SpiceDB is an open source database system for creating and managing security-critical application permissions. From version 1.15.0 to before version 1.52.0, caveat structures with nested lists can result in improper cache reuse. This issue has been patched in version 1.52.0.
Headplane versions prior to 0.6.3 and 0.7.0-beta.3 contain a path traversal vulnerability in the Headscale API client used for node and user rename operations. This vulnerability allows improper limitation of pathnames, leading to authorization bypass. The issue has been patched in versions 0.6.3 and 0.7.0-beta.3.
The Hippoo Mobile App for WooCommerce WordPress plugin up to version 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrator privileges. This occurs due to a logic error in permission handling functions that causes all REST API routes under /wc-hippoo/v1/ext/ to be accessible without authentication. Attackers can reset any WordPress user's password, including administrators, by sending a crafted POST request, leading to full site takeover.
CVE-2026-21036 is an improper authorization vulnerability in Samsung Internet browser versions prior to 30.0.0.39. This flaw allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.
Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.
Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at `/graphql` that does not enforce the same authorization checks as the REST API. Any authenticated user can abuse it in three ways: unauthorized IOC read across cases (IDOR), bulk IOC disclosure via `case.iocs`. The `case(caseId: …).iocs` resolver returns IOCs linked to an arbitrary case without verifying the caller has access to that case, and unauthorized case creation. All three are reachable by any authenticated user, regardless of role or case ACL. This is fixed in v2.4.28. The GraphQL blueprint, resolvers, and dependencies (`graphene`, `graphene-sqlalchemy`, `graphql-server[flask]`) were removed entirely, since the feature was not in use. As a workaround, block `/graphql` at the reverse proxy (recommended) or comment out the `graphql_blueprint` import and `register_blueprint` call in `source/app/views.py` and restart.
NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/pages/forum/get_quotes.php` only checks whether the caller is logged in, then reads a post by attacker-controlled `post` ID and returns its content. The backend helper in `modules/Forum/classes/Forum.php` does not enforce forum or topic ACLs. In contrast, the normal topic page in `modules/Forum/pages/forum/view_topic.php` enforces forum visibility and `view_other_topics`. Any low-privileged authenticated user can enumerate post IDs and read content from hidden, private, or staff-only forums. Version 2.2.5 fixes the issue.
An improper authorization vulnerability has been identified in Apache Kafka.
The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
CVE-2026-0072 is a critical vulnerability in Google Android XR version 14 where the addInputMethodListener function in InputMethodManagerService lacks a proper permission check. This flaw allows a local attacker to escalate privileges without needing additional execution privileges or user interaction. The vulnerability is classified as improper authorization (CWE-285) and has a CVSS 4.0 base score of 10. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
Nextcloud versions prior to 2.7.2 contain a privilege escalation vulnerability in the Approval app. This flaw allows users without sharing permissions to bypass authorization controls and force the system to share files with approvers. The vulnerability enables unauthorized distribution of restricted files. The issue has been addressed in Nextcloud version 2.7.2. The CVSS score is 6.5, indicating a medium severity level.
Incomplete authorization by Apache ActiveMQ server before versions v6.2.6 and v5.19.7 allows authenticated connections to remove existing destinations with proper permissions. This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version v6.2.6 or v5.19.7, which fixes the issue.
The structure_data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other Dags they were not authorized to read. Affects deployments that rely on per-Dag read scoping to keep Dag dependency topology private across teams. Users are advised to upgrade to `apache-airflow` 3.2.2 or later.
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reported previously, the same missing mailbox membership check was found in the sibling ThreadPolicy::edit method. A user with the PERM_EDIT_CONVERSATIONS permission who created a message or internal note in Mailbox A can rewrite that thread's body after an administrator removes them from Mailbox A, because the policy checks only authorship and a global permission flag — not current mailbox membership. This vulnerability is fixed in 1.8.221.
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders.capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.
CVE-2026-47744 is a critical improper privilege management vulnerability in shopperlabs shopper versions prior to 2.8.0. It involves two authorization defects that allow any authenticated user with low privileges to escalate to full administrator rights. Specifically, the team settings page lacks proper authorization checks, enabling users to create roles and delete administrators. Additionally, write actions in role permissions are improperly gated by a read-only permission, allowing arbitrary permission grants. This combined flaw permits complete takeover of the RBAC system and removal of legitimate administrators. The vulnerability is fixed in version 2.8.0.