Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7172 vulnerabilities reference this CWE, most recent first.

GHSA-C24Q-2G88-PP57

Vulnerability from github – Published: 2026-09-21 15:32 – Updated: 2026-09-30 15:31
VLAI
Details

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-80110"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-21T15:17:32Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA\u0027s profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority\u0027s issuance policy.",
  "id": "GHSA-c24q-2g88-pp57",
  "modified": "2026-09-30T15:31:03Z",
  "published": "2026-09-21T15:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80110"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:73765"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:73766"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-80110"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523749"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C2C9-MFW7-P8HW

Vulnerability from github – Published: 2026-05-20 15:45 – Updated: 2026-07-20 13:35
VLAI
Summary
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
Details

Summary

The /api/v1/chatflows/apikey/:apikey endpoint (whitelisted, accessible with API key auth only) returns all chatflows bound to the provided API key AND all chatflows across the entire system that have no API key assigned. This crosses workspace boundaries, allowing a user in Workspace A who has a valid API key to read the full configuration (including flowData, chatbotConfig, system prompts, and node configurations) of chatflows from Workspace B, Workspace C, and all other workspaces, as long as those chatflows have no API key assigned.

Details

The controller at packages/server/src/controllers/chatflows/index.ts:90-107 validates the API key and calls the service:

const getChatflowByApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        const apikey = await apiKeyService.getApiKey(req.params.apikey)
        if (\!apikey) {
            return res.status(401).send("Unauthorized")
        }
        const apiResponse = await chatflowsService.getChatflowByApiKey(apikey.id, req.query.keyonly)
        return res.json(apiResponse)  // Returns full chatflow objects with flowData
    } catch (error) {
        next(error)
    }
}

The service at packages/server/src/services/chatflows/index.ts:223-245 builds the database query:

const getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown): Promise<any> => {
    const appServer = getRunningExpressApp()
    let query = appServer.AppDataSource.getRepository(ChatFlow)
        .createQueryBuilder("cf")
        .where("cf.apikeyid = :apikeyid", { apikeyid: apiKeyId })
    if (keyonly === undefined) {
        // When keyonly is not set (default), also return ALL chatflows with no API key
        query = query.orWhere("cf.apikeyid IS NULL").orWhere("cf.apikeyid = ''")
    }
    const dbResponse = await query.orderBy("cf.name", "ASC").getMany()
    return dbResponse  // Returns full ChatFlow entities including flowData
}

When keyonly is not provided as a query parameter (which is the default case), the query expands to include: - All chatflows bound to the provided API key (same workspace, expected behavior) - ALL chatflows with apikeyid IS NULL (any workspace, no workspace filter) - ALL chatflows with empty apikeyid (any workspace, no workspace filter)

There is NO workspaceId filter in this query. The response includes the full ChatFlow entity, which contains: - flowData - the complete workflow graph including system prompts, model names, internal URLs, custom code - chatbotConfig - chatbot configuration including allowed origins - apiConfig - API configuration and override settings - textToSpeech / speechToText - TTS/STT configuration including credential IDs - analytic - analytics configuration

PoC

# Step 1: Attacker has a valid API key for Workspace A
API_KEY="<attacker-workspace-a-api-key>"

# Step 2: Query the chatflows/apikey endpoint WITHOUT keyonly parameter
# Returns the attacker chatflows PLUS all chatflows without API keys from ALL workspaces
curl -s "http://localhost:3000/api/v1/chatflows/apikey/" | jq ".[].workspaceId"

# Step 3: With keyonly parameter, only chatflows bound to the API key are returned
curl -s "http://localhost:3000/api/v1/chatflows/apikey/?keyonly=true" | jq ".[].workspaceId"

Impact

  • Cross-Workspace Information Disclosure: A user in any workspace can read the full configuration of chatflows from all other workspaces that do not have an API key assigned. This breaks workspace isolation.
  • Intellectual Property Exposure: System prompts, custom function code, and workflow architecture of chatflows from other workspaces/organizations are exposed.
  • Credential Reference Leakage: The textToSpeech and speechToText fields include credential IDs, which can be abused via the TTS generate endpoint.
  • Amplified by Default: Most chatflows are created without an API key assigned (API keys are opt-in), so the majority of chatflows in a multi-workspace deployment are affected.

