layout, left, right, bottom, hideDock}` and the walker enters only `[\"layout\"]`. Dock entries carry type, size and localized titles, so this is low value on its own, noted for completeness rather than as part of the impact claim.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. An administrator with the desktop client open, having at some point opened a password-protected document, a document in a locked or closed notebook, an asset, and run a search.\n\n```\nPOST http://127.0.0.1:6808/api/system/getConf\n{}\n\n\u2192 200. conf.uiLayout.layout contains, for the administrator\u0027s session:\n     - Editor tabs for password-protected documents, with title, docIcon,\n       notebookId, rootId and blockId intact\n     - Editor tabs whose rootId does not resolve, retained with their titles,\n       corresponding to locked encrypted or closed notebooks\n     - Asset tabs carrying private asset paths\n     - Search tabs carrying the search text, replace text, hPath and idPath\n```\n\nNo arguments and no authentication are required. Repeating the request after the administrator opens or closes a tab returns updated state, since `setUILayout` persists on every such event.\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, receives a live view of the administrator\u0027s working session. The disclosed material includes the titles and identifiers of documents the administrator protected with a publish password, the titles of documents in notebooks that are locked or closed and therefore should not be known to exist, the administrator\u0027s search terms together with the human-readable paths those searches covered, and the filesystem paths of private assets.\n\nTitles and search terms are author-written free text and routinely describe the subject matter of the documents they refer to. Because the layout is re-persisted on every tab event, repeated polling yields a running record of what the administrator is working on. Confidentiality only, with no integrity or availability impact.\n\n### Suggested fix\n\nFour changes, corresponding to the four defects:\n\n1. Replace the invisible-only check with `checkBlockTreeAccessableByPublishAccess`, so the password tier is honoured.\n2. Make the `bt == nil` branch fail closed, matching `CheckBlockIdAccessableByPublishAccess`.\n3. Drop or scrub `Asset`, `Outline`, `Search` and `Custom` instances rather than passing through anything without a `rootId`.\n4. Walk `left`, `right` and `bottom` in addition to `layout`.\n\nThe simpler and more robust option is to stop serving the administrator\u0027s layout to readers at all, and return a minimal default layout instead. Readers have no legitimate use for the administrator\u0027s tab arrangement, and a filter that must correctly classify every present and future tab type is a standing source of this class of defect. Defect 3 in particular will recur every time a new tab type is added.",
  "id": "GHSA-hgfg-j9pg-43xw",
  "modified": "2026-10-01T14:39:32Z",
  "published": "2026-10-01T14:39:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hgfg-j9pg-43xw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72788"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-uilayout-filter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan discloses an administrator\u0027s open documents and search terms to anonymous readers"
}

GHSA-HGFR-JMPR-2P89

Vulnerability from github – Published: 2026-03-24 15:30 – Updated: 2026-03-24 15:30
VLAI
Details

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-28755"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-24T15:16:33Z",
    "severity": "MODERATE"
  },
  "details": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked. \u00a0 \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-hgfr-jmpr-2p89",
  "modified": "2026-03-24T15:30:29Z",
  "published": "2026-03-24T15:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28755"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000160368"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-HGGX-69G9-VFHX

Vulnerability from github – Published: 2026-09-16 12:30 – Updated: 2026-09-16 12:30
VLAI
Details

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-73469"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T10:16:52Z",
    "severity": "MODERATE"
  },
  "details": "When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.",
  "id": "GHSA-hggx-69g9-vfhx",
  "modified": "2026-09-16T12:30:30Z",
  "published": "2026-09-16T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73469"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24732-security-advisory-0176"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-HGPF-8634-G44C

Vulnerability from github – Published: 2026-08-28 22:16 – Updated: 2026-08-28 22:16
VLAI
Summary
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
Details

Summary

SeaweedFS routes requests signed with SigV4 service s3tables to the S3Tables management API. Authorization on that path collapsed account-less S3 identities into the shared admin account and failed open, so a user holding only ordinary S3 Read credentials — and no S3Tables-specific permission — could invoke S3Tables management operations such as GET /buckets and enumerate administrator-owned table bucket inventory (names and ARNs). The same handler backs the Iceberg REST catalog, which was affected by the same flaw.

Impact

An authenticated low-privileged S3 user can cross the boundary between ordinary S3 object access and S3Tables management. Confirmed impact is disclosure of administrator-owned table bucket inventory (bucket names and ARNs); in shared or multi-tenant deployments this can reveal tenant naming and operational structure.

Affected versions

SeaweedFS >= 4.08, < 4.34 (the S3Tables management API was introduced in 4.08).

Patched versions

Fixed in 4.34 (#9961). Administrator status is now decided by the ACTION_ADMIN capability rather than by a collapsed admin account id, S3Tables authorization no longer defaults to allow, and the tautological ListTableBuckets gate was removed. Related hardening of the same root cause landed in #9962,

9963, and #9971.

Workaround

No configuration workaround — upgrade to 4.34 or later.

