CWE-284: Improper Access Control vulnerabilities

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.

The Convert Forms extension for Joomla versions 2.5.0 through 5.2.2 contains an improper access control vulnerability in its front-end Submissions view. This flaw allows unauthenticated visitors to list form submissions, leading to sensitive data exposure. The vulnerability is identified as CWE-284 (Improper Access Control) and CWE-200 (Information Exposure). It has a high severity rating with a CVSS score of 8.2. No official patch or remediation guidance is currently available from the vendor.

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a valid token and cache-management permission.

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.

A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.

Joomla Extension - regularlabs.com - restricted user-data exposure in Users Anywhere and Articles Anywhere extensions - User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization.

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions.

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items.

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

Gitea versions prior to 1.27.0 contain a vulnerability in the Arch package registry implementation where authenticated users with package publishing permissions can upload Arch package archives with an unbounded number of file entries. This causes resource amplification, leading to excessive consumption of CPU, memory, database storage, and repository index generation resources. The vulnerability impacts availability but does not affect confidentiality or integrity. A patch is available to address this issue.

Gitea versions prior to 1.27.0 contain a denial of service vulnerability in the Debian package registry parser. This flaw allows authenticated users with write access to upload malicious .deb packages that trigger excessive memory consumption through unbounded decompression. Additionally, inefficient O(N²) string concatenation in the parser causes high CPU usage, potentially stalling the server. The vulnerability can be exploited by any authenticated user with write permissions to the package registry.

Gitea version prior to 1.26.4 contains an improper authorization vulnerability in the OAuth2 sign-in callback. When a user authenticates via a linked external identity provider, the system silently re-enables accounts that were disabled by an administrator, bypassing the intended administrative disable action. This allows the user to regain full access, including read/write permissions to repositories and organizations, by simply completing the OAuth callback. This flaw undermines the disable account feature used for incident response in SSO deployments.

FUXA versions 1.2.11 through 1.3.0 contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code as root. This vulnerability persists even when the software is configured with its most secure settings enabled. The issue is resolved in version 1.3.1.