CWE-863: Incorrect Authorization vulnerabilities

Plane, an open-source project management tool, had a vulnerability prior to version 1.4.0 where certain API endpoints exposed sensitive information from private projects to any authenticated workspace member. Specifically, the GET /api/workspaces/{slug}/cycles/ and GET /api/workspaces/{slug}/modules/ endpoints returned data without verifying project membership, allowing unauthorized enumeration of project details. This issue was fixed in version 1.4.0.

Plane, an open-source project management tool, has an authorization vulnerability prior to version 1.4.0. The WorkspaceOwnerPermission check does not verify if a user is active, allowing deactivated users to retain workspace owner access. This issue is fixed in version 1.4.0.

CVE-2026-104891 is an authentication bypass vulnerability in the douglasborthwick-crypto mppx-condition-gate packages. These packages improperly grant free access to payment routes by trusting a client-supplied wallet address without verifying control over that wallet. This allows attackers to name any qualifying wallet address and bypass payment. All published versions of both packages are affected. Fixed versions will require proof of wallet control before granting free access. Until patched, removing the condition gate or ensuring prior wallet binding is recommended.

CVE-2026-71890 is a high-severity authorization vulnerability in Bouncy Castle for Java (BC-JAVA) versions from 1.73 up to but not including 1.86. The flaw involves improper validation of MLS external commit proposal lists, allowing an external joiner to remove any group member and take over their slot in the ratchet tree. This occurs because the validation did not ensure the removed leaf corresponded to the joiner, violating RFC 9420 requirements. The issue was fixed in version 1.86 by enforcing credential checks on both sending and receiving sides.

A vulnerability in Bouncy Castle for Java versions 1.81 up to but not including 1.86 allows incorrect authorization in the OpenPGP certificate API. The API accepted third-party certifications or trust delegations from subkeys that lacked the required CERTIFY_OTHER key flag, enabling an attacker to escalate a restricted subkey's authority to that of the primary key's identity-issuing capability. This flaw could cause applications relying on the API's validation to mistakenly trust attacker-controlled identities. The issue is fixed in version 1.86.

CVE-2026-104873 is an incorrect authorization vulnerability in the langgraph Python SDK used by langchain-ai. Versions from 0.1.45 up to but not including 0.4.4 have resource-scoped authorization decorators that ignore the actions argument, causing a wildcard handler to be selected for all actions. This allows authenticated users to bypass permission checks and access or modify other users' resources. The issue is fixed in version 0.4.4.

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client) could cause affected clients to accept an unauthorized member into the end-to-end encrypted media session, compromising the confidentiality and integrity of audio and video.

CVE-2026-82358 is an authorization bypass vulnerability in RT-Labs AB C-Open CANopen protocol stack. The flaw exists in the SDO server implementation where write permissions are not properly validated during download-segment frames processing. This allows an unauthenticated attacker on the CAN bus to overwrite read-only Object Dictionary entries by sending crafted SDO frames. The vulnerability is fixed in version 1.1.1.

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0.

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.

CVE-2026-102122 is an authorization vulnerability in Kiteworks Core where users with the Manager role on a shared folder could improperly assign the Owner role to themselves or others. This occurs due to incorrect enforcement of role assignment permissions. The vulnerability affects versions prior to 9.5.1. The CVSS score is 4.3, indicating medium severity with limited impact on integrity and no impact on confidentiality or availability.

CVE-2026-102139 is an authorization bypass vulnerability in the large file exchange feature of Kiteworks Email Protection Gateway. It allows an authenticated user to access the subject, message body, and attachments of email packages they neither sent nor received. This occurs because the system does not properly verify that the requesting user is a party to the requested package.

CVE-2026-55176 is a critical authorization vulnerability in Soft Machine versions 0.2.247 and earlier. The flaw exists in two authentication helper functions that accept a global shared secret as a bearer token without verifying the caller's workspace. This allows any tenant to use the shared secret to access and manipulate other tenants' workspace APIs, leading to cross-workspace read, write, and destructive restore capabilities. No patches are publicly known at the time of publication.

CVE-2026-47591 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Linux. It is an incorrect authorization flaw in the kernel mode layer that allows an unprivileged user to bypass read-only memory protections and gain write access to memory that should be read-only. This vulnerability can lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

CVE-2026-47571 is a high-severity vulnerability in the NVIDIA GeForce GPU Display Driver for Windows. It involves an incorrect authorization check in kernel-mode escape handling, allowing a local attacker to bypass restrictions based on client execution context. Exploitation could lead to privilege escalation, information disclosure, data tampering, denial of service, or code execution.

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments

CVE-2026-100277 is a high severity vulnerability in JetBrains YouTrack versions before 2026.2.19197. It allows an attacker to perform an account takeover by replaying a notification signature. The vulnerability is classified as CWE-863, indicating an authorization bypass issue. The flaw affects YouTrack versions from initial releases up to but not including 2026.2.19197.