Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7172 vulnerabilities reference this CWE, most recent first.

GHSA-6WW5-4467-WVXF

Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2026-08-19 18:31
VLAI
Details

Windows Hello Security Feature Bypass Vulnerability

Severity
6.1 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-42288"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-10T01:19:00Z",
    "severity": "MODERATE"
  },
  "details": "Windows Hello Security Feature Bypass Vulnerability",
  "id": "GHSA-6ww5-4467-wvxf",
  "modified": "2026-08-19T18:31:41Z",
  "published": "2022-05-24T19:20:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42288"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42288"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42288"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6WWJ-CRCH-J32J

Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-20 00:00
VLAI
Details

Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission.

Severity
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-28777"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-11T20:15:00Z",
    "severity": "LOW"
  },
  "details": "Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission.",
  "id": "GHSA-6wwj-crch-j32j",
  "modified": "2022-04-20T00:00:57Z",
  "published": "2022-04-12T00:00:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28777"
    },
    {
      "type": "WEB",
      "url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6X2M-HQFW-HVPJ

Vulnerability from github – Published: 2026-03-02 22:29 – Updated: 2026-03-02 22:29
VLAI
Summary
OpenClaw: Node exec approvals could be replayed across nodes
Details

Summary

exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.

Impact

An operator approval for a system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: <= 2026.2.22-2
  • Fixed: 2026.2.23 (released)

Mitigation

Upgrade to 2026.2.23 or later once published.

Fix Details

The fix requires and persists nodeId for host=node approval requests and rejects execution when the approving node binding does not match the invoking node.

Fix Commit(s)

  • 4a3f8438e527ac371a67fe7ac68a287f0dbe6063

Release Process Note

patched_versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.

OpenClaw thanks @tdjackey for reporting.

Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.23"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-02T22:29:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n`exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.\n\n## Impact\nAn operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.22-2`\n- Fixed: `2026.2.23` (released)\n\n## Mitigation\nUpgrade to `2026.2.23` or later once published.\n\n## Fix Details\nThe fix requires and persists `nodeId` for `host=node` approval requests and rejects execution when the approving node binding does not match the invoking node.\n\n## Fix Commit(s)\n- 4a3f8438e527ac371a67fe7ac68a287f0dbe6063\n\n## Release Process Note\n`patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-6x2m-hqfw-hvpj",
  "modified": "2026-03-02T22:29:45Z",
  "published": "2026-03-02T22:29:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-6x2m-hqfw-hvpj"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/4a3f8438e527ac371a67fe7ac68a287f0dbe6063"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Node exec approvals could be replayed across nodes"
}

GHSA-6X33-FGPV-F89F

Vulnerability from github – Published: 2022-05-24 19:21 – Updated: 2022-07-13 00:00
VLAI
Details

Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denial of service via local access.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-0110"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-17T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denial of service via local access.",
  "id": "GHSA-6x33-fgpv-f89f",
  "modified": "2022-07-13T00:00:54Z",
  "published": "2022-05-24T19:21:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0110"
    },
    {
      "type": "WEB",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00533.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6X34-89P7-95WG

Vulnerability from github – Published: 2026-03-03 14:50 – Updated: 2026-03-03 14:50
VLAI
Summary
Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
Details

Impact

An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation through cluster role template binding (CRTB) and project role template binding (PRTB). This issue does not affect the local cluster, it affects only downstream clusters.

The vulnerability can be exploited by any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster.

  • The user must have kubectl access in the local cluster to exploit this scenario.

  • This can only be abused to gain cluster-owner permission on a different downstream cluster if the user is already cluster-owner on at least one downstream cluster.

  • Example of a modified CRTB (note: the clusterName points to the cluster ID of the cluster that the privileges will be escalated and namespace points to the current cluster ID that the user has permissions):

kubectl edit clusterroletemplatebindings crtb-<crtb-ID> -n c-<cluster-ID>
---
apiVersion: management.cattle.io/v3
clusterName: <ID-of-the-cluster-to-escalate>
kind: ClusterRoleTemplateBinding
metadata:
  annotations:
    <omitted> 
  finalizers:
  - <omitted> 
  generateName: crtb-
  labels:
    <omitted> 
    cattle.io/creator: norman
  name: crtb-<crtb-ID>
  namespace: c-<current-cluster-ID>
roleTemplateName: cluster-owner
userName: u-<user-ID>
userPrincipalName: local://u-<user-ID>

An artifact to flag the exploitation of this issue is that the namespace of the CRTB/PRTB will not match the cluster name (clusterName) of the CRTB/PRTB. For example, every CRTB in the c-123xyz namespace should have a cluster name of c-123xyz. If instead, the cluster name is c-abc567, for example, this is likely a result of a user exploiting this flaw.

