Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7172 vulnerabilities reference this CWE, most recent first.

GHSA-6R4H-VW53-WMVV

Vulnerability from github – Published: 2022-05-13 01:16 – Updated: 2022-05-13 01:16
VLAI
Details

On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-1057"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-13T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users\u0027 passwords, including administrative users and privileged service accounts (eg Domain Controllers).",
  "id": "GHSA-6r4h-vw53-wmvv",
  "modified": "2022-05-13T01:16:28Z",
  "published": "2022-05-13T01:16:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1057"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553553"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201805-07"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20180313-0001"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3595-1"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4135"
    },
    {
      "type": "WEB",
      "url": "https://www.samba.org/samba/security/CVE-2018-1057.html"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/support/security/Synology_SA_18_08"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103382"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1040494"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6R66-34X7-46RG

Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2025-04-20 03:49
VLAI
Details

In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.

Severity
8.8 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-0910"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-27T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm.",
  "id": "GHSA-6r66-34x7-46rg",
  "modified": "2025-04-20T03:49:11Z",
  "published": "2022-05-13T01:38:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0910"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32"
    },
    {
      "type": "WEB",
      "url": "http://blog.zulip.org/2017/11/23/zulip-1-7-1-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6R7F-3FWQ-HQ74

Vulnerability from github – Published: 2026-03-09 17:28 – Updated: 2026-03-10 18:43
VLAI
Summary
Kubewarden: Cross-namespace data exfiltration via deprecated host callback binding
Details

Impact

Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionPolicyGroups in their Namespaces. One of Kubewarden promises is that configured users can deploy namespaced policies in a safe manner, without privilege escalation.

An attacker with privileged "AdmissionPolicy" create permissions (which isn't the default) could make use of 3 deprecated host-callback APIs: kubernetes/ingresses, kubernetes/namespaces, kubernetes/services. The attacker can craft a policy that exercises these deprecated API calls and would allow them read access to Ingresses, Namespaces, and Services resources respectively.

This attack is read-only, there is no write capability and no access to Secrets, ConfigMaps, or other resource types beyond these three. The attacker could read for example: - Namespace names and labels. - Services across all namespaces with ClusterIPs and ports to reveal cluster internal topology. - Ingresses across all namespaces with hostnames and routing rules.

Patches

The vulnerable, already deprecated host-capabilities (kubernetes/ingresses, kubernetes/namespaces, kubernetes/services) have been removed.

The removed calls were not being exercised by any Kubewarden SDK.

These host-callbacks had already been superseded for a long time by kubewarden/kubernetes/list_resources_by_namespace, kubewarden/kubernetes/list_resources, and kubewarden/kubernetes/get_resource. They provide similar capabilities while being more fine-grained, performant, and gated through our context-aware permissions feature. These current host-capabilities are part of the Kubernetes capabilities listed in our docs.

