Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7172 vulnerabilities reference this CWE, most recent first.

GHSA-2935-F8MX-XC5W

Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-10-27 12:00
VLAI
Details

A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-34626"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-07T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.",
  "id": "GHSA-2935-f8mx-xc5w",
  "modified": "2022-10-27T12:00:26Z",
  "published": "2022-05-24T19:07:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34626"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34626"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-297F-R9W7-W492

Vulnerability from github – Published: 2022-10-20 19:00 – Updated: 2024-04-23 17:24
VLAI
Summary
Magento Improper input validation vulnerability
Details

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privilege escalation.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.7-p4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.3-p3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "magento/community-edition"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.4"
            },
            {
              "fixed": "2.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-42344"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-23T17:24:33Z",
    "nvd_published_at": "2022-10-20T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.",
  "id": "GHSA-297f-r9w7-w492",
  "modified": "2024-04-23T17:24:33Z",
  "published": "2022-10-20T19:00:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42344"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/magento/magento2"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/magento/apsb22-38.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Magento Improper input validation vulnerability"
}

GHSA-299Q-3P96-5898

Vulnerability from github – Published: 2024-05-07 15:30 – Updated: 2024-05-08 14:01
VLAI
Summary
Apache Superset Incorrect Authorization vulnerability
Details

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2.

Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-superset"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-28148"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-07T16:53:40Z",
    "nvd_published_at": "2024-05-07T14:15:10Z",
    "severity": "MODERATE"
  },
  "details": "An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2.\n\nUsers are recommended to upgrade to version 3.1.2 or above, which fixes the issue.\n\n",
  "id": "GHSA-299q-3p96-5898",
  "modified": "2024-05-08T14:01:40Z",
  "published": "2024-05-07T15:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28148"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/superset"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Superset Incorrect Authorization vulnerability"
}

GHSA-29G7-9VCG-G9RM

Vulnerability from github – Published: 2023-11-20 09:30 – Updated: 2024-10-02 06:30
VLAI
Details

Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges.

Severity
5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-3379"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-20T08:15:44Z",
    "severity": "MODERATE"
  },
  "details": "Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker  to change the passwords of other non-admin users and thus to escalate non-root privileges.",
  "id": "GHSA-29g7-9vcg-g9rm",
  "modified": "2024-10-02T06:30:26Z",
  "published": "2023-11-20T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3379"
    },
    {
      "type": "WEB",
      "url": "https://cert.vde.com/en/advisories/VDE-2023-015"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-29GX-H2M3-XW44

Vulnerability from github – Published: 2026-10-07 18:01 – Updated: 2026-10-07 18:01
VLAI
Summary
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
Details

Impact

Scaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended.

Patches

  • @backstage/plugin-scaffolder-backend version 4.1.0
  • @backstage/plugin-scaffolder-backend-module-azure version 0.2.25
  • @backstage/plugin-scaffolder-backend-module-bitbucket-cloud version 0.3.10
  • @backstage/plugin-scaffolder-backend-module-bitbucket-server version 0.2.25
  • @backstage/plugin-scaffolder-backend-module-github version 0.9.13
  • @backstage/plugin-scaffolder-backend-module-gitlab version 0.11.10

The fix introduces a new configuration option that enforces user-provided credentials for supported SCM actions. The new behavior is opt-in for compatibility. After upgrading, set:

scaffolder:
  requireScmUserCredentials: true

Before enabling this setting, review and update your templates as described in the software templates documentation referred to below.

Workarounds

If you cannot upgrade and enable the setting immediately:

