CWE-284: Improper Access Control vulnerabilities

CVE-2026-72532 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users to create categories via webservice endpoints due to insufficient access control checks.

CVE-2026-71574 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.6 and 6.0.0 through 6.1.2. It allows unauthorized users to perform mutation actions via webservice endpoints that should be restricted, due to inconsistent ACL checks compared to the backend UI.

CVE-2026-50138 is an improper access control vulnerability in patrickhener's goshs SimpleHTTPServer before version 2.1.0. When WebDAV is enabled, mode-restriction flags such as --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port, not on the WebDAV port. This allows authenticated WebDAV clients to perform unauthorized operations like PUT, DELETE, MKCOL, MOVE, and COPY. The issue is fixed in version 2.1.0.

The Premium Packages WordPress plugin before 7.0.7 does not validate a withdrawal request against the requesting user's actual earned balance, allowing any authenticated user, including a subscriber with no sales at all, to submit a payout request for an arbitrary amount, which an administrator may then approve and pay out.

The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles.

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.

FreePBX backup versions prior to 17.0.11 contain a vulnerability in the publicKeySave AJAX endpoint that allows an authenticated administrator to append an SSH public key to the asterisk user's authorized_keys file without proper command restrictions. This grants persistent shell access with the ability to execute arbitrary commands, access sensitive data, modify system files, and disrupt services. The issue is fixed in version 17.0.11.

CVE-2026-59763 is a medium severity vulnerability in Gitea Open Source Git Server affecting versions from 0 up to and including 1.26.4. It involves unbounded Arch package file metadata that can lead to resource amplification during package uploads. This flaw does not impact confidentiality or integrity but can cause availability issues due to resource exhaustion.

CVE-2026-58508 is a critical security vulnerability in the Gitea Open Source Git Server involving two server-side request forgery (SSRF) issues in the migration/mirror functionality. These SSRF vulnerabilities stem from DNS rebinding and missing re-validation mechanisms, potentially allowing an attacker to cause unauthorized requests from the server. The vulnerability has a CVSS score of 9.1, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.

CVE-2026-58507 is a vulnerability in Gitea Open Source Git Server that allows disclosure of private repository existence via the go-get meta endpoint. This issue is classified under CWE-284, indicating an authorization bypass or insufficient access control. The vulnerability affects Gitea versions from 0 up to and including 1.26.4. It has a CVSS 3.1 base score of 5.3, indicating a medium severity level. The vulnerability does not require privileges or user interaction to exploit and impacts confidentiality only, without affecting integrity or availability.

CVE-2026-58440 is a vulnerability in Gitea Open Source Git Server where webhooks created by a collaborator continue to fire even after their repository access has been revoked. This occurs due to incomplete cleanup in the DeleteCollaboration function, potentially allowing ongoing real-time exfiltration of private repository content.

CVE-2026-58439 is a high-severity vulnerability in Gitea Open Source Git Server versions up to 1.26.4. It involves a branch protection bypass caused by pull request retargeting, which preserves a stale 'official' approval flag. This flaw allows an attacker with limited privileges to bypass intended branch protection controls, potentially leading to unauthorized code changes with high impact on integrity and availability.

CVE-2026-58437 is a vulnerability in Gitea Open Source Git Server affecting versions from 0 up to and including 1.26.4. It involves repository visibility manipulation via Git push options, classified under CWE-284 (Improper Access Control). The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity, with low attack complexity and requiring low privileges but no user interaction. The impact includes limited confidentiality loss and high integrity impact without affecting availability.

CVE-2026-58429 is a medium severity vulnerability in Gitea Open Source Git Server versions up to 1.26.4. It involves a scope bypass of Public-Only Personal Access Tokens in organization and permission endpoints, potentially allowing unauthorized access to sensitive data. The vulnerability does not affect availability or integrity but impacts confidentiality. No public exploits or patches are currently documented.

CVE-2026-58420 is a local file inclusion vulnerability in the Gitea Open Source Git Server affecting versions up to 1.26.4. It involves improper access control (CWE-284) allowing local file inclusion via file:// URI in the Migration Restore functionality. The vulnerability has a medium severity with a CVSS score of 4.4 and requires high privileges to exploit.

CVE-2026-58417 is a vulnerability in Gitea Open Source Git Server where the REST API exposes membership information of private organizations to the public. This exposure allows unauthorized users to view organization membership details that should remain confidential.

CVE-2026-56755 is a denial of service vulnerability in Gitea Open Source Git Server affecting versions from 0 up to 1.26.4. It arises from an O(N^2) string concatenation issue during Debian package uploads, which can exhaust CPU and memory resources, causing service disruption.

CVE-2026-56750 is a critical vulnerability in Gitea Open Source Git Server versions up to 1.26.4. The flaw involves improper authorization (CWE-284) where the Remember-Me token theft does not invalidate the attacker's session, potentially allowing unauthorized persistent access without user interaction.