Workarounds

Kubewarden operators can update the policy-server image used by their PolicyServers to tag :v1.33.0. Alternatively, Kubewarden operators can temporarily reduce the permissions of users to prevent them from creating or updating existing namespaced AdmissionPolicies or AdmissionPolicyGroups.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubewarden/kubewarden-controller"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.33.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-29773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-09T17:28:38Z",
    "nvd_published_at": "2026-03-10T17:39:03Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nKubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy namespaced AdmissionPolicies and AdmissionPolicyGroups in their Namespaces. One of Kubewarden promises is that configured users can deploy namespaced policies in a safe manner, without privilege escalation.\n\nAn attacker with privileged \"AdmissionPolicy\" create permissions (which isn\u0027t the default) could make use of 3 deprecated host-callback APIs: `kubernetes/ingresses`, `kubernetes/namespaces`, `kubernetes/services`.\nThe attacker can craft a policy that exercises these deprecated API calls and would allow them read access to Ingresses, Namespaces, and Services resources respectively.\n\nThis attack is read-only, there is no write capability and no access to Secrets, ConfigMaps, or other resource types beyond these three. The attacker could read for example:\n- Namespace names and labels.\n- Services across all namespaces with ClusterIPs and ports to reveal cluster internal topology.\n- Ingresses across all namespaces with hostnames and routing rules.\n\n### Patches\nThe vulnerable, already deprecated host-capabilities (`kubernetes/ingresses`, `kubernetes/namespaces`, `kubernetes/services`)\nhave been removed.\n\nThe removed calls were not being exercised by any Kubewarden SDK.\n\nThese host-callbacks had already been superseded for a long time by `kubewarden/kubernetes/list_resources_by_namespace`, `kubewarden/kubernetes/list_resources`, and `kubewarden/kubernetes/get_resource`. They provide similar capabilities while being more fine-grained, performant, and gated through our context-aware permissions feature. These current host-capabilities are part of the Kubernetes capabilities listed in our [docs](https://docs.kubewarden.io/reference/spec/host-capabilities/kubernetes).\n\n### Workarounds\nKubewarden operators can update the policy-server image used by their PolicyServers to tag `:v1.33.0`.\nAlternatively, Kubewarden operators can temporarily reduce the permissions of users to prevent them from creating or updating existing namespaced AdmissionPolicies or AdmissionPolicyGroups.",
  "id": "GHSA-6r7f-3fwq-hq74",
  "modified": "2026-03-10T18:43:12Z",
  "published": "2026-03-09T17:28:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kubewarden/kubewarden-controller/security/advisories/GHSA-6r7f-3fwq-hq74"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29773"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubewarden/kubewarden-controller/pull/1519"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubewarden/kubewarden-controller/commit/4e41b60ae44902d82d94101bac93fb77cae65651"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubewarden/kubewarden-controller"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Kubewarden: Cross-namespace data exfiltration via deprecated host callback binding"
}

GHSA-6RCP-VXWF-3MFP

Vulnerability from github – Published: 2026-03-03 19:46 – Updated: 2026-03-30 13:36
VLAI
Summary
OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text
Details

Summary

In openclaw up to and including 2026.2.23 (latest npm release as of February 25, 2026), system.run shell-wrapper inputs could present misleading approval/display text while still carrying hidden positional argv payloads that execute at runtime.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.23
  • Patched: >= 2026.2.24 (planned next release)

Root Cause

For shell-wrapper forms (for example /bin/sh -c ...), command-text binding could focus on inline shell payload text while runtime execution still used the full argv vector. Positional argv carriers after the inline payload could therefore be executed under incomplete display context.

Security Impact

Approval/display context could omit executed argv carriers, enabling hidden command execution under misleading operator-visible text.

Fix

  • Detect shell-wrapper inline-command forms that carry trailing positional argv values.
  • Bind approval/display command text to full formatted argv for those carrier forms.
  • Reject payload-only rawCommand values when they do not match the execution-bound argv context for those forms.
  • Forward canonical command display text to the macOS companion exec host and validate rawCommand/argv consistency there for carrier wrappers and env-modifier shell preludes.

Verification

  • pnpm check
  • pnpm exec vitest run --config vitest.gateway.config.ts
  • pnpm test:fast
  • pnpm vitest run src/infra/system-run-command.test.ts src/node-host/invoke-system-run.test.ts src/cli/nodes-cli.coverage.test.ts src/gateway/node-invoke-system-run-approval.test.ts
  • cd apps/macos && swift test --filter ExecSystemRunCommandValidatorTests

Fix Commit(s)

  • 0f0a680d3df81739ea5088a2f88e65f938b7936b
  • 55cf92578d266987e390c4bf688196af98eac748

Release Process Note

patched_versions is pre-set to the planned next release (2026.2.24) so after npm publish the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.

Publication Update (2026-02-25)

openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks >= 2026.2.24 as patched.

