CWE-862: Missing Authorization vulnerabilities

CVE-2026-93639 is a missing authorization vulnerability in Zimbra Collaboration Suite versions up to 10.1.20. It allows a delegated administrator without explicit administrative grants to overwrite global Zimlet configurations and add attacker-controlled domains to a proxy allowlist. This can lead to cross-origin JavaScript execution when a signed-in user accesses a crafted URL, enabling mailbox data theft and authenticated actions as the victim. Exploitation requires a delegated-administrator account and victim interaction with a malicious URL.

PraisonAI versions from 4.2.1 up to but not including 4.6.59 have an unauthenticated AgentOS FastAPI deployment surface. This allows unauthorized actors to invoke agent chat functionality without authentication, potentially exposing sensitive information and enabling unauthorized actions. The vulnerability has been fixed in version 4.6.59.

PraisonAI versions from 4.5.112 up to but not including 4.6.59 contain an authentication bypass vulnerability in the Recipe HTTP server. The server can be started on a non-localhost interface without authentication, allowing unauthenticated access to the recipe API and potentially the /admin/reload endpoint. This issue is fixed in version 4.6.59.

PraisonAI versions from 3.11.0 up to but not including 4.6.59 contain a missing authorization vulnerability in the Slack app_mention event handler. This flaw allows a Slack workspace user to trigger configured PraisonAI agents by mentioning the bot in a channel, bypassing restrictions set by allowed users, allowed channels, and unknown user policies. The issue is fixed in version 4.6.59.

CVE-2026-25716 is a missing authorization vulnerability in Hallo Welt! GmbH BlueSpice affecting the BlueSpiceUserManager extension. Authenticated users without special privileges can block or unblock arbitrary user accounts, including administrators, via REST endpoints that lack proper permission checks. This can lead to denial of service by locking out all administrators or unauthorized lifting of blocks imposed by administrators. The issue affects BlueSpice versions from 5.0.0 before 5.1.11 and from 5.2.0 before 5.2.7. Fixed versions are 5.1.11 and 5.2.7. The vulnerability has a CVSS 4.0 score of 7.1 (high severity).

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice being dismissed, so on sites in certain configurations a low-privileged authenticated user (Subscriber) can dismiss administrative notices the LiteSpeed Cache WordPress plugin before 7.9.2 marks as non-dismissible, including a warning that sensitive files may be publicly accessible.

CVE-2026-112230 is a vulnerability in the Popup Builder WordPress plugin versions before 4.4.6. It allows unauthenticated attackers to move popup content into the Trash and overwrite stored preview data due to missing authorization checks in a maintenance routine triggered by unauthenticated requests.

CVE-2026-114519 is a missing authorization vulnerability in Roskus Prospero Flow CRM versions 2.0.0 up to but not including 5.26.0. It allows users with a basic role to read account information of other users within their company, including those with higher privileges. From version 3.5.0 onward, such users can also delete accounts within their company. Additionally, users in the default company can delete any account across all companies. This flaw arises because the API routes only verify a valid JSON Web Token but do not enforce permission or role checks. Exploitation can lead to unauthorized access to personal data and deletion of accounts, including the last administrative account of a company.

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access.

CVE-2026-93336 is a missing authorization vulnerability in Canonical Juju versions 4.0 through 4.0.15. It allows a controller-authenticated principal, such as a unit agent or a user with only login permission, to access any application's charm resource across any model. This includes sensitive container-registry credentials, which can be read via a specially crafted request targeting an arbitrary unit. The issue is fixed in version 4.0.16.

CVE-2026-115502 is a missing authorization vulnerability in KNIME Business Hub versions prior to 1.19.0. It allows anyone with access to a "link without login" for a DataApp to list and potentially access jobs created by other users using the same link. The issue is fixed in version 1.19.0. A recommended workaround is to remove all "links without login" to DataApps until the update is applied.

CVE-2026-114487 is a missing authorization vulnerability in Devolutions Server affecting versions 2026.3.5.0 through 2026.3.10.0 and versions 2026.2.20.0 and earlier. It allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing Active Directory providers via a crafted import request to the PAM AD computer import endpoint.

CVE-2026-114515 is a missing authorization vulnerability in schorschii OCO-Server versions prior to 1.2.3. It allows a valid Self-Service Portal user with permission to create job containers and read visibility on certain resources to queue uninstall jobs without having deploy permission. This flaw permits unauthorized software removal on resources visible to the user's role. The issue is fixed in version 1.2.3.

The MB Custom Post Types & Custom Taxonomies WordPress plugin versions from 2.0.2 up to but not including 2.12.3 contain a missing authorization vulnerability. This flaw allows unauthenticated users to trigger a legacy data migration process that reverts custom post type or taxonomy definitions to their pre-upgrade state. As a result, configuration changes made by administrators after upgrading can be discarded, potentially exposing previously restricted content to anonymous visitors.

The Infility Global WordPress plugin versions before 2.16.25 contain a missing authorization vulnerability in an AJAX action accessible to unauthenticated users. This flaw allows any visitor to overwrite a machine-translation configuration value of a companion plugin without proper authorization or nonce verification.

CVE-2026-84910 is a missing authorization vulnerability in the Drupal Advanced Search module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.4.5. The vulnerability has a medium severity with a CVSS score of 4.2. A fix is available in version 2.4.5.

CVE-2026-84912 is a missing authorization vulnerability in the Drupal AI (Artificial Intelligence) module. It allows forceful browsing due to improper access control. The issue affects versions from 0.0.0 up to but not including 1.3.13, and from 1.4.0 up to but not including 1.4.8. The vulnerability has a medium severity with a CVSS score of 4.6. Fixed versions are 1.3.13 and 1.4.8.