CWE-284: Improper Access Control vulnerabilities

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits, denying service or changing how the system schedules them.

The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scope issued by a site administrator could therefore list private organizations and the email addresses of all users, create organizations, obtain runner registration tokens and create new site administrator accounts, the last of which persists after the token is revoked. Tokens of users who are not site administrators cannot reach these routes; public-only tokens are now rejected on the admin API.

CVE-2026-115828 is a critical improper access control vulnerability in Delinea Secret Server (On-Prem) versions earlier than 12.3.1. The issue arises because the software did not always validate the PIN or biometric check when using a FIDO2-compliant device, potentially allowing unauthorized access.

The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.

CVE-2026-61708 is an improper access control vulnerability in SOCFortress CoPilot prior to version 0.1.76. It allows low-privilege customer users to upload files to arbitrary storage buckets and object names without restrictions, enabling overwriting of cross-tenant data such as endpoint telemetry, report templates, and forensic artifacts. This can lead to tampering with evidence, poisoning of reports for potential code execution, and denial of service via storage exhaustion. The issue is fixed in version 0.1.76.

CVE-2026-75882 is an improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption. It allows an attacker with standard user permissions to access a privileged kernel driver interface and send specially crafted requests. This flaw affects versions prior to 5.4.29.0 for ESET Endpoint Encryption and prior to 2.4.8.0 for ESET Full Disk Encryption. The vulnerability has a high severity rating with a CVSS score of 8.5. A fix is available in versions 5.4.29.0 and 2.4.8.0.

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries.  We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.

CVE-2026-90867 is an improper access control vulnerability in the Web Admin console of Progress Software WS_FTP Server on Windows. It affects versions prior to 2024.0.7 and 2025.0.4. This flaw could allow remote unauthenticated attackers to access administrative functions. The vulnerability has a high severity with a CVSS score of 8.1. Fixed versions 2024.0.7 and 2025.0.4 address this issue.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

The Video Player for YouTube WordPress plugin versions before 2.1.4 have an improper access control vulnerability. This flaw allows users with the Contributor role and above to read the site-wide player-preset configuration. Versions before 2.1.1 also permit modification and deletion of this configuration via an AJAX handler without proper capability checks. The issue is fixed in version 2.1.4.

Vite versions from 6.4.4 up to but not including 6.4.5 have a vulnerability where the development server improperly evaluates file access restrictions before removing certain loader query parameters. This allows an unauthenticated attacker to bypass deny rules and access sensitive files if the server is network-exposed. The issue is fixed in version 6.4.5.

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

A vulnerability in the WP Roster WordPress plugin before version 2.35 allows unauthenticated attackers to delete WordPress user accounts of roster members due to missing capability and nonce checks on an AJAX action.

CVE-2026-106003 is a vulnerability in the Court Reservation WordPress plugin versions before 1.12.4. It allows unauthenticated users to add or delete reservation types via an AJAX action due to lack of authorization, authentication, and nonce validation. This improper access control can lead to unauthorized modification of the plugin's configuration.

Casso Flow WordPress plugin versions before 4.2.0 have an improper access control vulnerability where the token used to authenticate bank-transfer payment notifications is empty by default. This allows unauthenticated attackers to forge payment notifications and mark any pending WooCommerce order as paid, regardless of the actual payment method used.

A vulnerability in Nextcloud Server versions 32.0.0 through 33.0.0 allows authenticated non-members to enumerate internal resources of teams configured as "visible to everyone" via a direct API call. Although the web UI blocks non-members from viewing the team, the resources API endpoint leaks the existence, names, and identifiers of the team's internal resources. The contents of these resources remain inaccessible.

CVE-2026-77173 is an improper access control vulnerability in Nextcloud Files Confidential affecting versions 3.3.0 through 5.0.0. It allows a user to create a .docx or .odt file with a '#' character in the filename containing confidential information, such as credit card numbers, without the file being marked as confidential.

CVE-2026-67400 is a low severity vulnerability in Nextcloud Richdocuments where a missing token type check allows retrieval of additional WOPI configuration information using a user or guest token.