CWE-862: Missing Authorization vulnerabilities

CVE-2026-85938 is a medium severity vulnerability in Microsoft Windows 10 Version 1809 and related builds. It involves improper access control in the Windows Broadcast DVR User Service, allowing an authorized local attacker to disclose information. The flaw does not affect system integrity or availability but can lead to unauthorized information disclosure. Microsoft has issued official fixes for all affected versions.

CVE-2026-83658 is a vulnerability in Microsoft Windows 10 Version 1809 and related builds involving improper access control in Windows Error Reporting. This flaw allows an authorized local attacker to disclose sensitive information. The issue affects multiple Windows 10 builds prior to their respective fixed versions. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released by Microsoft to address this issue.

CVE-2026-83583 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving improper access control in the Windows Geotag Broker component. This flaw allows an authorized local attacker to elevate privileges. Multiple Windows 10 builds prior to specific fixed versions are affected. An official fix is available from Microsoft.

CVE-2026-70085 is a medium severity vulnerability in Microsoft Windows Server 2012 DNS Server involving missing authorization. This flaw allows an authorized attacker with local access to tamper with the DNS Server. The vulnerability affects multiple Windows Server 2012 and later builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-69945 is a high-severity vulnerability in Microsoft Windows 10 Version 21H2 involving missing authorization in Windows AppX Deployment Extensions. This flaw allows an authorized local attacker to elevate privileges, potentially gaining higher system rights. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official patches to address this issue.

CVE-2026-69905 is a missing authorization vulnerability in the Windows AppX Deployment Service affecting multiple builds of Microsoft Windows 10 Version 1809 and later. This flaw allows an authorized local attacker to tamper with the service, potentially impacting system integrity. The vulnerability has a medium severity rating and has been officially fixed in specific Windows 10 builds.

CVE-2026-70235 is a vulnerability in Microsoft Windows 11 Version 24H2 involving improper authentication in Windows Event Tracing. This flaw allows an authorized local attacker to perform spoofing attacks. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches addressing this issue have been released in multiple Windows 11 builds.

CVE-2026-102861 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition where missing authorization allows an authorized attacker to elevate privileges over a network. The flaw affects versions from 16.0.0 up to but not including 16.0.20326.20190. An official fix is available in version 16.0.20326.20190.

CVE-2026-70098 is a high-severity vulnerability in Microsoft Visual Studio Code where missing authorization allows an unauthorized attacker to execute code over a network. The issue affects versions from 1.0.0 up to but not including 1.141.1. An official fix is available in version 1.141.1.

CVE-2026-102233 is a high-severity vulnerability in Microsoft Visual Studio Code where missing authorization allows a local attacker to bypass security features. This flaw affects versions from 1.0.0 up to but not including 1.141.1. An official fix is available starting with version 1.141.1.

NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POST requests to an AIStore proxy. A successful exploit may lead to information disclosure and unauthorized start or stop operations that affect the integrity and availability of ETL data-processing pipelines.

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability.

The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organisation is specified using an organisation ID.An authenticated user with limited privileges could potentially access CLA signature records containing contributor information belonging to an organisation they are not authorized to administer.

SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability.

NangoHQ nango versions prior to 0.70.9 contain a missing authorization vulnerability (CWE-862) in two private flow-read API routes. On accounts with RBAC enabled, users with the development_full_access role can bypass production role boundaries within the same tenant and read production integration flow metadata or named flow configurations. This issue does not allow cross-tenant access. The vulnerability is fixed in version 0.70.9.

CVE-2026-84314 is an improper authorization vulnerability in 0xJacky's nginx-ui that allows any authenticated user to change any other user's password without requiring two-factor authentication (2FA). The vulnerable endpoint POST /api/users/:id lacks the RequireSecureSession middleware, unlike other sensitive operations that enforce 2FA. This flaw enables an attacker to take over the initial admin account by changing its password, effectively locking out the legitimate admin user.

CVE-2026-84315 is a missing authorization vulnerability in 0xJacky's nginx-ui version prior to 2.4.1. The application uses a short-lived OTP/passkey "secure session" token to enforce step-up authorization for sensitive operations for users with 2FA enabled. However, several sensitive authenticated mutation routes are not protected by this step-up middleware, allowing an attacker with a valid authenticated JWT/session but without a fresh OTP secure-session token to perform unauthorized sensitive actions.

CVE-2026-57118 is a critical vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions prior to 1.6.59 allow unauthenticated remote clients to access critical functions such as listing agents and invoking agent chat endpoints without authentication. This lack of access control enables attackers to enumerate agents, consume model resources, access private context, and trigger agent tools or workflows. The issue is fixed in version 1.6.59.

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.