CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7194 vulnerabilities reference this CWE, most recent first.
GHSA-JFFW-8F4H-X7FQ
Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2022-05-13 01:44On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.
{
"affected": [],
"aliases": [
"CVE-2017-2306"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-30T14:29:00Z",
"severity": "HIGH"
},
"details": "On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space administrative web interface can execute code on the device.",
"id": "GHSA-jffw-8f4h-x7fq",
"modified": "2022-05-13T01:44:45Z",
"published": "2022-05-13T01:44:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2306"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/JSA10770"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98772"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JFGC-5VH4-8RH5
Vulnerability from github – Published: 2022-04-23 00:40 – Updated: 2024-11-18 22:14trytond 2.4: ModelView.button fails to validate authorization.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "trytond"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-2238"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-29T09:57:26Z",
"nvd_published_at": "2019-11-21T14:15:00Z",
"severity": "HIGH"
},
"details": "trytond 2.4: `ModelView.button` fails to validate authorization.",
"id": "GHSA-jfgc-5vh4-8rh5",
"modified": "2024-11-18T22:14:03Z",
"published": "2022-04-23T00:40:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2238"
},
{
"type": "WEB",
"url": "https://github.com/tryton/trytond/commit/4509595762da0c08fdf182e2bdf952cbbe300667"
},
{
"type": "WEB",
"url": "https://github.com/tryton/trytond/commit/96cd5d58ea82fb746b42dc2ebde9b8f531368d53"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78435"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/trytond/PYSEC-2019-211.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/tryton/trytond"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2012-2238"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229115241/https://www.securityfocus.com/bid/55503"
},
{
"type": "WEB",
"url": "http://hg.tryton.org/2.4/trytond/rev/279f0031b461"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/09/11/10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "trytond Incorrect Authorization vulnerability"
}
GHSA-JFM6-9G2X-F7PR
Vulnerability from github – Published: 2025-08-05 00:30 – Updated: 2025-08-05 00:30tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure.
{
"affected": [],
"aliases": [
"CVE-2025-54554"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-04T22:15:28Z",
"severity": "MODERATE"
},
"details": "tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure.",
"id": "GHSA-jfm6-9g2x-f7pr",
"modified": "2025-08-05T00:30:26Z",
"published": "2025-08-05T00:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54554"
},
{
"type": "WEB",
"url": "https://github.com/Aman-Parmar/CVE-2025-54554"
},
{
"type": "WEB",
"url": "https://ticrypt.com/docs/ticrypt-backend/audit/rest"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JFV6-7JF3-3V86
Vulnerability from github – Published: 2022-12-08 06:30 – Updated: 2025-04-23 15:30Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)
{
"affected": [],
"aliases": [
"CVE-2022-46792"
],
"database_specific": {
"cwe_ids": [
"CWE-732",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-08T06:15:00Z",
"severity": "HIGH"
},
"details": "Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)",
"id": "GHSA-jfv6-7jf3-3v86",
"modified": "2025-04-23T15:30:38Z",
"published": "2022-12-08T06:30:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hasura/graphql-engine/security/advisories/GHSA-g7mj-g7f4-hgrg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46792"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/hasura-security-announce/c/kzK-uPAKGUU"
},
{
"type": "WEB",
"url": "https://hasura.io/blog/critical-vulnerability-in-hasuras-graphql-engine-v2-10-0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JFXM-H5M6-27F9
Vulnerability from github – Published: 2026-07-14 00:31 – Updated: 2026-07-14 00:31OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured input paths to bypass intended authorization controls and execute restricted operations.
{
"affected": [],
"aliases": [
"CVE-2026-62198"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T22:16:51Z",
"severity": "MODERATE"
},
"details": "OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stronger policy checks. Attackers can exploit misconfigured input paths to bypass intended authorization controls and execute restricted operations.",
"id": "GHSA-jfxm-h5m6-27f9",
"modified": "2026-07-14T00:31:04Z",
"published": "2026-07-14T00:31:04Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-v4f6-x5g5-2g4g"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62198"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-authorization-bypass-via-web-search"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JG6Q-3QFH-R9F8
Vulnerability from github – Published: 2026-10-07 18:03 – Updated: 2026-10-07 18:03Impact
Both packages wrap an mppx payment method so that a wallet meeting on-chain conditions is granted free access instead of being charged.
