Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
17631 vulnerabilities reference this CWE, most recent first.
CVE-2026-85212 (GCVE-0-2026-85212)
Vulnerability from cvelistv5 – Published: 2026-09-03 14:12 – Updated: 2026-09-24 14:20
VLAI
EPSS
VEX
Title
CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check
Summary
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 15:03 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/crmeb/CRMEB/issues/119 | issue-tracking |
| https://github.com/crmeb/CRMEB | product |
| https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/… | technical-description |
| https://www.vulncheck.com/advisories/crmeb-throug… | third-party-advisory |
Impacted products
Date Public
2026-07-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85212",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T15:03:57.245055Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T17:23:19.772Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CRMEB",
"vendor": "crmeb",
"versions": [
{
"lessThanOrEqual": "6.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crmeb:crmeb:*:*:*:*:*:*:*:*",
"versionEndIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:20:55.453Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #119",
"tags": [
"issue-tracking"
],
"url": "https://github.com/crmeb/CRMEB/issues/119"
},
{
"tags": [
"product"
],
"url": "https://github.com/crmeb/CRMEB"
},
{
"name": "SystemRoleServices.php at v6.0.0",
"tags": [
"technical-description"
],
"url": "https://github.com/crmeb/CRMEB/blob/v6.0.0/crmeb/app/services/system/admin/SystemRoleServices.php"
},
{
"name": "VulnCheck Advisory: CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crmeb-through-6.0.0-missing-authorization-via-inert-verifyauth-role-check"
}
],
"title": "CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85212",
"datePublished": "2026-09-03T14:12:23.174Z",
"dateReserved": "2026-09-03T13:44:51.551Z",
"dateUpdated": "2026-09-24T14:20:55.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85210 (GCVE-0-2026-85210)
Vulnerability from cvelistv5 – Published: 2026-09-03 14:12 – Updated: 2026-10-08 15:51
VLAI
EPSS
VEX
Title
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
Summary
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-05 01:23 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/oppia/oppia/issues/26652 | issue-tracking |
| https://github.com/oppia/oppia | product |
| https://github.com/oppia/oppia/blob/v3.5.2/core/c… | technical-description |
| https://www.vulncheck.com/advisories/oppia-throug… | third-party-advisory |
Impacted products
Date Public
2026-07-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85210",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-05T01:23:09.690005Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T01:23:34.810Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/oppia/oppia/issues/26652"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/oppia/oppia",
"product": "oppia",
"vendor": "oppia",
"versions": [
{
"lessThanOrEqual": "3.5.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oppia:oppia:*:*:*:*:*:*:*:*",
"versionEndIncluding": "3.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Oppia\u0027s AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames holding specific roles, banned flags, and managed topic identifiers without authorization."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T15:51:46.106Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #26652",
"tags": [
"issue-tracking"
],
"url": "https://github.com/oppia/oppia/issues/26652"
},
{
"tags": [
"product"
],
"url": "https://github.com/oppia/oppia"
},
{
"name": "core/controllers/admin.py at v3.5.2",
"tags": [
"technical-description"
],
"url": "https://github.com/oppia/oppia/blob/v3.5.2/core/controllers/admin.py"
},
{
"name": "VulnCheck Advisory: Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/oppia-through-3.5.2-missing-authorization-on-adminrolehandler-get"
}
],
"title": "Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85210",
"datePublished": "2026-09-03T14:12:21.815Z",
"dateReserved": "2026-09-03T13:44:46.783Z",
"dateUpdated": "2026-10-08T15:51:46.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85209 (GCVE-0-2026-85209)
Vulnerability from cvelistv5 – Published: 2026-10-02 11:58 – Updated: 2026-10-02 17:30
VLAI
EPSS
VEX
Title
IDOR in AVEZ Electronics's LMS
Summary
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Learning Management System (LMS): through 2026-09-18.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-02 17:30 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AVEZ Electronics Communication Training and Consultancy Trade Inc. | Learning Management System (LMS) |
Affected:
0 , ≤ 2026-09-18
(date)
|
Date Public
2026-10-02 11:51
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-02T17:30:03.851094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T17:30:23.005Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Learning Management System (LMS)",
"vendor": "AVEZ Electronics Communication Training and Consultancy Trade Inc.",
"versions": [
{
"lessThanOrEqual": "2026-09-18",
"status": "affected",
"version": "0",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yagiz B\u0130LG\u0130L\u0130"
}
],
"datePublic": "2026-10-02T11:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Learning Management System (LMS): through 2026-09-18.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Learning Management System (LMS): through 2026-09-18."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T11:58:15.723Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1242"
}
],
"source": {
"advisory": "TR-26-1242",
"defect": [
"TR-26-1242"
],
"discovery": "UNKNOWN"
},
"title": "IDOR in AVEZ Electronics\u0027s LMS",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-85209",
"datePublished": "2026-10-02T11:58:15.723Z",
"dateReserved": "2026-09-03T13:15:56.086Z",
"dateUpdated": "2026-10-02T17:30:23.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85058 (GCVE-0-2026-85058)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:40 – Updated: 2026-09-22 15:14
VLAI
EPSS
VEX
Title
Moquette: Missing Authorization in io.moquette:moquette-broker
Summary
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:13 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/moquette-io/moquette/security/… | x_refsource_CONFIRM |
| https://github.com/moquette-io/moquette/commit/e2… | x_refsource_MISC |
| https://github.com/moquette-io/moquette/commit/f5… | x_refsource_MISC |
| https://github.com/moquette-io/moquette/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| moquette-io | moquette |
Affected:
