CWE-284: Improper Access Control vulnerabilities

CVE-2026-78084 is a medium severity vulnerability in the SP Property extension for Joomla by joomshaper.com. Versions 1.0.0 through 4.1.3 are affected. The issue involves missing access control and lack of CSRF token validation in the gallery image management controller, allowing unauthorized users to perform file removal with arbitrary paths or upload unverified file types.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

CVE-2026-50165 is an improper access control vulnerability in alf.io, an open source ticket reservation system. Versions prior to 2.0-M5-2606 allow organization owners to access system-level configuration secrets via certain configuration endpoints. These endpoints accept arbitrary configuration keys and return values that may include administrator-only secrets such as the system API key. The issue is fixed in version 2.0-M5-2606.

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.

CVE-2026-21109 is an improper access control vulnerability in the Samsung Mobile Watch Plugin prior to Android Watch 17. It allows local attackers to access sensitive information due to insufficient access restrictions.

CVE-2026-21105 is an improper access control vulnerability in the Samsung Mobile Collection app affecting versions prior to 1.0.1.14 on Android 15 and 2.0.02.7 on Android 16. This flaw allows local attackers to access sensitive information without proper authorization.

CVE-2026-21100 is an improper access control vulnerability in the SystemUI component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. This flaw allows local attackers to launch arbitrary activities on affected devices. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.

CVE-2026-21098 is an improper access control vulnerability in Samsung Mobile Devices' Link to Windows feature prior to the SMR Sep-2026 Release 1. This flaw allows local attackers to establish a connection with a PC without requiring proper user interaction, potentially bypassing intended security controls.

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

Adobe ColdFusion 2025 is affected by an improper access control vulnerability that allows an attacker to read arbitrary files on the file system without user interaction. This vulnerability could expose sensitive files and directories outside the intended access scope. The issue has a high severity rating with a CVSS score of 7.5.

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

CVE-2026-77487 is an improper access control vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to elevate privileges over a network. The vulnerability affects multiple versions of Microsoft SQL Server 2017, 2019, 2022, and 2024 before specific fixed releases. A high severity CVSS score of 8.8 indicates significant impact on confidentiality, integrity, and availability. Microsoft has released official fixes for all affected versions.

CVE-2026-73028 is an improper access control vulnerability in Microsoft SQL Server 2017 (CU 31) that allows an authorized attacker to elevate privileges over a network. The flaw affects multiple versions prior to specific fixed releases. Microsoft has issued official fixes for the affected versions. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability. No known exploits are reported in the wild at this time.

CVE-2026-69282 is a high severity vulnerability in Microsoft SharePoint Server Subscription Edition involving improper access control. It allows an authorized attacker to execute code remotely over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20090. An official fix is available in version 16.0.20326.20090.

CVE-2026-69273 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition involving improper access control. It allows an authorized attacker to execute code remotely over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20082. An official fix is available in version 16.0.20326.20082.

CVE-2026-69268 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition involving improper access control. It allows an authorized attacker to execute code remotely over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20090. An official fix is available in version 16.0.20326.20090. There are no known exploits in the wild at this time.

CVE-2026-86242 is a high-severity vulnerability in maximhq Bifrost HTTP transport versions before 2.0.0-prerelease3. It allows unauthenticated remote code execution when management authentication is disabled (the default setting). The flaw arises because Bifrost accepts a custom plugin path as an HTTP URL, downloads it, and dynamically loads it as a Go plugin, executing initialization code with the Bifrost process user privileges. This dynamic loading only succeeds on dynamically linked builds; statically linked Docker images are not vulnerable to RCE but may be susceptible to server-side request forgery. The vulnerability requires high attack complexity due to environment-specific plugin compatibility requirements. The 1.6.x line through 1.6.11 is also affected. No official patch or remediation link is provided in the data.