The free-access path reads the payer address from credential.source — a client-supplied DID in the payment credential — asks InsumerAPI whether that address satisfies the configured conditions, and on a pass returns a successful receipt without ever calling the wrapped payment verifier. Nothing in that path establishes that the caller controls the wallet it named.
Because qualifying wallets are public chain state, an attacker does not need to guess one. Naming any qualifying address in credential.source is sufficient to obtain free access to a route that should have been paid for. An in-process cache (default TTL 300s, keyed on wallet and conditions) then re-serves the grant without re-evaluating.
mppx documents this requirement explicitly. Its type definitions describe source as "an asserted identity, not independent proof of control", and state that methods relying on it "must validate the relationship to the credential payload". These packages did not.
This is a defect in these wrapper packages, not in the attestation they consume. The attestation answers one question — does this wallet satisfy these conditions — and answered it honestly about the address it was given. Binding that address to the caller was the wrapper's responsibility.
Affected versions
Every published version of both packages is affected. The vulnerable control flow is present from the first release of each.
Patches
Fixed releases will not grant free access unless the payer has been proven, and fall through to the paid path wherever no proven payer is available.
Workarounds
Remove the condition gate from the payment method until a fixed version is installed, so all requests take the normal paid path. Alternatively, ensure the wrapped payment method has already bound the credential to the payer before the gate is consulted.
Credit
Reported by @chenshj73, who identified the issue, traced the exact code path, and proposed correct remediations.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.0.3"
},
"package": {
"ecosystem": "npm",
"name": "@insumermodel/mppx-condition-gate"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.3"
},
"package": {
"ecosystem": "npm",
"name": "@insumermodel/mppx-token-gate"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-104891"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T18:03:42Z",
"nvd_published_at": "2026-10-05T16:17:06Z",
"severity": "HIGH"
},
"details": "### Impact\n\nBoth packages wrap an `mppx` payment method so that a wallet meeting on-chain conditions is granted free access instead of being charged.\n\nThe free-access path reads the payer address from `credential.source` \u2014 a client-supplied DID in the payment credential \u2014 asks InsumerAPI whether that address satisfies the configured conditions, and on a pass returns a successful receipt **without ever calling the wrapped payment verifier**. Nothing in that path establishes that the caller controls the wallet it named.\n\nBecause qualifying wallets are public chain state, an attacker does not need to guess one. Naming any qualifying address in `credential.source` is sufficient to obtain free access to a route that should have been paid for. An in-process cache (default TTL 300s, keyed on wallet and conditions) then re-serves the grant without re-evaluating.\n\nmppx documents this requirement explicitly. Its type definitions describe `source` as \"an asserted identity, not independent proof of control\", and state that methods relying on it \"must validate the relationship to the credential payload\". These packages did not.\n\n**This is a defect in these wrapper packages, not in the attestation they consume.** The attestation answers one question \u2014 does this wallet satisfy these conditions \u2014 and answered it honestly about the address it was given. Binding that address to the caller was the wrapper\u0027s responsibility.\n\n### Affected versions\n\nEvery published version of both packages is affected. The vulnerable control flow is present from the first release of each.\n\n### Patches\n\nFixed releases will not grant free access unless the payer has been proven, and fall through to the paid path wherever no proven payer is available.\n\n### Workarounds\n\nRemove the condition gate from the payment method until a fixed version is installed, so all requests take the normal paid path. Alternatively, ensure the wrapped payment method has already bound the credential to the payer before the gate is consulted.\n\n### Credit\n\nReported by @chenshj73, who identified the issue, traced the exact code path, and proposed correct remediations.",
"id": "GHSA-jg6q-3qfh-r9f8",
"modified": "2026-10-07T18:03:42Z",
"published": "2026-10-07T18:03:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/douglasborthwick-crypto/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8"
},
{
"type": "WEB",
"url": "https://github.com/insumerapi/mppx-condition-gate/security/advisories/GHSA-jg6q-3qfh-r9f8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104891"
},
{
"type": "WEB",
"url": "https://github.com/insumerapi/mppx-condition-gate/commit/b1d9935a57ba6d32da49eead1bfb459ad0cd55ab"
},
{
"type": "WEB",
"url": "https://github.com/insumerapi/mppx-condition-gate/commit/ec43a2fcd443a0fa102b6d4203abed2b785bd954"
},
{
"type": "PACKAGE",
"url": "https://github.com/douglasborthwick-crypto/mppx-condition-gate"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control"
}
GHSA-JG7H-CR7W-5FC6
Vulnerability from github – Published: 2022-07-02 00:00 – Updated: 2022-07-14 00:00An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects.
