CWE-284: Improper Access Control vulnerabilities

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.17.6, GuiServer::WndHookRegisterSlave in Sandboxie/core/svc/GuiServer.cpp stores attacker-supplied hthread and hproc fields from a GUI_WND_HOOK_REGISTER request without validating that the thread belongs to the sandboxed process or that the function pointer is in the caller address space, and GuiServer::WndHookNotifySlave then calls OpenThread(THREAD_SET_CONTEXT, FALSE, whk->hthread) and QueueUserAPC((PAPCFUNC)whk->hproc, hThread, (ULONG_PTR)req->threadid) as SYSTEM, allowing a sandboxed process to execute arbitrary code in an unsandboxed host process. This issue is fixed in version 1.17.6.

Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 (introduced in commit d1d631a, PR #1015) The root cause is in `lib/policy/checker.go`, `PathChecker.Check()`: ```go func (pc *PathChecker) Check(r *http.Request) (bool, error) { originalUrl := r.Header.Get("X-Original-URI") if originalUrl != "" { if pc.regexp.MatchString(originalUrl) { return true, nil } } if pc.regexp.MatchString(r.URL.Path) { return true, nil } return false, nil } ``` The header value comes directly from the client request. The middleware chain never strips it. In reverse proxy mode an attacker fully controls it. The default policy imports `data/common/keep-internet-working.yaml`, which contains path-only ALLOW rules with no other conditions: ```yaml - name: well-known path_regex: ^/\.well-known/.*$ action: ALLOW ``` When `X-Original-URI` matches one of those regexes, the rule fires as ALLOW and the request is forwarded upstream without any challenge or JWT check. # Proof of concept Normal request, gets challenged: ``` curl -s https://anubis.techaro.lol/ | grep -o "<title>.*</title>" ``` Bypass, gets upstream content: ``` curl -s -H "X-Original-URI: /.well-known/x" https://anubis.techaro.lol/ | grep -o "<title>.*</title>" ``` The first command returns the Anubis challenge page title. The second returns the real site title directly, with no cookie set and no challenge issued. Verified live against anubis.techaro.lol. # Suggested fix The fix should probably be to strip the header from incoming client requests in the middleware chain before policy evaluation. In `auth_request` mode the header is set by the proxy after Anubis processes the middleware, so stripping it at ingress does not break that deployment mode.

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permissions, allowing unauthorized modification of dashboard configuration and potential service disruption. This issue is fixed in version 4.0.8.

CVE-2026-14961 is an improper access control vulnerability in Pegatron Corp.'s Tdelo64.sys driver. The driver exposes a privileged device interface \\.\TdeIo that does not properly restrict access to sensitive IOCTL functions. This allows a local attacker to send crafted IOCTL requests to perform arbitrary kernel memory read and write operations. Exploitation can lead to privilege escalation to NT AUTHORITY\SYSTEM, bypass of security products, credential theft, or full system compromise. The vulnerability has a CVSS score of 6.2, indicating medium severity.

Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue is fixed in version 1.36.0.

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.

Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally.

Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

Improper access control in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.

Improper access control in Windows System allows an unauthorized attacker to bypass a security feature locally.

Improper access control in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.