Credit

Reported by TA-MU-TA.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/seaweedfs/seaweedfs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-20260128085517-09bb90e8dc16"
            },
            {
              "fixed": "0.0.0-20260614205536-b13463880c1f"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55873"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T22:16:43Z",
    "nvd_published_at": "2026-07-08T15:16:30Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nSeaweedFS routes requests signed with SigV4 service `s3tables` to the S3Tables\nmanagement API. Authorization on that path collapsed account-less S3 identities\ninto the shared `admin` account and failed open, so a user holding only ordinary\nS3 `Read` credentials \u2014 and no S3Tables-specific permission \u2014 could invoke\nS3Tables management operations such as `GET /buckets` and enumerate\nadministrator-owned table bucket inventory (names and ARNs). The same handler\nbacks the Iceberg REST catalog, which was affected by the same flaw.\n\n### Impact\nAn authenticated low-privileged S3 user can cross the boundary between ordinary\nS3 object access and S3Tables management. Confirmed impact is disclosure of\nadministrator-owned table bucket inventory (bucket names and ARNs); in shared or\nmulti-tenant deployments this can reveal tenant naming and operational structure.\n\n### Affected versions\nSeaweedFS `\u003e= 4.08, \u003c 4.34` (the S3Tables management API was introduced in 4.08).\n\n### Patched versions\nFixed in **4.34** (#9961). Administrator status is now decided by the\n`ACTION_ADMIN` capability rather than by a collapsed `admin` account id, S3Tables\nauthorization no longer defaults to allow, and the tautological ListTableBuckets\ngate was removed. Related hardening of the same root cause landed in #9962,\n#9963, and #9971.\n\n### Workaround\nNo configuration workaround \u2014 upgrade to 4.34 or later.\n\n### Credit\nReported by **TA-MU-TA**.",
  "id": "GHSA-hgpf-8634-g44c",
  "modified": "2026-08-28T22:16:43Z",
  "published": "2026-08-28T22:16:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/seaweedfs/seaweedfs/security/advisories/GHSA-hgpf-8634-g44c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55873"
    },
    {
      "type": "WEB",
      "url": "https://github.com/seaweedfs/seaweedfs/pull/9961"
    },
    {
      "type": "WEB",
      "url": "https://github.com/seaweedfs/seaweedfs/commit/b13463880c1fa62e255c058a9228b63cc95b4b36"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/seaweedfs/seaweedfs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/seaweedfs/seaweedfs/releases/tag/4.34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets"
}

GHSA-HGWW-4988-8569

Vulnerability from github – Published: 2022-02-11 00:00 – Updated: 2023-08-08 15:31
VLAI
Details

Improper access control in the Intel(R) Capital Global Summit Android application may allow an authenticated user to potentially enable information disclosure via local access.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-21153"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-09T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper access control in the Intel(R) Capital Global Summit Android application may allow an authenticated user to potentially enable information disclosure via local access.",
  "id": "GHSA-hgww-4988-8569",
  "modified": "2023-08-08T15:31:43Z",
  "published": "2022-02-11T00:00:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21153"
    },
    {
      "type": "WEB",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00608.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HH32-7344-CG2F

Vulnerability from github – Published: 2022-05-20 00:00 – Updated: 2024-10-04 20:22
VLAI
Summary
Authorization bypass in Spring Security
Details

In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "5.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.6.0"
            },
            {
              "fixed": "5.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.4.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.5.0"
            },
            {
              "fixed": "5.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.6.0"
            },
            {
              "fixed": "5.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.4.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-22978"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-25T20:20:36Z",
    "nvd_published_at": "2022-05-19T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.",
  "id": "GHSA-hh32-7344-cg2f",
  "modified": "2024-10-04T20:22:02Z",
  "published": "2022-05-20T00:00:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22978"
    },
    {
      "type": "WEB",
      "url": "https://github.com/anchore/grype/issues/2158"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-projects/spring-security"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220707-0003"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2022-22978"
    },
    {
      "type": "WEB",
      "url": "https://tanzu.vmware.com/security/cve-2022-22978"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authorization bypass in Spring Security"
}

GHSA-HH36-F69G-HQ4H

Vulnerability from github – Published: 2026-03-31 12:31 – Updated: 2026-03-31 12:31
VLAI
Details

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-24029"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-31T12:16:27Z",
    "severity": "MODERATE"
  },
  "details": "When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.",
  "id": "GHSA-hh36-f69g-hq4h",
  "modified": "2026-03-31T12:31:35Z",
  "published": "2026-03-31T12:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24029"
    },
    {
      "type": "WEB",
      "url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-HH43-Q692-2XMQ

Vulnerability from github – Published: 2026-03-29 15:30 – Updated: 2026-04-01 00:06
Withdrawn 2026-04-01 VLAI
Summary
Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wcxr-59v9-rxr8. This link is maintained to preserve external references.

Original Description

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.

Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
9.2 (Critical)
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2026.3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T00:06:14Z",
    "nvd_published_at": "2026-03-29T13:17:00Z",
    "severity": "CRITICAL"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wcxr-59v9-rxr8. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.",
  "id": "GHSA-hh43-q692-2xmq",
  "modified": "2026-04-01T00:06:58Z",
  "published": "2026-03-29T15:30:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-wcxr-59v9-rxr8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32918"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-session-sandbox-escape-via-session-status-tool"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state",
  "withdrawn": "2026-04-01T00:06:14Z"
}

GHSA-HH4P-FF9X-4G5C

Vulnerability from github – Published: 2023-10-04 12:30 – Updated: 2025-03-03 18:31
VLAI
Details

Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users including administrators leading to a privilege escalation.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-4997"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-04T11:15:10Z",
    "severity": "HIGH"
  },
  "details": "Improper authorisation of regular users in ProIntegra Uptime DC software (versions below 2.0.0.33940) allows them to change passwords of all other users including administrators leading to a privilege escalation.",
  "id": "GHSA-hh4p-ff9x-4g5c",
  "modified": "2025-03-03T18:31:18Z",
  "published": "2023-10-04T12:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4997"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2023/10/CVE-2023-4997"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/posts/2023/10/CVE-2023-4997"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list