  • Restrict who can create Scaffolder tasks and which templates they can execute.
  • Limit SCM integration credentials to the minimum repository read and mutation permissions required.
  • Remove integration credentials for SCM hosts where all required operations can use explicitly supplied user tokens.
Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-github"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-gitlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.11.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-azure"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-bitbucket-cloud"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-scaffolder-backend-module-bitbucket-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.2.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106462"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T18:01:53Z",
    "nvd_published_at": "2026-10-06T21:17:17Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nScaffolder actions that interact with source control systems may not consistently enforce the intended credential boundaries under certain configurations. An authenticated user could perform operations with broader access than intended.\n\n### Patches\n\n- `@backstage/plugin-scaffolder-backend` version `4.1.0`\n- `@backstage/plugin-scaffolder-backend-module-azure` version `0.2.25`\n- `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` version `0.3.10`\n- `@backstage/plugin-scaffolder-backend-module-bitbucket-server` version `0.2.25`\n- `@backstage/plugin-scaffolder-backend-module-github` version `0.9.13`\n- `@backstage/plugin-scaffolder-backend-module-gitlab` version `0.11.10`\n\nThe fix introduces a new configuration option that enforces user-provided credentials for supported SCM actions. The new behavior is opt-in for compatibility. After upgrading, set:\n\n```yaml\nscaffolder:\n  requireScmUserCredentials: true\n```\n\nBefore enabling this setting, review and update your templates as described in the software templates documentation referred to below.\n\n### Workarounds\n\nIf you cannot upgrade and enable the setting immediately:\n\n- Restrict who can create Scaffolder tasks and which templates they can execute.\n- Limit SCM integration credentials to the minimum repository read and mutation permissions required.\n- Remove integration credentials for SCM hosts where all required operations can use explicitly supplied user tokens.",
  "id": "GHSA-29gx-h2m3-xw44",
  "modified": "2026-10-07T18:01:54Z",
  "published": "2026-10-07T18:01:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-29gx-h2m3-xw44"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106462"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/6fb2a41ea47da37eafe5ea744050ef90be6820c0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Backstage\u0027s scaffolder credential handling may allow unintended GitHub authentication fallback"
}

GHSA-29H6-3FPG-R7JH

Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2022-07-13 00:00
VLAI
Details

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-19154"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-15T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the \u0027FileManager.editFile()\u0027 function in the component \u0027modules/filemanager/FileManagerController.java\u0027.",
  "id": "GHSA-29h6-3fpg-r7jh",
  "modified": "2022-07-13T00:00:44Z",
  "published": "2022-05-24T19:14:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19154"
    },
    {
      "type": "WEB",
      "url": "https://www.seebug.org/vuldb/ssvid-97882"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-29MX-8R38-HFXQ

Vulnerability from github – Published: 2023-07-31 15:30 – Updated: 2024-03-21 03:35
VLAI
Details

** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-36092"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-31T14:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "** UNSUPPORTED WHEN ASSIGNED ** Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
  "id": "GHSA-29mx-8r38-hfxq",
  "modified": "2024-03-21T03:35:36Z",
  "published": "2023-07-31T15:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36092"
    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/security-bulletin"
    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/support"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-29R9-67VG-QJ56

Vulnerability from github – Published: 2026-10-08 16:43 – Updated: 2026-10-08 16:43
VLAI
Summary
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
Details

Summary

PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.

Root cause

ApprovalRegistry.is_already_approved (src/praisonai-agents/praisonaiagents/approval/registry.py, around line 181) returns True whenever the tool name is present in a per-run context set. The cache is keyed on tool name only — arguments are not part of the key.

approve_sync / approve_async (around lines 224-226 / 278-279) short-circuit on that cache before the approval backend is consulted.

clear_approved (around lines 186-187) is the only routine that clears the cache, but it is never invoked in the shipped library (only in tests). The cache persists for the entire agent run and is inherited by child tasks via contextvars.

Critical-tier tools (execute_command, execute_code) are exempt from the cache. But high-risk tools like write_file are not.

Proof of concept

from praisonaiagents.approval.registry import ApprovalRegistry
from praisonaiagents.approval.protocols import ApprovalDecision, ApprovalRequest

class CountingBackend:
    def __init__(self): self.prompts = []
    def request_approval_sync(self, request):
        self.prompts.append((request.tool_name, dict(request.arguments)))
        return ApprovalDecision(approved=True, reason="human approved")

backend = CountingBackend()
reg = ApprovalRegistry()
reg.set_backend(backend)
reg.add_requirement("write_file", "high")

d1 = reg.approve_sync("agent", "write_file", {"path": "/tmp/safe.txt", "content": "hi"})
# Human prompted — approves a benign write

d2 = reg.approve_sync("agent", "write_file", {"path": "/etc/crontab", "content": "* * * * * root evil"})
# NO prompt — auto-approved from cache

assert len(backend.prompts) == 1
assert d2.reason == "Already approved in context"

Negative control: execute_command (critical) re-prompts on every call — 2 prompts for 2 calls.

Impact

A write_file approval for a benign path authorizes every later write_file call in the session with arbitrary arguments. A model steered by malicious input can write to sensitive locations with no further human prompt.