Severity
5.8 (Medium)
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.2.23"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-436",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T19:46:42Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nIn `openclaw` up to and including **2026.2.23** (latest npm release as of **February 25, 2026**), `system.run` shell-wrapper inputs could present misleading approval/display text while still carrying hidden positional argv payloads that execute at runtime.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.23`\n- Patched: `\u003e= 2026.2.24` (planned next release)\n\n### Root Cause\nFor shell-wrapper forms (for example `/bin/sh -c ...`), command-text binding could focus on inline shell payload text while runtime execution still used the full argv vector. Positional argv carriers after the inline payload could therefore be executed under incomplete display context.\n\n### Security Impact\nApproval/display context could omit executed argv carriers, enabling hidden command execution under misleading operator-visible text.\n\n### Fix\n- Detect shell-wrapper inline-command forms that carry trailing positional argv values.\n- Bind approval/display command text to full formatted argv for those carrier forms.\n- Reject payload-only `rawCommand` values when they do not match the execution-bound argv context for those forms.\n- Forward canonical command display text to the macOS companion exec host and validate `rawCommand`/argv consistency there for carrier wrappers and env-modifier shell preludes.\n\n### Verification\n- `pnpm check`\n- `pnpm exec vitest run --config vitest.gateway.config.ts`\n- `pnpm test:fast`\n- `pnpm vitest run src/infra/system-run-command.test.ts src/node-host/invoke-system-run.test.ts src/cli/nodes-cli.coverage.test.ts src/gateway/node-invoke-system-run-approval.test.ts`\n- `cd apps/macos \u0026\u0026 swift test --filter ExecSystemRunCommandValidatorTests`\n\n### Fix Commit(s)\n- `0f0a680d3df81739ea5088a2f88e65f938b7936b`\n- `55cf92578d266987e390c4bf688196af98eac748`\n\n### Release Process Note\n`patched_versions` is pre-set to the planned next release (`2026.2.24`) so after npm publish the advisory can be published without further field edits.\n\nOpenClaw thanks @tdjackey for reporting.\n\n\n### Publication Update (2026-02-25)\n`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `\u003e= 2026.2.24` as patched.",
  "id": "GHSA-6rcp-vxwf-3mfp",
  "modified": "2026-03-30T13:36:43Z",
  "published": "2026-03-03T19:46:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-6rcp-vxwf-3mfp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32052"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/0f0a680d3df81739ea5088a2f88e65f938b7936b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/55cf92578d266987e390c4bf688196af98eac748"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-hidden-command-execution-via-shell-wrapper-positional-argv-carriers"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw\u0027s system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text"
}

GHSA-6RFJ-PJGC-MV6H

Vulnerability from github – Published: 2026-09-01 12:31 – Updated: 2026-09-01 12:31
VLAI
Details

Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-76111"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T12:17:47Z",
    "severity": "HIGH"
  },
  "details": "Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation.",
  "id": "GHSA-6rfj-pjgc-mv6h",
  "modified": "2026-09-01T12:31:50Z",
  "published": "2026-09-01T12:31:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76111"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000497829/dsa-2026-330-dell-powerstore-t-security-update-for-multiple-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RGF-4C44-8HWH

Vulnerability from github – Published: 2022-05-24 17:31 – Updated: 2022-05-27 00:01
VLAI
Details

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The vulnerability is due to insufficient validation of URLs when portal access rules are configured. An attacker could exploit this vulnerability by accessing certain URLs on the affected device.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-3578"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-21T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass a configured access rule and access parts of the WebVPN portal that are supposed to be blocked. The vulnerability is due to insufficient validation of URLs when portal access rules are configured. An attacker could exploit this vulnerability by accessing certain URLs on the affected device.",
  "id": "GHSA-6rgf-4c44-8hwh",
  "modified": "2022-05-27T00:01:01Z",
  "published": "2022-05-24T17:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3578"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rule-bypass-P73ABNWQ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RJW-MCJC-47CH

Vulnerability from github – Published: 2026-09-08 15:31 – Updated: 2026-09-08 15:31
VLAI
Details

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.