< 0.18.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85058",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:13:17.846630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:14:00.736Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "moquette",
"vendor": "moquette-io",
"versions": [
{
"status": "affected",
"version": "\u003c 0.18.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and topic ACLs restrict writes, a remote client can set an ACL-protected topic as the Last Will Topic during CONNECT and perform an abnormal client disconnect, causing the broker to inject attacker-controlled messages into a topic for which the client lacks write permission. This issue is fixed in version 0.18.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:40:39.113Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx"
},
{
"name": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97"
},
{
"name": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973"
},
{
"name": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/moquette-io/moquette/releases/tag/v0.18.1"
}
],
"source": {
"advisory": "GHSA-9jjc-fw8x-fmwx",
"discovery": "UNKNOWN"
},
"title": "Moquette: Missing Authorization in io.moquette:moquette-broker"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85058",
"datePublished": "2026-09-18T17:40:39.113Z",
"dateReserved": "2026-09-02T21:21:01.774Z",
"dateUpdated": "2026-09-22T15:14:00.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84990 (GCVE-0-2026-84990)
Vulnerability from cvelistv5 – Published: 2026-09-21 16:09 – Updated: 2026-09-29 15:08
VLAI
EPSS
VEX
Title
ntopng: Missing Authorization on System Configuration Backup Download and Listing
Summary
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 15:08 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ntop/ntopng/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/ntop/ntopng/commit/f912ee93bc1… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84990",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T15:08:18.030549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:08:23.975Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-7gqc-vjwr-6rh5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ntopng",
"vendor": "ntop",
"versions": [
{
"status": "affected",
"version": "\u003c 6.7.260718"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:09:20.689Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ntop/ntopng/security/advisories/GHSA-7gqc-vjwr-6rh5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-7gqc-vjwr-6rh5"
},
{
"name": "https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a"
}
],
"source": {
"advisory": "GHSA-7gqc-vjwr-6rh5",
"discovery": "UNKNOWN"
},
"title": "ntopng: Missing Authorization on System Configuration Backup Download and Listing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84990",
"datePublished": "2026-09-21T16:09:20.689Z",
"dateReserved": "2026-09-02T18:12:13.534Z",
"dateUpdated": "2026-09-29T15:08:23.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84989 (GCVE-0-2026-84989)
Vulnerability from cvelistv5 – Published: 2026-09-03 14:47 – Updated: 2026-09-03 14:55
VLAI
EPSS
VEX
Title
ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags
Summary
ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` — perform no authorization check at all. Any authenticated user, including a non-administrator ("unprivileged") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 14:54 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ntop/ntopng/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/ntop/ntopng/commit/0e41f24b367… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84989",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T14:54:08.872588Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:55:46.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ntopng",
"vendor": "ntop",
"versions": [
{
"status": "affected",
"version": "\u003e= 6.7.0, \u003c 6.7.260718"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng\u0027s tag/badge feature \u2014 `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.lua` \u2014 perform no authorization check at all. Any authenticated user, including a non-administrator (\"unprivileged\") account, can delete or rename any tag in the system, including tags created by an administrator. Version 6.7.260718 contains a fix."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:47:18.332Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ntop/ntopng/security/advisories/GHSA-43p9-5758-wwq8"
},
{
"name": "https://github.com/ntop/ntopng/commit/0e41f24b367fb9caf750459da67827326e3289e8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ntop/ntopng/commit/0e41f24b367fb9caf750459da67827326e3289e8"
}
],
"source": {
"advisory": "GHSA-43p9-5758-wwq8",
"discovery": "UNKNOWN"
},
"title": "ntopng\u0027s Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84989",
"datePublished": "2026-09-03T14:47:01.859Z",
"dateReserved": "2026-09-02T18:12:13.534Z",
"dateUpdated": "2026-09-03T14:55:46.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84908 (GCVE-0-2026-84908)
Vulnerability from cvelistv5 – Published: 2026-09-09 05:31 – Updated: 2026-09-09 13:08
VLAI
EPSS
VEX
Title
WPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action
Summary
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 13:07 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| getwpfunnels | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell |
Affected:
0 , ≤ 3.12.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T13:07:55.317127Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:08:04.132Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout \u0026 One Click Upsell",
"vendor": "getwpfunnels",
"versions": [
{
"lessThanOrEqual": "3.12.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the \u0027wpfnl_load_payment\u0027 AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T05:31:04.199Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a24d442-56f9-4f6d-bff6-0eb354249895?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L166"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L166"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L71"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.13/includes/core/offer/class-wpfnl-offer.php#L213"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L71"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.12/includes/core/offer/class-wpfnl-offer.php#L213"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3675200%40wpfunnels\u0026new=3675200%40wpfunnels"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-02T15:57:21.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-08T17:13:51.000Z",
"value": "Disclosed"
}
],
"title": "WPFunnels \u003c= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via \u0027wpfnl_load_payment\u0027 AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-84908",