Recommended Fix

Add workspace scoping to the getChatflowByApiKey query by passing the API key workspace ID and filtering the OR clause:

// packages/server/src/services/chatflows/index.ts
const getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown, workspaceId?: string): Promise<any> => {
    const appServer = getRunningExpressApp()
    let query = appServer.AppDataSource.getRepository(ChatFlow)
        .createQueryBuilder("cf")
        .where("cf.apikeyid = :apikeyid", { apikeyid: apiKeyId })
    if (keyonly === undefined && workspaceId) {
        // Only include unprotected chatflows from the SAME workspace
        query = query.orWhere(
            "(cf.apikeyid IS NULL OR cf.apikeyid = :empty) AND cf.workspaceId = :workspaceId",
            { empty: "", workspaceId }
        )
    }
    const dbResponse = await query.orderBy("cf.name", "ASC").getMany()
    return dbResponse
}
Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56268"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-20T15:45:19Z",
    "nvd_published_at": "2026-06-22T22:16:51Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/api/v1/chatflows/apikey/:apikey` endpoint (whitelisted, accessible with API key auth only) returns all chatflows bound to the provided API key AND all chatflows across the entire system that have no API key assigned. This crosses workspace boundaries, allowing a user in Workspace A who has a valid API key to read the full configuration (including flowData, chatbotConfig, system prompts, and node configurations) of chatflows from Workspace B, Workspace C, and all other workspaces, as long as those chatflows have no API key assigned.\n\n## Details\n\nThe controller at `packages/server/src/controllers/chatflows/index.ts:90-107` validates the API key and calls the service:\n\n```typescript\nconst getChatflowByApiKey = async (req: Request, res: Response, next: NextFunction) =\u003e {\n    try {\n        const apikey = await apiKeyService.getApiKey(req.params.apikey)\n        if (\\!apikey) {\n            return res.status(401).send(\"Unauthorized\")\n        }\n        const apiResponse = await chatflowsService.getChatflowByApiKey(apikey.id, req.query.keyonly)\n        return res.json(apiResponse)  // Returns full chatflow objects with flowData\n    } catch (error) {\n        next(error)\n    }\n}\n```\n\nThe service at `packages/server/src/services/chatflows/index.ts:223-245` builds the database query:\n\n```typescript\nconst getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown): Promise\u003cany\u003e =\u003e {\n    const appServer = getRunningExpressApp()\n    let query = appServer.AppDataSource.getRepository(ChatFlow)\n        .createQueryBuilder(\"cf\")\n        .where(\"cf.apikeyid = :apikeyid\", { apikeyid: apiKeyId })\n    if (keyonly === undefined) {\n        // When keyonly is not set (default), also return ALL chatflows with no API key\n        query = query.orWhere(\"cf.apikeyid IS NULL\").orWhere(\"cf.apikeyid = \u0027\u0027\")\n    }\n    const dbResponse = await query.orderBy(\"cf.name\", \"ASC\").getMany()\n    return dbResponse  // Returns full ChatFlow entities including flowData\n}\n```\n\nWhen `keyonly` is not provided as a query parameter (which is the default case), the query expands to include:\n- All chatflows bound to the provided API key (same workspace, expected behavior)\n- ALL chatflows with `apikeyid IS NULL` (any workspace, no workspace filter)\n- ALL chatflows with empty `apikeyid` (any workspace, no workspace filter)\n\nThere is NO `workspaceId` filter in this query. The response includes the full `ChatFlow` entity, which contains:\n- `flowData` - the complete workflow graph including system prompts, model names, internal URLs, custom code\n- `chatbotConfig` - chatbot configuration including allowed origins\n- `apiConfig` - API configuration and override settings\n- `textToSpeech` / `speechToText` - TTS/STT configuration including credential IDs\n- `analytic` - analytics configuration\n\n## PoC\n\n```bash\n# Step 1: Attacker has a valid API key for Workspace A\nAPI_KEY=\"\u003cattacker-workspace-a-api-key\u003e\"\n\n# Step 2: Query the chatflows/apikey endpoint WITHOUT keyonly parameter\n# Returns the attacker chatflows PLUS all chatflows without API keys from ALL workspaces\ncurl -s \"http://localhost:3000/api/v1/chatflows/apikey/\" | jq \".[].workspaceId\"\n\n# Step 3: With keyonly parameter, only chatflows bound to the API key are returned\ncurl -s \"http://localhost:3000/api/v1/chatflows/apikey/?keyonly=true\" | jq \".[].workspaceId\"\n```\n\n## Impact\n\n- **Cross-Workspace Information Disclosure**: A user in any workspace can read the full configuration of chatflows from all other workspaces that do not have an API key assigned. This breaks workspace isolation.\n- **Intellectual Property Exposure**: System prompts, custom function code, and workflow architecture of chatflows from other workspaces/organizations are exposed.\n- **Credential Reference Leakage**: The `textToSpeech` and `speechToText` fields include credential IDs, which can be abused via the TTS generate endpoint.\n- **Amplified by Default**: Most chatflows are created without an API key assigned (API keys are opt-in), so the majority of chatflows in a multi-workspace deployment are affected.\n\n## Recommended Fix\n\nAdd workspace scoping to the `getChatflowByApiKey` query by passing the API key workspace ID and filtering the OR clause:\n\n```typescript\n// packages/server/src/services/chatflows/index.ts\nconst getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown, workspaceId?: string): Promise\u003cany\u003e =\u003e {\n    const appServer = getRunningExpressApp()\n    let query = appServer.AppDataSource.getRepository(ChatFlow)\n        .createQueryBuilder(\"cf\")\n        .where(\"cf.apikeyid = :apikeyid\", { apikeyid: apiKeyId })\n    if (keyonly === undefined \u0026\u0026 workspaceId) {\n        // Only include unprotected chatflows from the SAME workspace\n        query = query.orWhere(\n            \"(cf.apikeyid IS NULL OR cf.apikeyid = :empty) AND cf.workspaceId = :workspaceId\",\n            { empty: \"\", workspaceId }\n        )\n    }\n    const dbResponse = await query.orderBy(\"cf.name\", \"ASC\").getMany()\n    return dbResponse\n}\n```",
  "id": "GHSA-c2c9-mfw7-p8hw",
  "modified": "2026-07-20T13:35:08Z",
  "published": "2026-05-20T15:45:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56268"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/flowise-cross-workspace-information-disclosure-via-chatflows-apikey-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows"
}