{
"affected": [],
"aliases": [
"CVE-2022-2243"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-01T16:15:00Z",
"severity": "MODERATE"
},
"details": "An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects.",
"id": "GHSA-jg7h-cr7w-5fc6",
"modified": "2022-07-14T00:00:17Z",
"published": "2022-07-02T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2243"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1546138"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2243.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/360666"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JG87-7JXH-JP92
Vulnerability from github – Published: 2026-03-11 03:31 – Updated: 2026-03-11 03:31Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.
{
"affected": [],
"aliases": [
"CVE-2026-21286"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T03:15:53Z",
"severity": "MODERATE"
},
"details": "Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.",
"id": "GHSA-jg87-7jxh-jp92",
"modified": "2026-03-11T03:31:27Z",
"published": "2026-03-11T03:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21286"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb26-05.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JG9M-WR8W-VHXV
Vulnerability from github – Published: 2023-11-01 18:30 – Updated: 2023-11-01 18:30A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by the FMC Software. This vulnerability is due to insufficient authorization of configuration commands that are sent through the web service interface. An attacker could exploit this vulnerability by authenticating to the FMC web services interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute certain configuration commands on the targeted FTD device. To successfully exploit this vulnerability, an attacker would need valid credentials on the FMC Software.
{
"affected": [],
"aliases": [
"CVE-2023-20048"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-01T18:15:08Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by the FMC Software. This vulnerability is due to insufficient authorization of configuration commands that are sent through the web service interface. An attacker could exploit this vulnerability by authenticating to the FMC web services interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute certain configuration commands on the targeted FTD device. To successfully exploit this vulnerability, an attacker would need valid credentials on the FMC Software.",
"id": "GHSA-jg9m-wr8w-vhxv",
"modified": "2023-11-01T18:30:33Z",
"published": "2023-11-01T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20048"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-29MP49hN"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JGCF-RF45-2F8V
Vulnerability from github – Published: 2026-04-16 20:40 – Updated: 2026-04-27 14:20Impact
Images rendered in templates or otherwise accessed via DBFile::getURL() or DBFile::getSourceURL() incorrectly add an access grant to the current session, which bypasses file permissions.
This usually happens when creating an image variant, for example using a manipulation method like ScaleWidth() or Convert().
Note that if you use DBFile directly in the $db configuration for a DataObject class that doesn't subclass File, and if you were setting the visibility of those files to "protected", those files will now need an explicit access grant to be accessed. If you do not want to explicitly provide access grants for these files (i.e. you want these files to be accessible by default), you should use the "public" visibility.
Reported by
Restruct web & apps
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/assets"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/assets"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-24749"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T20:40:37Z",
"nvd_published_at": "2026-04-16T18:16:44Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nImages rendered in templates or otherwise accessed via `DBFile::getURL()` or `DBFile::getSourceURL()` incorrectly add an access grant to the current session, which bypasses file permissions.\n\nThis usually happens when creating an image variant, for example using a manipulation method like `ScaleWidth()` or `Convert()`.\n\nNote that if you use `DBFile` directly in the `$db` configuration for a `DataObject` class that doesn\u0027t subclass `File`, and if you were setting the visibility of those files to \"protected\", those files will now need an explicit access grant to be accessed. If you do not want to explicitly provide access grants for these files (i.e. you want these files to be accessible by default), you should use the \"public\" visibility.\n\n### Reported by\n\nRestruct web \u0026 apps",
"id": "GHSA-jgcf-rf45-2f8v",
"modified": "2026-04-27T14:20:04Z",
"published": "2026-04-16T20:40:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/silverstripe/silverstripe-assets/security/advisories/GHSA-jgcf-rf45-2f8v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24749"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2026-24749.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/silverstripe/silverstripe-assets"
},
{
"type": "WEB",
"url": "https://www.silverstripe.org/download/security-releases/cve-2026-24749"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Silverstripe Assets Module has a DBFile::getURL() permission bypass"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.