"datePublished": "2026-09-09T05:31:04.199Z",
"dateReserved": "2026-09-02T15:42:15.416Z",
"dateUpdated": "2026-09-09T13:08:04.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84869 (GCVE-0-2026-84869)
Vulnerability from cvelistv5 – Published: 2026-09-08 19:29 – Updated: 2026-09-12 03:55
VLAI
EPSS
VEX
Title
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
Summary
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Severity
9.9 (Critical)
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
Assigner
References
5 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ConnectWise | ScreenConnect |
Affected:
All versions prior to 26.6.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84869",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-09-11",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-12T03:55:19.450Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-11T00:00:00.000Z",
"value": "CVE-2026-84869 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ScreenConnect",
"vendor": "ConnectWise",
"versions": [
{
"status": "affected",
"version": "All versions prior to 26.6.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
}
],
"value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T19:29:33.630Z",
"orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
"shortName": "ConnectWise"
},
"references": [
{
"url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
},
{
"url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
},
{
"url": "https://www.connectwise.com/company/trust/advisories"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cb\u003eCloud:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eUpdated to the latest release. We recommend that\npartners \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client\"\u003ereinstall their host clients\u003c/a\u003e\u003cspan\u003e and \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent\"\u003eupdate their access agents\u003c/a\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eOn-prem\u003c/b\u003e:\u0026nbsp;\u003cspan\u003eUpgrade to ScreenConnect client version \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eor later.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eAutomate-integrated ScreenConnect deployments:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eAutomate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eupdate through Automate\nProduct Updates.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Cloud:\u00a0Updated to the latest release. We recommend that\npartners reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client and update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem:\u00a0Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments:\u00a0Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. \u003cb\u003eThis is\nnot a substitute for installing the security update\u003c/b\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003eNavigate to the \u003cb\u003eAdministration \u0026gt; Security \u0026gt; Roles\u003c/b\u003e section. \u003c/li\u003e\u003cli\u003eEdit\na role, review each session group that has permissions assigned to it, and\ndeselect the \u003cb\u003eTransferFiles\u003c/b\u003e permission if it is selected.\u003c/li\u003e\u003cli\u003eSave\nyour changes. Repeat for each role.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n * Navigate to the Administration \u003e Security \u003e Roles section. \n * Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n * Save\nyour changes. Repeat for each role."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
"assignerShortName": "ConnectWise",
"cveId": "CVE-2026-84869",
"datePublished": "2026-09-08T19:29:33.630Z",
"dateReserved": "2026-09-02T13:57:51.898Z",
"dateUpdated": "2026-09-12T03:55:19.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84847 (GCVE-0-2026-84847)
Vulnerability from cvelistv5 – Published: 2026-09-03 16:32 – Updated: 2026-09-05 01:53
VLAI
EPSS
VEX
Title
WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-05 01:53 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| brightvesseldev | Quick Event Manager |
Affected:
n/a , ≤ 9.17
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84847",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-05T01:53:16.532668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-05T01:53:25.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "quick-event-manager",
"product": "Quick Event Manager",
"vendor": "brightvesseldev",
"versions": [
{
"lessThanOrEqual": "9.17",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "she11f | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in Quick Event Manager \u003c= 9.17 versions."
}
],
"value": "Unauthenticated Broken Access Control in Quick Event Manager \u003c= 9.17 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T16:32:00.540Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/quick-event-manager/vulnerability/wordpress-quick-event-manager-plugin-9-17-broken-access-control-vulnerability?_s_id=cve"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Quick Event Manager plugin \u003c= 9.17 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-84847",
"datePublished": "2026-09-03T16:32:00.540Z",
"dateReserved": "2026-09-02T12:41:07.440Z",
"dateUpdated": "2026-09-05T01:53:25.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84835 (GCVE-0-2026-84835)
Vulnerability from cvelistv5 – Published: 2026-09-02 11:52 – Updated: 2026-09-23 08:50 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 12:43 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| DimaFreund | Rentsyst |
Affected:
0 , ≤ 2.1.5
(custom)
|
Date Public
2026-09-02 11:51
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84835",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T12:43:50.683774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:44:10.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "rentsyst",
"product": "Rentsyst",
"vendor": "DimaFreund",
"versions": [
{
"lessThanOrEqual": "2.1.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "benzdeus | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-09-02T11:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Rentsyst: from n/a through 2.1.5.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T08:50:36.357Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/rentsyst/vulnerability/wordpress-rentsyst-plugin-2-1-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Rentsyst plugin \u003c= 2.1.5 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-84835",
"datePublished": "2026-09-02T11:52:49.187Z",
"dateReserved": "2026-09-02T11:51:28.200Z",
"dateUpdated": "2026-09-23T08:50:36.357Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.