GHSA-C2HX-PWR4-GFHP

Vulnerability from github – Published: 2025-10-17 21:31 – Updated: 2025-10-18 03:30
VLAI
Details

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-62648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-17T21:15:37Z",
    "severity": "MODERATE"
  },
  "details": "The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.",
  "id": "GHSA-c2hx-pwr4-gfhp",
  "modified": "2025-10-18T03:30:24Z",
  "published": "2025-10-17T21:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62648"
    },
    {
      "type": "WEB",
      "url": "https://archive.today/fMYQp"
    },
    {
      "type": "WEB",
      "url": "https://bobdahacker.com/blog/rbi-hacked-drive-thrus"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus"
    },
    {
      "type": "WEB",
      "url": "https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers"
    },
    {
      "type": "WEB",
      "url": "https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C2X5-MPJ8-V9V9

Vulnerability from github – Published: 2025-05-08 18:30 – Updated: 2025-05-08 21:32
VLAI
Details

An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-26842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-08T16:15:25Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog.",
  "id": "GHSA-c2x5-mpj8-v9v9",
  "modified": "2025-05-08T21:32:55Z",
  "published": "2025-05-08T18:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26842"
    },
    {
      "type": "WEB",
      "url": "https://www.znuny.org/en/advisories/zsa-2025-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C2XJ-3MXC-4W9Q

Vulnerability from github – Published: 2024-12-09 03:30 – Updated: 2024-12-09 03:30
VLAI
Details

An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection objects that trigger execution of arbitrary EXE files. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-55579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-09T03:15:05Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection objects that trigger execution of arbitrary EXE files. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15.",
  "id": "GHSA-c2xj-3mxc-4w9q",
  "modified": "2024-12-09T03:30:59Z",
  "published": "2024-12-09T03:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55579"
    },
    {
      "type": "WEB",
      "url": "https://community.qlik.com/t5/Official-Support-Articles/High-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows-CVEs/tac-p/2496004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C329-R8PP-J9RG

Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-07 12:31
VLAI
Details

Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-106246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T19:17:51Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-c329-r8pp-j9rg",
  "modified": "2026-10-07T12:31:53Z",
  "published": "2026-10-06T21:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106246"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/514070956"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C34F-6CMX-FCVV

Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2025-08-29 15:30
VLAI
Details

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.

