CWE-284: Improper Access Control vulnerabilities

Dell Display and Peripheral Manager (DDPM Mac) versions prior to 2.3.0.1005 contain an improper access control vulnerability. This flaw allows a low privileged local attacker to potentially elevate privileges and execute arbitrary code. The vulnerability is identified as CWE-284 and has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided yet by the vendor.

CVE-2026-15430 is an improper access control vulnerability in Wellbia XIGNCODE3 version 2026.6.1.192. It affects the IRP_MJ_WRITE command interface in the xhunter2.sys driver, allowing a local, unprivileged attacker to escalate privileges to NT AUTHORITY\SYSTEM. The attacker can also extract credentials from PPL-protected lsass.exe and terminate PPL-protected security processes.

HCL iControl version 3.2.0 contains a missing access control vulnerability (CWE-284) that allows unauthorized users to access or view administrator-level functionalities. The vulnerability does not require user interaction and has a low CVSS score of 3.7. There is no information about an available patch or official remediation from the vendor at this time.

Academy LMS WordPress plugin versions before 3.8.3 have an improper access control vulnerability in their REST API. This flaw allows users with Subscriber-level accounts to access lesson content without verifying enrollment or lesson publication status. As a result, unauthorized users can view lessons from paid courses they are not enrolled in, including unpublished lessons in draft, pending, or private states.

The Clever Mega Menu for Visual Composer WordPress plugin through 1.0.1 does not perform a nonce or capability check in an AJAX action that updates navigation menu item metadata, allowing any authenticated user, including Subscribers, to overwrite menu item content and settings that are rendered in the site's public navigation.

AI ChatBot for WooCommerce WordPress plugin versions before 4.8.4 have an improper access control vulnerability. The plugin does not perform authorization or nonce checks on a specific AJAX action, allowing unauthenticated users to misuse the site owner's stored third-party API key. This can lead to unauthorized requests billed to the owner's account and, if enabled, unauthorized retrieval of indexed knowledge-base content.

The Five Star Restaurant Reservations WordPress plugin before version 2.7.23 contains an improper access control vulnerability. This flaw allows users with the lowest booking-management role, who normally cannot access the plugin's settings, to reset the site's booking notification rules via an unprotected AJAX action.

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders.

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.

The Direct Payments for WooCommerce WordPress plugin before 2.5.3 does not verify that the requester owns the targeted WooCommerce order in several unauthenticated AJAX handlers before changing its status and overwriting its payment metadata, allowing unauthenticated attackers to tamper with other customers' orders, including forging a "payment sent" state, overwriting the payment-method label, and attaching forged payment-proof files.

ANDRITZ HIPASE-250 contains an unauthenticated HTTP endpoint that allows remote attackers to change the server's logging level and target. This vulnerability can be exploited to suppress audit logging, potentially hiding malicious activity. No authentication is required to access this critical function. The vulnerability has a medium severity score of 5.3 and does not impact confidentiality or availability but affects integrity by allowing log tampering. No patch or official remediation information is currently available.

Mailgun for WordPress versions prior to 2.2.1 contain an improper access control vulnerability. The plugin fails to perform capability or nonce checks on an unauthenticated AJAX action that adds subscribers to mailing lists. This allows unauthenticated attackers to add arbitrary email addresses to the site owner's configured mailing lists using the owner's stored API credentials.

CVE-2026-58039 is a vulnerability in Node.js affecting versions 22.x, 24.x, and 26.x. It involves improper access control in the Node.js permission model, allowing process.report to write or overwrite files outside the intended --allow-fs-write paths. This flaw can lead to confidentiality impacts or bypass of security boundaries under certain configurations. The vulnerability has a low severity rating with a CVSS score of 3.3.

An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame.

Kamaji, a Hosted Control Plane Manager for Kubernetes, has an improper access control vulnerability prior to version 26.7.4-edge. The issue arises from a lossy normalization process that causes distinct tenants with colliding normalized identifiers to share control-plane state. This allows unauthorized tenants to read, modify, or destroy another tenant's Kubernetes data. The vulnerability is identified as CVE-2026-62246 and has a high severity score of 8.5. The problem is fixed in version 26.7.4-edge.

CVE-2026-66803 is a critical improper access control vulnerability in Microsoft Azure Cosmos DB that allows unauthorized attackers to execute code remotely over a network. The vulnerability has a CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages remediation for this cloud service.

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.