CWE-862: Missing Authorization vulnerabilities

CVE-2026-111046 is a low-severity missing authorization vulnerability in FOSSBilling versions 0.8.4 through 0.8.5. It allows a low-privileged staff user with module-level extension access to read and overwrite configuration of deactivated non-core modules via specific API endpoints. The flaw arises because the permission check fails to enforce restrictions on inactive modules, exposing decrypted extension secrets. This issue was fixed in version 0.8.6.

CVE-2026-107566 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It allows an authenticated user to manipulate email headers via the Sieve editheader action or mail-rule Set header value action to send emails as any address within domains the server signs for with DKIM signatures. This can result in forged emails that pass DMARC validation by altering From and DKIM-Signature headers without proper authorization.

CVE-2026-107568 is a missing authorization vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.6. It affects the Sieve notify action introduced in version 6.2.22 and the mail-rule Reply action, allowing authenticated users to send emails from any address on the server. This flaw enables forging emails that can pass DKIM and DMARC checks for domains hosted by the server, potentially allowing impersonation within those domains.

CVE-2026-71563 is a missing authorization vulnerability in Apache Answer versions up to 2.0.2. It allows users with a global API key to access answer content linked to hidden, deleted, or pending-review questions. This issue is fixed in version 2.0.3.

CVE-2026-68482 is a missing authorization vulnerability in Apache Answer up to version 2.0.2. It allows unauthenticated or unauthorized users to retrieve the invited-user list of a non-public question due to missing visibility authorization checks. The issue is fixed in version 2.0.3.

MISP versions prior to 2.5.48 have a vulnerability in the handling of module plugin settings where sensitive flags such as redacted and cli_only are dropped during server processing. This causes sensitive information like API keys to be exposed to any authenticated user with access to server settings, and allows modification of settings intended to be restricted to CLI-only access.

MISP versions prior to 2.5.48 contain an access control vulnerability in the proposal visibility logic. Users in a sharing group could view proposed changes to attributes or objects associated with that group regardless of the intended distribution level restrictions. Additionally, the owning organisation could not view proposals on its own organisation-only attributes. This flaw leads to unauthorized disclosure of proposed attribute changes.

A missing authorization vulnerability exists in the openGauss-server's pg_read_binary_file_blocks() function, allowing users with basic database connection rights to read binary data blocks of tables without having SELECT permission. This flaw affects versions from 3.0.0 through 6.0.6 and was fixed in version 7.0.0-LTS.

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it does check is issued to unauthenticated visitors, allowing anyone to overwrite the plugin's entire configuration and to discard any setting they do not supply.

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify the credentials on its public payment-status update route and treats unset credentials as valid, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file.

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.

CVE-2026-103091 is a critical vulnerability in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authorization and insecure default initialization in the MCP proxy and OIDC registration flow, allowing remote attackers to self-enroll and gain full read, write, and execution access on backend services. The flaw arises because the GET /info endpoint publicly exposes OIDC configuration, and the POST /register endpoint auto-enrolls any valid OIDC token holder without claim filtering or ban checks. The default policy binds authenticated users to wildcard services and targets, enabling broad unauthorized access. The issue is fixed in version 0.1.0-alpha.9, which enforces stricter policy controls and ban checks.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain a critical vulnerability where the /libp2p-http ingress server lacks authentication and authorization checks. This flaw allows an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary backend services. The issue is fixed in version 0.1.0-alpha.3.

CVE-2026-97859 is a missing authorization vulnerability in Gitea affecting seven API routes under /api/v1/users/{username}. These routes lacked proper permission checks, allowing authenticated users to access followers, following lists, starred and watched repositories, and public SSH and GPG keys of users with limited or private visibility. The issue was fixed in versions 1.27.3 and 28.0.0 and publicly disclosed with version 28.2.0.