For more information about cluster and project roles, please consult Rancher's documentation.

Patches

Patched versions include releases 2.5.16, 2.6.7 and later versions.

Workarounds

Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.

Important: - It is highly advised to check the local and downstream clusters for potential unrecognized CRTBs (kubectl get clusterroletemplatebindings -A) and PRTBs (kubectl get projectroletemplatebindings -A) assignments. - The ability to add other users to projects and clusters is a highly-privileged permission which may result in users being able to operate beyond their explicitly specified RBAC. It is recommended that this permission be granted selectively.

The following script can be used as a helper to detect possible deviations of CRTBs and PRTBs that do not match the expected value. Further investigation is required to determine if the flagged objects were maliciously modified or not. The script requires kubectl access to the local cluster and the jq command.

#!/usr/bin/env bash

echo "CRTBs that don't match cluster:"
kubectl get clusterroletemplatebindings -A -o=jsonpath="{range .items[?(@.clusterName!=@.metadata.namespace)]}{.metadata.name}{'\n'}{end}"

echo "PRTBs that don't match project:"
kubectl get projectroletemplatebindings -A -ojson | jq -r '.items[]|.metadata as $m|select(.projectName|endswith($m.namespace)|not)|.metadata.name'

For more information

If you have any questions or comments about this advisory:

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.5.15"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.5.0"
            },
            {
              "fixed": "2.5.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.6.6"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "2.6.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T14:50:12Z",
    "nvd_published_at": "2022-09-07T09:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nAn issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation through cluster role template binding (CRTB) and project role template binding (PRTB). This issue does not affect the local cluster, it affects only downstream clusters.\n\nThe vulnerability can be exploited by any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as `cluster-owner`, `manage cluster members`, `project-owner` and `manage project members`) to gain `owner` permission in another project in the same cluster or in another project on a different downstream cluster.\n\n   - The user must have `kubectl` access in the local cluster to exploit this scenario.\n\n   - This can only be abused to gain `cluster-owner` permission on a different downstream cluster if the user is already `cluster-owner` on at least one downstream cluster.\n\n   - Example of a modified CRTB (note: the `clusterName` points to the cluster ID of the cluster that the privileges will be escalated and `namespace` points to the current cluster ID that the user has permissions):\n```\nkubectl edit clusterroletemplatebindings crtb-\u003ccrtb-ID\u003e -n c-\u003ccluster-ID\u003e\n---\napiVersion: management.cattle.io/v3\nclusterName: \u003cID-of-the-cluster-to-escalate\u003e\nkind: ClusterRoleTemplateBinding\nmetadata:\n  annotations:\n    \u003comitted\u003e \n  finalizers:\n  - \u003comitted\u003e \n  generateName: crtb-\n  labels:\n    \u003comitted\u003e \n    cattle.io/creator: norman\n  name: crtb-\u003ccrtb-ID\u003e\n  namespace: c-\u003ccurrent-cluster-ID\u003e\nroleTemplateName: cluster-owner\nuserName: u-\u003cuser-ID\u003e\nuserPrincipalName: local://u-\u003cuser-ID\u003e\n```\n\nAn artifact to flag the exploitation of this issue is that the `namespace` of the CRTB/PRTB will not match the cluster name (`clusterName`) of the CRTB/PRTB. For example, every CRTB in the `c-123xyz` namespace should have a cluster name of `c-123xyz`. If instead, the cluster name is `c-abc567`, for example, this is likely a result of a user exploiting this flaw.\n\nFor more information about cluster and project roles, please consult Rancher\u0027s [documentation](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/).\n\n### Patches\n\nPatched versions include releases 2.5.16, 2.6.7 and later versions.\n\n### Workarounds\n\nLimit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.\n\n**Important:**\n- It is highly advised to check the local and downstream clusters for potential unrecognized CRTBs (`kubectl get clusterroletemplatebindings -A`) and PRTBs (`kubectl get projectroletemplatebindings -A`) assignments.\n- The ability to add other users to projects and clusters is a highly-privileged permission which may result in users being able to operate beyond their explicitly specified RBAC. It is recommended that this permission be granted selectively.\n\nThe following script can be used as a helper to detect possible deviations of CRTBs and PRTBs that do not match the expected value. Further investigation is required to determine if the flagged objects were maliciously modified or not. The script requires `kubectl` access to the `local` cluster and the `jq` command.\n\n```shell\n#!/usr/bin/env bash\n\necho \"CRTBs that don\u0027t match cluster:\"\nkubectl get clusterroletemplatebindings -A -o=jsonpath=\"{range .items[?(@.clusterName!=@.metadata.namespace)]}{.metadata.name}{\u0027\\n\u0027}{end}\"\n\necho \"PRTBs that don\u0027t match project:\"\nkubectl get projectroletemplatebindings -A -ojson | jq -r \u0027.items[]|.metadata as $m|select(.projectName|endswith($m.namespace)|not)|.metadata.name\u0027\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
  "id": "GHSA-6x34-89p7-95wg",
  "modified": "2026-03-03T14:50:12Z",
  "published": "2026-03-03T14:50:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-6x34-89p7-95wg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31247"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1199730"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)"
}