Suggested fix

  • Include arguments in the approval cache key, or re-prompt on argument change.
  • Expire the cache per-call or per-turn.
  • Do not inherit the cache into child tasks.
Severity
6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.77"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-60087"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T16:43:45Z",
    "nvd_published_at": "2026-07-15T17:16:52Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nPraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt. The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.\n\n## Root cause\n\n`ApprovalRegistry.is_already_approved` (`src/praisonai-agents/praisonaiagents/approval/registry.py`, around line 181) returns `True` whenever the tool name is present in a per-run context set. The cache is keyed on tool name only \u2014 arguments are not part of the key.\n\n`approve_sync` / `approve_async` (around lines 224-226 / 278-279) short-circuit on that cache before the approval backend is consulted.\n\n`clear_approved` (around lines 186-187) is the only routine that clears the cache, but it is never invoked in the shipped library (only in tests). The cache persists for the entire agent run and is inherited by child tasks via `contextvars`.\n\nCritical-tier tools (`execute_command`, `execute_code`) are exempt from the cache. But high-risk tools like `write_file` are not.\n\n## Proof of concept\n\n```python\nfrom praisonaiagents.approval.registry import ApprovalRegistry\nfrom praisonaiagents.approval.protocols import ApprovalDecision, ApprovalRequest\n\nclass CountingBackend:\n    def __init__(self): self.prompts = []\n    def request_approval_sync(self, request):\n        self.prompts.append((request.tool_name, dict(request.arguments)))\n        return ApprovalDecision(approved=True, reason=\"human approved\")\n\nbackend = CountingBackend()\nreg = ApprovalRegistry()\nreg.set_backend(backend)\nreg.add_requirement(\"write_file\", \"high\")\n\nd1 = reg.approve_sync(\"agent\", \"write_file\", {\"path\": \"/tmp/safe.txt\", \"content\": \"hi\"})\n# Human prompted \u2014 approves a benign write\n\nd2 = reg.approve_sync(\"agent\", \"write_file\", {\"path\": \"/etc/crontab\", \"content\": \"* * * * * root evil\"})\n# NO prompt \u2014 auto-approved from cache\n\nassert len(backend.prompts) == 1\nassert d2.reason == \"Already approved in context\"\n```\n\nNegative control: `execute_command` (critical) re-prompts on every call \u2014 2 prompts for 2 calls.\n\n## Impact\n\nA `write_file` approval for a benign path authorizes every later `write_file` call in the session with arbitrary arguments. A model steered by malicious input can write to sensitive locations with no further human prompt.\n\n## Suggested fix\n\n- Include arguments in the approval cache key, or re-prompt on argument change.\n- Expire the cache per-call or per-turn.\n- Do not inherit the cache into child tasks.",
  "id": "GHSA-29r9-67vg-qj56",
  "modified": "2026-10-08T16:43:45Z",
  "published": "2026-10-08T16:43:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-29r9-67vg-qj56"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60087"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62164"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-before-tool-approval-cache-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments"
}

GHSA-29VR-79W7-P649

Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2023-07-31 20:36
Withdrawn 2023-07-31 VLAI
Summary
Duplicate Advisory: Incorrect Authorization in Gerapy
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9w7f-m4j4-j3xw. This link is maintained to preserve external references.

Original Description

An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in project_configure function.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "gerapy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-44597"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-28T14:23:45Z",
    "nvd_published_at": "2022-03-10T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9w7f-m4j4-j3xw. This link is maintained to preserve external references.\n\n## Original Description\nAn Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in project_configure function.",
  "id": "GHSA-29vr-79w7-p649",
  "modified": "2023-07-31T20:36:31Z",
  "published": "2022-03-11T00:02:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44597"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gerapy/Gerapy/issues/219"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gerapy/Gerapy/commit/49bcb19be5e0320e7e1535f34fe00f16a3cf3b28"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Gerapy/Gerapy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gerapy/Gerapy/releases/tag/v0.9.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/gerapy/PYSEC-2022-228.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Incorrect Authorization in Gerapy",
  "withdrawn": "2023-07-31T20:36:31Z"
}

GHSA-2C59-QQ5M-3QF7

Vulnerability from github – Published: 2022-05-13 01:44 – Updated: 2022-05-13 01:44
VLAI
Details

Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML authType is enabled, mishandles SAML, which allows remote attackers to bypass intended access restrictions or conduct impersonation attacks.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-17067"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-30T02:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Splunk Web in Splunk Enterprise 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when the SAML authType is enabled, mishandles SAML, which allows remote attackers to bypass intended access restrictions or conduct impersonation attacks.",
  "id": "GHSA-2c59-qq5m-3qf7",
  "modified": "2022-05-13T01:44:15Z",
  "published": "2022-05-13T01:44:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17067"
    },
    {
      "type": "WEB",
      "url": "https://www.splunk.com/view/SP-CAAAP3K"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/102005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list