CWE-862: Missing Authorization vulnerabilities

Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5 have a missing authorization vulnerability in the transaction administration REST API. Authenticated users without permissions can read transaction metadata and statistics across tenant boundaries when transaction support is enabled. This does not allow modification of transactions or access to message contents. The issue is mitigated by upgrading to versions 4.0.14 or 4.2.5 and later, or by disabling transaction support if not used.

Apache Pulsar versions 2.2.0 through 4.0.13, 4.1.0 through 4.1.3, and 4.2.0 through 4.2.4 contain a missing authorization vulnerability in the Pulsar broker's binary protocol commands GetSchema and GetOrCreateSchema. Authenticated clients without permissions on a target topic could read schema definitions or register new schema versions on topics in other namespaces or tenants, potentially causing schema incompatibility errors for legitimate producers and consumers. The issue affects deployments with authentication and authorization enabled and does not impact the Pulsar REST API endpoints for schemas. Fixed versions are 4.0.14 and 4.2.5 and later.

Electron versions prior to 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4 have a missing authorization vulnerability where chrome.tabs.query() exposes each tab's URL and title to extensions without the required permissions. This allows an untrusted extension loaded via session.extensions.loadExtension to access sensitive browsing information. The issue is fixed in the specified versions.

CVE-2026-114489 is a high-severity vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It involves missing authorization checks in the REST and COM administration APIs, allowing remote authenticated users with domain-confined credentials to perform unauthorized changes to mail routing and domain configurations beyond their permitted domains on multi-tenant servers. Attackers can create domain aliases, rename domains, and modify mail routing rules to divert or deny mail for other tenants. The vulnerability arises from insufficient authorization enforcement in API handlers and COM API operations.

CVE-2026-114477 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.2.25 through 6.3.6. It allows a remote authenticated user with credentials confined to specific named domains to access server-wide traffic history metrics that should be restricted. The exposed data consists of aggregate traffic counters over the last 30 days, not individual messages or account details.

CVE-2026-114475 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.3.4 through 6.3.6. It allows a remote authenticated user with credentials confined to specific named domains to modify custom roles assigned to accounts in other domains. This includes creating, updating, and deleting custom roles across tenants, potentially altering permissions on mailboxes and settings. However, the vulnerability does not allow escalation to server administrator privileges. The flaw arises because the server does not properly restrict access to role-management REST routes for confined credentials.

EnterpriseDB WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 contain a missing authorization vulnerability in the gp_add_coordinator_standby() function. This function does not require superuser privileges, allowing a low-privileged user with utility-mode connection access to add a fake standby coordinator entry to the cluster configuration. This prevents administrators from adding a legitimate standby coordinator until the fake entry is removed by a superuser. No user data is exposed or modified by this vulnerability.

EnterpriseDB WarehousePG versions 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 contain a missing authorization vulnerability in the built-in cluster expansion functions gp_expand_lock_catalog() and gp_expand_bump_version(). Authenticated users with low privileges can invoke these functions without proper privilege checks, enabling them to block catalog changes cluster-wide or disconnect sessions holding temporary tables. This can disrupt database operations, including DDL, role management, and temporary table creation, requiring superuser intervention to resolve.

WarehousePG versions 7.2.1 through 7.6.0 contain a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). This flaw allows any authenticated database role to invoke the function without explicit permission, bypassing PostgreSQL's superuser restrictions. A low-privileged user can cause segment backends of other sessions, including superuser sessions, to write memory context details to logs. These logs may include query text from other users' cached plans. WarehousePG versions 6.x are not affected. The issue is fixed in version 7.6.1.

CVE-2026-70386 is a high-severity OS command injection vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. It allows any locally installed Android app, without declared permissions or user interaction beyond launch, to execute arbitrary shell commands as root in the dumpstate SELinux domain. This occurs due to lack of authorization on a binder interface and unsanitized input passed to a system command. Fixed versions are 15.0.0.2000 and 16.0.5.1200.

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created against, to force the integration into a verified state the site owner never completed, and to remove the payment method from the store's checkout.

The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as paid and completed, and cancelling other customers' orders. In versions up to 0.3.7 the response additionally returns the affected order's billing details, disclosing customer names, addresses, email addresses and phone numbers to the same unauthenticated caller.

The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as navigation menus, block templates, global styles and WooCommerce coupons.

The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Productive Commerce WordPress plugin before 1.1.49 already installed on the site.

The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.

The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule staging site to overwrite the separate live site's database and configuration and take it offline.

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.

The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid features.

The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group. To remediate this issue, users should upgrade to version 0.7.2.