CWE-863: Incorrect Authorization vulnerabilities

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass security restrictions due to incorrect authorization.

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with {{service:write}} or {{node:write}} permission may exploit this issue to remove services, checks, or nodes imported from a peered cluster without holding authority over the peer origin. This vulnerability (CVE-2026-87107) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node name may exploit this issue if they can obtain the node ID of a node they do not control. This vulnerability (CVE-2026-87090) is fixed in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12 and 2.0.4.

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo WordPress plugin before 1.4.14 and to lock every administrator out of the site.

Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs.

CVE-2026-61907 is an authorization vulnerability in Cyrus IMAP before version 3.12.4. It allows an authenticated user with insert permissions on another user's snoozed mailbox to bypass access controls and insert mail into that user's inbox or other mailboxes, even without explicit insert permissions on the target mailbox. The issue arises from improper enforcement of mailbox ACLs in the JMAP snooze feature.

CVE-2026-61910 is an authorization vulnerability in Cyrus IMAP before version 3.12.4. It allows an authenticated user with maySetKeywords permission on another user's mailbox to change the special-use role annotation of a shared mailbox. This could result in the sharee modifying the mailbox role to archived, snoozed, or other roles, potentially causing mail to be written to the shared mailbox and exposing more content than intended. The situation is considered unusual and is further mitigated by role duplication suppression if the target mailbox already has a non-shared mailbox with that role.

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation requires no authentication or user interaction.

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not verify that a stored payment method belongs to the user attaching it, allowing any authenticated user, such as a subscriber, to bind another customer's stored card to their own account and then charge or delete it. Exploitation requires the attacker to already know the payment provider's identifier for the victim's stored method, which the Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not expose.

Adobe Acrobat contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to bypass security features and gain unauthorized write access. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 26.002.21900 and 24.001.30383. The issue changes the security scope and has a medium severity rating with a CVSS score of 6.3.

Adobe Acrobat contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to escalate privileges without user interaction. The vulnerability affects versions up to 26.002.21900 and 24.001.30383. Exploitation changes the security scope and can lead to full confidentiality, integrity, and availability compromise. The issue is rated high severity with a CVSS score of 8.8.

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Illustrator Desktop 2026 contains an Incorrect Authorization vulnerability (CWE-863) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions up to 30.7 and 29.8.10. The scope of the vulnerability is changed, indicating a potential impact beyond the initially affected component.

CVE-2026-77109 is an Incorrect Authorization vulnerability in Adobe Commerce that allows an attacker to escalate privileges and gain elevated access to restricted resources without requiring user interaction. The vulnerability changes the security scope and has a high severity rating with a CVSS score of 8.6.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-70283 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds. It involves incorrect authorization in the Windows Win32K component, allowing an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.