CWE-306: Missing Authentication vulnerabilities

CVE-2026-48050 is a high-severity vulnerability in Basekick-Labs' Arc time-series database prior to version 26.06.1. The issue arises because the application registers Go's pprof debugging endpoints under /debug/pprof/* without proper authentication, allowing unauthorized access to sensitive profiling information. This exposure occurs due to the authentication middleware bypassing token checks for these endpoints. The vulnerability is patched in version 26.06.1. Workarounds include blocking access to /debug/pprof* at the reverse proxy or load balancer, restricting API port access via firewall rules, or disabling the pprof handler in the source code and rebuilding the application.

CVE-2026-34949 is a vulnerability in Combodo iTop, a web-based IT service management tool. Versions prior to 3.2.3 allow an unauthenticated user to delete the .readonly file, which is created during setup to prevent write actions. This missing authentication for a critical function could enable unauthorized modification of the system. The issue is fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a vulnerability that allows unauthenticated remote attackers to bypass authentication and execute arbitrary PHP files from the env-production directory on new iTop instances in production environments. This issue has been fixed in version 3.2.3.

CVE-2026-69228 is a medium severity vulnerability in Esri Portal for ArcGIS versions 11.1 through 12.0. It involves missing authentication for a critical function, allowing remote unauthenticated attackers to access a specific resource that should be restricted to authenticated users. The vulnerability does not affect user content and does not impact integrity or availability. Users are advised to patch or upgrade to the latest long-term support release.

Combodo iTop versions prior to 3.2.3 contain a vulnerability where unauthenticated users can access sensitive uploaded files via sniffed URLs. This issue is due to missing authentication controls on critical functions. The vulnerability has been fixed in version 3.2.3.

The Calix GS7 XGS GS5239XG residential router was initially reported to have a missing authentication vulnerability in its UPnP WANIPConnection service exposed on the WAN interface at TCP port 5000. This could have allowed unauthenticated remote attackers to modify NAT port-forwarding rules, potentially exposing internal LAN devices. However, after thorough investigation and testing by Calix and CERT/CC, it was determined that the default firmware configuration blocks inbound WAN traffic to TCP port 5000, preventing exploitation. No affected customer deployments or required mitigations have been identified. The vulnerability report has been retracted as the issue could not be reproduced under normal conditions.

CVE-2026-15576 is a medium severity vulnerability in Checkmk versions 2.5.0 through 2.5.0p9. It involves improper authentication in the agent receiver component, allowing an unauthenticated remote attacker to bypass mutual TLS client certificate verification on relay endpoints by using a fixed placeholder identity in the request URL. This issue affects only the Cloud, Ultimate, and Ultimate MT editions of Checkmk, as other editions do not expose relay endpoints. The impact is limited to integrity and availability.

CVE-2026-19441 is a medium severity vulnerability in IKAS Technology Inc.'s Rush product, involving missing authentication for a critical function. This flaw allows an attacker to fake the source of data. The affected version is exactly 0. The product is no longer supported by the vendor, and no patch is available.

CVE-2026-76137 is a vulnerability in Yamaha Corporation's VOCALOID6 software where a missing authentication check for a critical function allows processes running under the same local user account to escalate privileges via a local named pipe. The vulnerability does not require user interaction and impacts confidentiality moderately without affecting integrity or availability. The CVSS score is 3.3, indicating a low severity level.

CVE-2026-76157 is a high severity vulnerability in Datiphy Inc.'s Data Management Center versions 8.3.0 through 8.5.1. It involves missing authentication on a critical upload API endpoint, allowing unauthenticated remote attackers to upload arbitrary files to the server's upload directory.

Mailu versions prior to 2024.06.52 contain a vulnerability in the admin REST API where missing authorization checks allow unauthenticated attackers to remove IP restrictions or modify user token comments. This issue is fixed in version 2024.06.52. Disabling the REST API is a viable workaround if upgrading is not immediately possible.

CVE-2026-77644 is a critical vulnerability in PTC Windchill Risk and Reliability Enterprise Edition (formerly Relex) versions 11.1 through 13.1. It allows bypassing access control due to missing authentication for a critical function. The vulnerability has a CVSS 4.0 score of 9.3, indicating it is network exploitable without requiring privileges or user interaction, and it impacts confidentiality, integrity, and availability.

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.  Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate.

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthenticated network attacker can call the /api/connection/connect and /api/query/execute routes to use configured database credentials and execute arbitrary SQL, allowing disclosure, modification, or destruction of data in connected databases. The desktop Tauri application is not affected because it binds only to loopback. This issue is fixed in version 0.5.51.

CVE-2026-18265 is a critical vulnerability in OSNEXUS QuantaStor version 6.7.3.010+9c965a6414 involving missing authentication for a critical function in the Kapacitor configuration. This flaw allows remote attackers to execute arbitrary code with root privileges without any authentication. The vulnerability is identified as CWE-306 and has a CVSS 3.0 score of 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed.

CVE-2026-15706 is a critical vulnerability in the Baylan Smart Meter Management Application (BMS) caused by missing authentication for a critical function. This flaw allows an attacker to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability. The issue affects versions before 1.1.10.142.

CVE-2026-14952 is a high-severity vulnerability in Frauscher Sensortechnik's FDS 102 product. It allows unauthenticated remote attackers to access sensitive files on the FDS Web server without valid authentication. Specifically, attackers can retrieve backup archives and other files containing detailed railway signaling and track layout information over HTTP. This exposure of critical infrastructure data poses significant confidentiality risks.

ICEcoder version 8.1 has a critical vulnerability allowing unauthenticated remote code execution. Attackers can bypass authentication and CSRF protections by sending a crafted HTTP POST request to the terminal endpoint, executing arbitrary OS commands as the web-server user.