PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.
CVE-2026-16401 is a high-severity privilege escalation vulnerability in the Data Loss Prevention component of Firefox and Thunderbird. This issue allows an attacker to gain elevated privileges within the affected applications. The vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16396 is a high-severity privilege escalation vulnerability affecting WebExtensions in Mozilla Firefox and Thunderbird. The flaw allows an attacker to escalate privileges within the affected applications. This vulnerability was fixed in Firefox version 153 and Firefox ESR 140.13, as well as Thunderbird 153 and Thunderbird 140.13.
CVE-2026-16379 is a high-severity privilege escalation vulnerability in the DOM: Content Processes component of Firefox and Thunderbird. This issue allows an attacker to escalate privileges within the affected applications. The vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16371 is a privilege escalation vulnerability in the DOM Navigation component of Mozilla Firefox. It allows an attacker to escalate privileges within the browser context. The vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. No known exploits in the wild have been reported. Users are advised to update to the fixed versions to remediate this issue.
CVE-2026-16372 is a privilege escalation vulnerability in the DOM: Content Processes component of Firefox and Thunderbird. This issue allows an attacker to gain elevated privileges within the affected component. The vulnerability was fixed in Firefox 153 and Thunderbird 153. The severity of this vulnerability is assessed as high.
CVE-2026-16366 is a high-impact privilege escalation vulnerability in the DOM Navigation component of Firefox and Thunderbird. This flaw allows an attacker to escalate privileges within the affected applications. The vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16365 is a high-severity vulnerability affecting the DOM: Workers component in Thunderbird and Firefox packages on Red Hat Enterprise Linux and SUSE Linux Enterprise distributions. It involves multiple authorization and memory safety weaknesses. The vulnerability is addressed by updates equivalent to Mozilla's Firefox 153 release. No CVSS score is provided, but the impact is considered high.
The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access.
NextCRM version 0.12.1 has an improper privilege management vulnerability in its MCP product tools API. Authenticated users with low privileges can perform product creation, modification, archiving, or soft-deletion via the /api/mcp/mcp endpoint without proper role checks. This allows unauthorized write access to the shared CRM product catalog. The issue is fixed in version 0.12.3.
A critical vulnerability (CVE-2026-44231) affects the bestpractical RT issue tracking system. Versions prior to 5.0.10 and versions from 6.0.0 up to but not including 6.0.3 contain a flaw in the REST 2.0 API that allows a privileged non-administrative user to obtain authentication credentials of other users, including administrators. This leads to unauthorized information disclosure and potential privilege escalation. The vulnerability also causes feed URLs to be rotated and invalidated upon exploitation. Fixed versions are 5.0.10 and 6.0.3.
Apache Syncope contains an improper privilege management vulnerability (CWE-269) affecting versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. When configured with certain user workflow adapters and BPMN definitions that do not require admin approval for user self-registration or self-update requests, a REST API call can allow users to grant themselves administrative roles. This results in unauthorized privilege escalation. Upgrading to versions 4.0.7 or 4.1.2 addresses this issue.
The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before version 1.4.1 has a vulnerability that allows unauthenticated attackers to brute-force short numeric one-time-password codes sent via email. This is due to lack of rate limiting and storing codes in plaintext. Successful exploitation can lead to full site takeover, including administrator accounts.
A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption required (ITMS 8.7.3)
The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM account, bypassing filesystem ACLs. No admin privileges required. The provider reverts to the LocalSystem context when servicing WMI queries without re-impersonating the caller. Any local standard user can therefore read SYSTEM-readable files — including configuration files, service logs, and secrets stored with SYSTEM/Administrator-only ACLs — by querying the provider directly.
The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.
The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exists.
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.
wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission check on all subsequent trainer-login calls. This grants full gym administration capabilities including viewing all member data, modifying contracts, managing gym configuration, and accessing other trainers' and managers' personal information. This issue has been fixed in version 2.6.
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.