CWE-284: Improper Access Control vulnerabilities

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file upload_files.php. This manipulation causes unrestricted upload. The attack may be initiated remotely.

CVE-2025-14561 is a critical improper access control vulnerability in WSO2 API Manager affecting multi-tenant deployments. The Publisher REST APIs do not properly enforce tenant isolation, allowing a privileged user in one tenant to perform publisher operations such as exposing or modifying API metadata in other tenants. This issue impacts versions 4.1.0 through 4.6.0. The vulnerability has a CVSS score of 9.0, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-13703 is a medium severity vulnerability in the SEO Redirection Plugin for WordPress versions before 9.19. The plugin fails to perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user, including low-privileged roles like subscribers, to read the site's configured 301 redirect rules. This exposure includes both source and destination URLs of redirects.

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin versions up to 1.0.13 contain an improper access control vulnerability. This flaw allows unauthenticated attackers to deactivate the plugin's premium licensing state and erase the stored license key by exploiting a shared secret derived entirely from publicly available information.

A vulnerability in Rongzhitong Visual Integrated Command and Dispatch Platform up to version 20260617 allows remote attackers to perform unrestricted file uploads via manipulation of the File argument in the /dm/dispatch/userinfo/upload endpoint. The vulnerability has a CVSS 3.1 score of 7.3, indicating a medium severity. The vendor was contacted but did not respond, and no patch or remediation information is currently available. Exploit code is publicly available but no known exploitation in the wild has been reported.

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.

YayPricing WordPress plugin versions before 3.5.7 have an improper access control vulnerability in several REST API routes. The plugin relies solely on a shared nonce without performing proper capability checks, allowing any authenticated user, including subscribers, to overwrite store pricing configurations and disclose private coupon codes. This vulnerability has a high severity score of 8.1 and impacts confidentiality and integrity but not availability.

A vulnerability in the User Registration & Membership WordPress plugin before version 5.2.6 allows unauthenticated users to create new accounts even when the site administrator has disabled open registration. This occurs because the plugin does not enforce the registration-disabled setting during registration-form submissions.

CVE-2026-70476 is an improper access control vulnerability in FlowiseAI Flowise versions prior to 3.1.3. It allows an authenticated attacker to manipulate Stripe subscription operations for other tenants by exploiting insufficient verification of subscription identifiers. This can lead to unauthorized changes in subscription plans or seat quantities, causing financial impact and service disruption. The issue is fixed in version 3.1.3.

The REST API Log WordPress plugin before version 1.7.1 has an improper access control vulnerability in its log download feature. The plugin does not bind the token protecting log downloads to the specific log entry nor verify the requester's capabilities. This allows unauthenticated users who possess any valid token to download REST API request and response logs, potentially exposing sensitive data such as credentials and authentication tokens.

Clearfy Cache WordPress plugin versions before 2.4.3 have an improper access control vulnerability. This flaw allows any authenticated user, including low-privileged roles like Subscribers, to access admin-only settings pages and view their contents. The vulnerability arises because one admin-page dispatch path does not perform a capability check, although the canonical page URL does restrict access properly.

A vulnerability in the Paid Membership Subscriptions WordPress plugin before version 3.0.8 allows authenticated users with Subscriber-level access or higher to modify another member's subscription without proper verification. This improper access control issue enables overwriting the subscription's plan, status, and expiration details.

The GDPR Framework By Data443 WordPress plugin versions prior to 2.4.0 contains an improper access control vulnerability. This flaw allows unauthenticated attackers to forge cookie-consent records for arbitrary email addresses and to flood the site's privacy-request queue with arbitrary entries. The vulnerability arises from insufficient verification of authorization or the identity of the data subject when recording consent and privacy requests.

CVE-2026-12698 is a medium severity vulnerability in the wpForo Forum WordPress plugin before version 3.1.3. It allows subscriber-level users to improperly modify administrator-controlled profile fields, including account state and reputation. This flaw enables unauthorized self-activation of pending or banned accounts and manipulation of forum reputation scores.