CWE-863: Incorrect Authorization vulnerabilities

CVE-2026-18662 is a medium severity vulnerability in Eclipse Jetty affecting multiple versions of jetty-security and jetty-eeN-security. The issue arises when two or more security constraints share the same http-method-omission set and have no URL patterns, causing improper combination according to the Jakarta Servlet Specification. This leads to later http-method-omission sets overriding earlier constraints with the same set, potentially weakening security enforcement.

CVE-2026-19863 is a critical vulnerability in EthereumAuthenticator affecting versions 12.1.0 through 12.1.12. It allows an unauthenticated client to access certain protected resources if the request path contains the configured login path as a later segment. This occurs because the authenticator uses an unanchored substring match to identify the login page, causing it to mistakenly treat protected resource requests as login requests and bypass authentication or role checks. Explicitly forbidden routes are not affected.

CVE-2026-18661 is a high-severity vulnerability in Eclipse Jetty affecting multiple versions of jetty-annotations and jetty-eeN-annotations. The issue arises when a servlet has multiple url-patterns defined in web.xml, and security constraints apply only to some of those patterns. In this case, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotations and web.xml security-constraints are not properly enforced, potentially leading to incomplete security coverage for certain url-patterns.

CVE-2024-22031 is a high-severity authorization vulnerability in SUSE Rancher. It allows a user who can create a project in one cluster to create a project with the same name in another cluster, thereby gaining unauthorized access to the other project. This occurs because the namespace for storing project-related resources is based on the project name, leading to privilege escalation across clusters.

CVE-2026-96540 is an improper access control vulnerability in SonicWall Network Security Manager (NSM) on-premises export settings. It allows a remote authenticated attacker with limited privileges to potentially access sensitive information. Exploitation may lead to privilege escalation to administrator level or interception of other users' communications within the NSM instance. The vulnerability has a high severity rating with a CVSS score of 8.8.

Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 contain a vulnerability where media and attachments uploaded in public categories retained public accessibility flags even after the categories became read-restricted or permissions changed. This allowed anonymous users to access these uploads via short URLs, including those linked to deleted topics. The issue has been fixed in the specified versions.

CVE-2026-89072 is an Incorrect Authorization vulnerability in the Client Certificates module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4. The vulnerability has a high severity with a CVSS score of 7.5, indicating it can lead to high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. The vendor has not provided explicit patch links or advisories in the provided data.

CVE-2026-85298 is an Incorrect Authorization vulnerability in Google Cloud Application Integration's AuthConfig validation and integration execution runtime. It affects versions prior to 2026-08-27 and allows an authenticated user to escalate privileges and impersonate a service account within the project. The vulnerability was patched on August 27, 2026, and no customer action is required.

CVE-2026-92426 is an authorization vulnerability in the YITH WooCommerce Popup WordPress plugin before version 1.60.0. The plugin fails to verify user capabilities before allowing deletion of post meta data. This flaw permits users with the Contributor role or higher to delete arbitrary post meta from any post, including those owned by users with higher privileges.

CVE-2026-106098 is a medium severity vulnerability in the WP Data Access WordPress plugin before version 5.5.77. The plugin fails to properly check authorization on a REST endpoint, allowing unauthenticated attackers to perform write operations by only verifying read permissions. This can lead to unauthorized data modification even if update actions are disabled by the administrator.

Nix versions before 2.35.3, when run unsandboxed on macOS or FreeBSD, have an incorrect authorization vulnerability that allows build users to make unauthorized connections from daemon clients. This issue is tracked as CVE-2026-110453 and is classified under CWE-863 (Incorrect Authorization). The vulnerability has a medium severity with a CVSS score of 4.3.

CVE-2026-110451 is a medium severity vulnerability in NixOS Nix affecting multiple versions before 2.35.3. It involves an incorrect authorization issue (CWE-863) that allows a Seatbelt sandbox escape on macOS when an unconfined build is used due to mishandling of a size threshold.

CVE-2026-92817 is a vulnerability in the Ignition Perspective module of Inductive Automation Ignition. It involves improper validation of session privileges, allowing an authenticated user with Vision project access to escalate to Designer-level privileges by reusing a valid Vision session identifier. This privilege escalation could enable execution of arbitrary code within the Ignition Gateway process. The vulnerability affects versions 8.1.0 through 8.1.54 and 8.3.0 through 8.3.8. It has a high severity with a CVSS score of 8.8.

Adobe Photoshop Desktop contains an Incorrect Authorization vulnerability (CWE-863) that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 27.10 and 26.11.7. The vulnerability changes the security scope and has a high severity rating with a CVSS score of 8.6.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security features and gain unauthorized write access without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the impact is changed, indicating that the vulnerability affects resources beyond the initial security boundary.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control and results in a changed scope. The issue has a high severity with a CVSS score of 7.8.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to high impact on confidentiality, integrity, and availability.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to execute arbitrary code with the privileges of the current user. The vulnerable component is by default restricted to an administrative network zone. Exploitation does not require user interaction and changes the security scope. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The CVSS score is 9.6, indicating critical severity.