Severity
6.6 (Medium)
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-14665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-10-25T20:29:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.",
  "id": "GHSA-c34f-6cmx-fcvv",
  "modified": "2025-08-29T15:30:37Z",
  "published": "2022-05-13T01:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14665"
    },
    {
      "type": "WEB",
      "url": "https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46142"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45938"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45922"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45908"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45832"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45742"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45697"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4328"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3802-1"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201810-09"
    },
    {
      "type": "WEB",
      "url": "https://lists.x.org/archives/xorg-announce/2018-October/002927.html"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:3410"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105741"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041948"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C34V-MGWV-92X6

Vulnerability from github – Published: 2026-09-28 09:30 – Updated: 2026-09-28 09:30
VLAI
Details

Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session. Only installations that configure an OAuth 1.0a site-wide consumer are affected, and exploitation requires knowledge of one of its outstanding request tokens. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which binds authorization to the logged-in session.

Severity
9.0 (Critical)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-82378"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-28T08:16:41Z",
    "severity": "CRITICAL"
  },
  "details": "Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that token to an arbitrary user account, including an administrator, by submitting an unsigned authorization request. The endpoint derives the authorizing identity from a request-supplied value rather than the authenticated session. Only installations that configure an OAuth 1.0a site-wide consumer are affected, and exploitation requires knowledge of one of its outstanding request tokens. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which binds authorization to the logged-in session.",
  "id": "GHSA-c34v-mgwv-92x6",
  "modified": "2026-09-28T09:30:26Z",
  "published": "2026-09-28T09:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82378"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/roller/pull/165"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/fq512gy70zj9yx8v4c4zm54x43wqb04b"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/25/11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C34X-5V75-6MCP

Vulnerability from github – Published: 2026-10-06 21:31 – Updated: 2026-10-07 12:31
VLAI
Details

Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Severity
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-106295"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T19:17:57Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect authorization in Unbounded Element in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-c34x-5v75-6mcp",
  "modified": "2026-10-07T12:31:54Z",
  "published": "2026-10-06T21:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106295"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/553138969"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C36C-CF6R-GHGJ

Vulnerability from github – Published: 2026-10-07 20:25 – Updated: 2026-10-07 20:25
VLAI
Summary
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
Details

Impact

Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters.

An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This can cause catalog entities and metadata to be ingested from a repository that the operator did not intend to trust.

Deployments that do not enable event support for the Bitbucket Server catalog provider, do not configure repository filters, or whose integration credentials cannot read the filtered-out repositories are not affected.

Patches

Upgrade @backstage/plugin-catalog-backend-module-bitbucket-server to version 0.5.15 or later. The fixed package is available in Backstage v1.55.0.

Workarounds

  • Disable event-driven updates for the Bitbucket Server catalog provider and rely on scheduled discovery until the patched package is deployed.
  • Restrict the configured Bitbucket Server integration credentials so that they cannot read repositories that must remain outside the catalog trust boundary.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@backstage/plugin-catalog-backend-module-bitbucket-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.4.0"
            },
            {
              "fixed": "0.5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106458"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:25:08Z",
    "nvd_published_at": "2026-10-06T21:17:16Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nDeployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider\u0027s configured project, repository, or archived-repository filters.\n\nAn authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This can cause catalog entities and metadata to be ingested from a repository that the operator did not intend to trust.\n\nDeployments that do not enable event support for the Bitbucket Server catalog provider, do not configure repository filters, or whose integration credentials cannot read the filtered-out repositories are not affected.\n\n### Patches\n\nUpgrade `@backstage/plugin-catalog-backend-module-bitbucket-server` to version `0.5.15` or later. The fixed package is available in [Backstage v1.55.0](https://github.com/backstage/backstage/releases/tag/v1.55.0).\n\n### Workarounds\n\n- Disable event-driven updates for the Bitbucket Server catalog provider and rely on scheduled discovery until the patched package is deployed.\n- Restrict the configured Bitbucket Server integration credentials so that they cannot read repositories that must remain outside the catalog trust boundary.",
  "id": "GHSA-c36c-cf6r-ghgj",
  "modified": "2026-10-07T20:25:08Z",
  "published": "2026-10-07T20:25:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/security/advisories/GHSA-c36c-cf6r-ghgj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106458"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/commit/989db63b6f87c8fc04d440f296ad89e10c79b363"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/backstage/backstage"
    },
    {
      "type": "WEB",
      "url": "https://github.com/backstage/backstage/releases/tag/v1.55.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list