CWE-863: Incorrect Authorization vulnerabilities

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

CVE-2026-100273 is a high-severity vulnerability in JetBrains YouTrack before version 2026.2.19197. It involves an authorization bypass in the scripts debugger component that allows arbitrary code execution. The vulnerability has a CVSS score of 8.2, indicating significant impact on confidentiality and integrity. No official patch link is provided in the data, and the product is not a cloud service. There are no known exploits in the wild at this time.

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access

CVE-2026-13719 is a vulnerability in Grafana Enterprise that allows an authenticated user to list alert rules stored in folders they are not authorized to access via the alert rules API. If the user has no folder read permissions, the restriction is bypassed, exposing all alert rules in the organization. Starting from Grafana 13.1.0, any user can trigger this using a folder filter. The exposed information includes rule configuration but does not include data source credentials.

Pexip Infinity versions before 38.2, as well as versions 39.0, 39.1, and 40.0, contain an improper access control vulnerability in an internal API. This flaw allows an attacker with local access to one node in a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another node. The vulnerability is classified as CWE-863 (Incorrect Authorization) and has a high severity with a CVSS score of 8.8.

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVE-2026-71899 is an authorization vulnerability in Apache DolphinScheduler versions 3.2.0 up to but not including 3.4.3. The flaw exists in the `query-dynamic-sub-workflows` API, which fails to properly verify user permissions when accessing workflow data. This allows authenticated users without project access rights to retrieve workflow information from unauthorized projects, leading to information disclosure. The issue is fixed in version 3.4.3.

CVE-2026-78214 is an authentication bypass vulnerability in Apache DolphinScheduler before version 3.4.3. The flaw allows remote unauthenticated attackers to bypass authentication for Actuator endpoints by sending specially crafted requests with percent-encoded paths. This can expose operational or configuration information and potentially sensitive management functionality depending on the configuration. The issue is fixed in version 3.4.3.

A vulnerability in grpc-node versions prior to 1.13.1 and between 1.14.0 and 1.14.1 causes the RBAC path matcher to perform a prefix comparison instead of an equality comparison when case-insensitive matching is enabled. This can lead to incorrect authorization if one method name prefixes another and they have different access rules. The issue is fixed in versions 1.13.1 and 1.14.1.

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

CVE-2026-19759 is an Incorrect Authorization vulnerability in Google Cloud Application Integration versions prior to 2026-06-17. It allows an authenticated Google Cloud user to execute arbitrary internal RPCs within Google's production network under a privileged identity by exploiting an internal-only task type. This vulnerability was patched on June 17, 2026, and no customer action is required.