Severity
7.4 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
6.4 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-33388"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T14:17:22Z",
    "severity": "MODERATE"
  },
  "details": "An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry\u0027s configuration may be able to indirectly obtain the credentials.",
  "id": "GHSA-6rjw-mcjc-47ch",
  "modified": "2026-09-08T15:31:54Z",
  "published": "2026-09-08T15:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33388"
    },
    {
      "type": "WEB",
      "url": "https://security.nozominetworks.com/NN-2026:19-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-6RMP-2HGM-CPRX

Vulnerability from github – Published: 2022-05-24 17:25 – Updated: 2024-04-04 02:55
VLAI
Details

Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-15868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-12T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "Sonatype Nexus Repository Manager OSS/Pro before 3.26.0 has Incorrect Access Control.",
  "id": "GHSA-6rmp-2hgm-cprx",
  "modified": "2024-04-04T02:55:36Z",
  "published": "2022-05-24T17:25:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15868"
    },
    {
      "type": "WEB",
      "url": "https://support.sonatype.com/hc/en-us/articles/360052192533"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6RQ7-CJMJ-RC58

Vulnerability from github – Published: 2026-09-05 15:30 – Updated: 2026-09-05 15:30
VLAI
Details

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-86193"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-05T13:18:14Z",
    "severity": "HIGH"
  },
  "details": "grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative control.",
  "id": "GHSA-6rq7-cjmj-rc58",
  "modified": "2026-09-05T15:30:25Z",
  "published": "2026-09-05T15:30:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-vv8m-jqpm-38x4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86193"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/grav-api-plugin-authentication-bypass-via-group-inherited-super"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-6V32-FJC9-9QF6

Vulnerability from github – Published: 2026-06-15 20:36 – Updated: 2026-07-18 17:26
VLAI
Summary
Nest: Middleware Bypass on Fastify via Trailing Slash
Details

Impact

An authentication bypass vulnerability exists in @nestjs/platform-fastify (confirmed on version 11.1.24, the latest available release at time of report). When middleware is registered through NestJS's MiddlewareConsumer.forRoutes() API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (/) to the request URL.

This bypass works on the default Fastify adapter configuration — no special router options need to be enabled. Applications using the standard CRUD route shape (GET /resource and GET /resource/:id) are affected when they protect those routes with MiddlewareConsumer.forRoutes() middleware.

Patches

Fixed in @nestjs/platform-fastify@11.1.24

References

Kudos goes to @a-tt-om

Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 11.1.23"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@nestjs/platform-fastify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.1.24"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54281"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-15T20:36:43Z",
    "nvd_published_at": "2026-06-22T22:16:49Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAn authentication bypass vulnerability exists in `@nestjs/platform-fastify` (confirmed on version `11.1.24`, the latest available release at time of report). When middleware is registered through NestJS\u0027s `MiddlewareConsumer.forRoutes()` API on the Fastify adapter, an unauthenticated client can bypass the Nest middleware registered for that route by simply appending a trailing slash (`/`) to the request URL.\n\nThis bypass works on the **default Fastify adapter configuration** \u2014 no special router options need to be enabled. Applications using the standard CRUD route shape (`GET /resource` and `GET /resource/:id`) are affected when they protect those routes with `MiddlewareConsumer.forRoutes()` middleware.\n\n### Patches\n\nFixed in `@nestjs/platform-fastify@11.1.24`\n\n### References\n\nKudos goes to @a-tt-om",
  "id": "GHSA-6v32-fjc9-9qf6",
  "modified": "2026-07-18T17:26:42Z",
  "published": "2026-06-15T20:36:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nestjs/nest/security/advisories/GHSA-6v32-fjc9-9qf6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54281"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nestjs/nest"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nest: Middleware Bypass on Fastify via Trailing Slash"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list