CWE-862: Missing Authorization vulnerabilities

The Advanced Custom Fields: Extended WordPress plugin versions up to 0.9.2.6 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media library attachments by submitting a crafted form with a numeric attachment ID, without verifying user ownership or capability. Exploitation requires a site administrator to have set up a public ACFE form with an Email action that includes a deletable attachment field bound to user input.

CVE-2026-85299 is a Missing Authorization vulnerability in Google Cloud Compute Engine affecting the disks.createSnapshot and regionDisks.createSnapshot APIs. It allows an authenticated attacker with limited privileges to exfiltrate disk data across projects. The vulnerability was patched on August 31, 2026, and no customer action is required as Google manages remediation for this cloud service.

Psono Server versions 1.0.0 through 7.2.3 contain a missing authorization vulnerability in file-repository operations. An authenticated attacker with read-only file access can misuse the file transfer endpoints to upload or overwrite repository objects by obtaining a signed upload URL for arbitrary object keys. This can lead to unauthorized modification of files and resource consumption within defined limits. The issue is fixed in version 7.2.4.

HashiCorp Consul and Consul Enterprise versions 1.17.0 up to 2.0.4 contain an authorization bypass vulnerability in the agent's service mesh leaf certificate API. This flaw allows attackers without a valid ACL token to retrieve cached service leaf certificates and their private keys. The vulnerability is fixed in Consul Community Edition 2.1.0 and Consul Enterprise versions 2.1.0 and 1.21.19.

CVE-2026-93328 is a critical vulnerability in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0. It involves path traversal and missing authorization in the cloud-storage source component, allowing unauthenticated remote attackers to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local files via crafted tool invocation parameters. The issue is fixed in version 1.5.0.

CVE-2026-115195 is a broken access control vulnerability in the Mautic Stats API endpoint (/api/stats/{table}) that allows any authenticated API user to read data from several internal tables without proper authorization. This includes sensitive information such as the application audit log, user actions, contact personal data, visitor IP addresses and geolocation, and tracked redirect URLs. The flaw exists because intended administrator-only restrictions were never enforced, and tables without explicit permission mappings were readable by default. The vulnerability affects multiple Mautic core versions prior to fixed releases.

CVE-2026-114743 is a missing authorization vulnerability in the InstaWP Connect WordPress plugin versions before 0.1.4.2. The plugin fails to perform a proper capability check on its settings update action, relying only on a nonce verification. This flaw allows an authenticated user with a low-privileged role, granted access to the plugin's sync feature by an administrator, to overwrite plugin settings, including those controlling role access to the feature. The role grant is not enabled by default.

A missing authorization vulnerability in the WPVR WordPress plugin before version 9.1.3 allows users with Contributor role and above to create and publish tour content and set arbitrary post metadata via the setup wizard, bypassing intended capability checks.

GiveWP WordPress plugin versions before 4.19.0.1 contain a missing authorization vulnerability. This flaw allows users with donor-report (view) access but without donor-edit access to add, modify, or delete donor addresses. The issue is fixed in version 4.19.0.1.

The Chikkili- Google Pay India for Woocommerce WordPress plugin versions up to 1.0.6 contains a missing authorization vulnerability. It does not verify that payment notifications originate from the legitimate payment provider before marking orders as paid. This flaw allows unauthenticated attackers to mark arbitrary orders as paid without making any actual payment.

Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.

The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.

CVE-2026-55463 is a vulnerability in intranda's goobi-viewer-core web application versions from 4.11.0 up to but not including 26.05. Several Jakarta WebSocket endpoints do not verify that the HttpSession belongs to a logged-in user and fail to validate the Origin header. This allows unauthenticated attackers to connect and disrupt the crowdsourcing page-lock mechanism by broadcasting forged lock messages. The issue is fixed in version 26.05.

A missing authorization vulnerability exists in the system-privileged 'DJIUpdateService' binder on DJI CrystalSky ZS600C devices running firmware versions 0.3.9.7 through 0.6.6.9. This flaw allows a local application without any permissions to invoke privileged operations such as factory reset with user-data wipe, device shutdown, clock/timezone changes, and firmware update hand-off. The vulnerability arises because the onTransact() method does not perform any caller identity or permission checks.

A missing authorization vulnerability exists in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9. This flaw allows a local application without any permissions to execute arbitrary operating system commands as root by passing a caller-supplied string to the root-privileged 'assistant' daemon's system() call without verifying caller identity or permissions.