CWE-862: Missing Authorization vulnerabilities

CVE-2026-97665 is a high-severity vulnerability in Sonatype Nexus Repository 3 affecting the NuGet Components API upload path. It involves a missing authorization check that allows users with only read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing normal write-permission restrictions. This requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the anonymous user can exploit this without authentication due to default read and browse privileges.

CVE-2026-111092 is a vulnerability in JetBrains YouTrack that affects versions before 2026.2.19575 and specific 2026.3.x builds (16075, 16397, 16402). It allows a project administrator to execute cross-project issue commands via mail rules, which is a privilege escalation issue related to improper authorization (CWE-862). The vulnerability has a medium severity with a CVSS score of 6.5.

Elementor Website Builder plugin for WordPress versions up to and including 4.2.3 contains a vulnerability that allows authenticated users with contributor-level access or higher to access sensitive information. Specifically, attackers can extract the full post content and plaintext post passwords of private, draft, pending, and future posts from any author, including administrators and editors. The vulnerability is due to missing authorization checks related to the 'keys_conversion_map' parameter.

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 7.9.6. This flaw allows authenticated users with subscriber-level access or higher to delete arbitrary Media Library attachments due to improper authorization checks.

CVE-2026-107795 is a high-severity vulnerability in TP-Link Omada Software Controller versions prior to 6.3.0.45. It involves missing authorization checks in the MSP and OpenAPI certificate/private-key management APIs, allowing authenticated users with low privileges to perform privileged certificate management operations. Exploitation could enable such users to upload or delete TLS certificates or private keys, potentially disrupting secure management access.

CVE-2026-102298 is a high-severity authorization bypass vulnerability in TP-Link Omada Software Controller (Windows) versions prior to 6.3.0.45. In MSP mode, the user-confirmation endpoint does not properly enforce permission checks, allowing authenticated users to supply a manipulated identifier parameter. This flaw enables user enumeration, credential verification, and unauthorized access to MSP resources or targeted accounts.

FileRise versions prior to 3.18.0 contain a missing authorization vulnerability that allows unauthenticated users with a valid share token and any configured share password to overwrite existing files by uploading a file with the same name. This flaw also affects authenticated uploads where users lack edit permissions, enabling silent replacement of file content without changing the original uploader metadata. The issue is resolved in version 3.18.0.

OpenAEV-Platform versions prior to 2.260622.0 have a missing authentication vulnerability in the /api/player/** lessons endpoints. These endpoints accept a userId query parameter without verifying the caller's identity or membership in the exercise. This allows unauthenticated attackers who know an exercise UUID to read sensitive lesson content and impersonate users by creating or overwriting answers. The issue is fixed in version 2.260622.0.

Plane, an open-source project management tool, has a missing authorization vulnerability in versions 1.3.1 and earlier. The flaw allows project guests or members to modify the is_active status of other project members, including administrators, by bypassing proper authorization checks. Additionally, members can overwrite preferences of other members due to insufficient object-level authorization. This vulnerability is fixed in version 1.4.0.

Dgraph version prior to 25.4.0 has an unauthenticated administrative HTTP interface exposed on port 6080. This interface allows unauthenticated attackers to read cluster state, allocate IDs, and perform destructive membership operations such as removing nodes. Exploitation can disrupt the Zero control plane and destabilize Alpha nodes, resulting in denial of service. The vulnerability arises because administrative endpoints lack authentication or IP whitelisting by default.

Pipecat-ai pipecat versions from 0.0.98 up to but not including 1.6.0 include a development runner exposing unauthenticated endpoints for creating bot sessions and Daily rooms. These endpoints are bound to localhost by default and intended only for local development. Exploitation requires deliberate exposure of the runner to untrusted networks. Version 1.6.0 adds warnings and documentation directing users to authenticated or managed production deployments but does not change endpoint behavior.

CVE-2026-88164 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition where missing authorization allows an authorized attacker to elevate privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. An official fix is available in version 16.0.20326.20190.

Zulip Server versions prior to 12.2 have an authorization vulnerability that allows guest users to receive new message events from public channels they are not subscribed to. This occurs because guests can create event queues for unsubscribed channels or retain access after permissions are revoked. The issue exposes new messages from public channels to unauthorized guests. The vulnerability is fixed in version 12.2.

The Jeg Kit for Elementor WordPress plugin (versions up to and including 3.2.19) contains a missing authorization vulnerability. Authenticated users with Subscriber-level access or higher can exploit AJAX actions to enumerate all registered users and gradually reconstruct their email addresses via substring search. This vulnerability arises from missing capability checks on the 'jkit_post_block' and 'jeg_find_author' AJAX handlers.

CVE-2026-94360 is a vulnerability in the Paymentfor Gateway for WooCommerce WordPress plugin before version 1.0.6. The plugin fails to verify the authenticity of inbound payment notifications, allowing unauthenticated attackers to mark orders as paid without completing any payment.

CVE-2026-94260 is a missing authorization vulnerability in the Sifalo Pay WordPress plugin versions 2.0 up to but not including 2.5.3. It allows unauthenticated attackers to modify payment session metadata on any order and to force orders awaiting payment into a failed state. This flaw arises because the plugin does not verify ownership or authorization when processing payment returns.

CVE-2026-94254 is a vulnerability in the SellKit WordPress plugin versions 2.3.5 up to but not including 2.8.0. It allows unauthenticated attackers to manipulate product prices during checkout by exploiting missing authorization checks, enabling them to place orders at arbitrary prices. The vulnerability has a medium severity rating with a CVSS score of 5.3.