GHSA-6X4F-H7G4-FCW2

Vulnerability from github – Published: 2023-07-18 03:30 – Updated: 2024-04-04 06:12
VLAI
Details

The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.

Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-3459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-18T03:15:55Z",
    "severity": "HIGH"
  },
  "details": "The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027hf_update_customer\u0027 function called via an AJAX action in versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with shop manager-level permissions to change user passwords and potentially take over administrator accounts.",
  "id": "GHSA-6x4f-h7g4-fcw2",
  "modified": "2024-04-04T06:12:28Z",
  "published": "2023-07-18T03:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3459"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/users-customers-import-export-for-wp-woocommerce/tags/2.4.1/admin/modules/user/import/import.php#L446"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2938705/users-customers-import-export-for-wp-woocommerce#file201"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/47337214-9cc3-4b12-bb71-9acbab3649b7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6X5Q-X4XW-V9VX

Vulnerability from github – Published: 2026-09-02 15:34 – Updated: 2026-09-02 15:34
VLAI
Details

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-8945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T15:17:36Z",
    "severity": "MODERATE"
  },
  "details": "The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.",
  "id": "GHSA-6x5q-x4xw-v9vx",
  "modified": "2026-09-02T15:34:49Z",
  "published": "2026-09-02T15:34:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8945"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/37cec6e0-a349-4cc7-971d-b370bc733ab6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6X77-892J-XM83

Vulnerability from github – Published: 2022-05-24 19:01 – Updated: 2022-05-24 19:01
VLAI
Details

On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the 'Administrator' role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-23015"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-10T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mode, an authenticated user assigned the \u0027Administrator\u0027 role may be able to bypass Appliance Mode restrictions utilizing undisclosed iControl REST endpoints. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-6x77-892j-xm83",
  "modified": "2022-05-24T19:01:54Z",
  "published": "2022-05-24T19:01:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23015"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K74151369"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-6X82-GHMG-H6PG

Vulnerability from github – Published: 2026-09-09 03:30 – Updated: 2026-09-09 15:35
VLAI
Details

Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-87644"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T01:17:22Z",
    "severity": "HIGH"
  },
  "details": "Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-6x82-ghmg-h6pg",
  "modified": "2026-09-09T15:35:03Z",
  "published": "2026-09-09T03:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87644"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/521616899"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-6X88-35M6-5R8V

Vulnerability from github – Published: 2026-08-25 21:31 – Updated: 2026-08-26 18:31
VLAI
Details

Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Severity
8.3 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-78911"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-25T21:17:48Z",
    "severity": "HIGH"
  },
  "details": "Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)",
  "id": "GHSA-6x88-35m6-5r8v",
  "modified": "2026-08-26T18:31:36Z",
  "published": "2026-08-25T21:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78911"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/517742721"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list