CWE-862: Missing Authorization vulnerabilities

A missing authorization vulnerability in Gitea allowed users to access metadata of repositories they no longer had permission to view. Specifically, the API endpoint GET /api/v1/user/subscriptions returned repository details such as name, description, clone URLs, owner, and counters without verifying current access rights. This affected users who had previously watched private repositories but lost access due to permission changes. The issue was fixed in versions 1.27.0 and 28.0.0.

A missing authorization vulnerability exists in WPExperts Advanced File Manager (file-manager-advanced) up to version 5.4.14. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation details are provided in the available data.

A missing authorization vulnerability in the AI Engine WordPress plugin before version 3.7.9 allows users with Editor role or higher to modify or change the type of arbitrary posts on the site, including those they are not permitted to edit.

The AI Engine WordPress plugin versions before 3.7.9 contain a missing authorization vulnerability that allows users with Editor role and above to delete arbitrary posts, including those they normally cannot delete such as navigation menus, block templates, and global styles. This occurs because the plugin does not verify ownership of the media item before converting and deleting it.

Tasty Recipes Lite WordPress plugin versions from 1.2 up to but not including 1.2.11 have a missing authorization vulnerability. This flaw allows users with Contributor-level roles to create, rename, and delete taxonomy terms such as categories, tags, and navigation menus without proper capability checks.

CVE-2026-87844 is a vulnerability in the PickPlugins Product Designer for WooCommerce WordPress plugin up to version 1.0.40. The plugin fails to perform proper capability checks and has an inverted nonce verification mechanism, which accepts requests with invalid or missing nonces while rejecting valid ones. Additionally, it does not validate the post to which data is written, allowing unauthenticated users to insert design template data into the metadata of any post on the site. This can lead to unauthorized modification of post metadata.

The ACF Frontend Admin WordPress plugin by DynamiApps up to version 3.29.13 contains a missing authorization vulnerability. This flaw allows unauthenticated users to submit a public form that overwrites site-wide Advanced Custom Fields (ACF) options without proper capability checks. The vulnerability has a medium severity score of 5.3 and impacts the integrity of site configuration data.

CVE-2026-92431 is a low severity vulnerability in the Patreon WordPress plugin versions before 1.10.0. It involves missing authorization checks on certain plugin functionality, allowing unauthenticated users to enumerate taxonomy term names, including those of non-public taxonomies not normally exposed on the front end.

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions up to and including 4.4.10 contain an authorization bypass vulnerability. This flaw allows authenticated users with subscriber-level access or higher to enumerate all site users and extract their full email addresses, including those of administrators, by exploiting improper authorization checks.

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 suffers from an authorization bypass vulnerability. This flaw allows unauthenticated attackers or any subscriber-level user to access stored notification email bodies of bookings by iterating booking and email log IDs. Sensitive customer information such as names, email addresses, phone numbers, messages, and booking dates intended only for administrators can be exposed. The vulnerability arises because the plugin does not properly verify user authorization when performing certain actions.

The WP Booking System – Booking Calendar WordPress plugin up to version 2.1.0.3 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can exploit this flaw to grant themselves and others edit access to all booking forms by manipulating the user_permission meta. Exploitation requires prior delegated edit rights on at least one booking form to obtain a valid nonce. This vulnerability allows unauthorized privilege escalation within the plugin's access control.

The WP Booking System – Booking Calendar WordPress plugin versions up to and including 2.1.0.3 contain a missing authorization vulnerability. Authenticated users with subscriber-level access or higher can exploit the 'id' parameter to access private booking descriptions and booking IDs from any calendar on the site. This vulnerability leads to sensitive information exposure without impacting data integrity or availability.

The Fastcache by Host.it WordPress plugin up to version 1.7.5 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can modify the site's root .htaccess file by adding or removing page-cache rewrite rules without proper authorization checks. This vulnerability does not impact confidentiality or availability but allows unauthorized integrity modifications to the web server configuration.

Frappe HRMS versions prior to 15.58.3 and between 16.0.0 and before 16.4.3 contain a missing authorization vulnerability in their PWA API endpoints. Authenticated users can access employee data records belonging to other employees without proper authorization. This vulnerability allows unauthorized disclosure of sensitive HR data. The issue is fixed in versions 15.58.3 and 16.4.3.

CVE-2026-108373 is a missing authorization vulnerability in ERPNext affecting certain endpoints in the Sales Person-wise Transaction Summary report. Versions prior to 15.118.0 and between 16.0.0 and before 16.27.0 do not enforce proper authorization checks, allowing role-limited authenticated users to access financial data beyond their permissions. This issue is fixed in versions 15.118.0 and 16.27.0.

ERPNext versions prior to 15.121.0 and between 16.0.0 and 16.34.0 contain a missing authorization vulnerability. Low-privileged authenticated users can invoke certain state-changing methods without proper permission checks, allowing unauthorized data modification. This issue is resolved in versions 15.121.0 and 16.34.0.

A missing authorization vulnerability exists in the MariaDB server's CONNECT engine plugin file-access UDFs (json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file()) in certain versions. These functions do not enforce the FILE privilege or the secure_file_priv setting, allowing a low-privileged attacker to read or write files on the filesystem that the database account is not authorized to access, subject to OS permissions. The issue affects multiple MariaDB versions and has been fixed in later releases.

Dockhand versions prior to 1.0.34 have a critical vulnerability where the in-browser container terminal endpoint does not enforce authentication on WebSocket upgrade requests. This allows unauthenticated attackers with network access and knowledge of a container ID to execute commands inside that container, potentially leading to host compromise if the container has sensitive mounts or privileged execution. The issue is fixed in version 1.0.34.

CVE-2026-97851 is a critical vulnerability in J4Care's dcm4chee-arc-light version 5.35.1. The issue arises from the storage status-change REST service, which allows location records still linked to DICOM instances to be changed to deletion-related states. Specifically, changing a location to TO_DELETE triggers the PurgeStorageScheduler to delete the referenced object from storage, while the corresponding instance record remains in the database.

Apache Kylin versions 4.0.0 through 5.0.4 contain a missing authorization vulnerability in a backend metadata dump API. This flaw allows unauthorized access due to insufficient authorization checks and lack of path confinement. The vulnerability primarily impacts Kylin services exposed directly to public networks, which is uncommon, while typical in-house deployments are mostly unaffected. The issue is fixed in version 5.0.5.