CWE-862: Missing Authorization vulnerabilities

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward.

CVE-2026-102410 is a medium severity vulnerability in Elastic Kibana versions 9.2.0 through 9.3.8. It involves missing authorization checks in an internal API within the Metrics Experience feature, allowing users with only data-store-level read access to retrieve metric data that should require higher Kibana feature privileges. This flaw results from inconsistent enforcement of access control lists (ACLs) between related APIs in the same feature.

A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.

MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.

CVE-2026-105488 is a missing authorization vulnerability in Devolutions Server versions 2026.3.7.0 and earlier. It allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. This flaw affects versions prior to 2026.3.8. The vulnerability has a high severity rating with a CVSS score of 7.1.

## Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants. **You are affected if:** - You are using `@payloadcms/plugin-multi-tenant` If you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds Configure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all tenants can modify memberships.

## Impact An attacker can submit a request to a specific endpoint that permits collection documents to be updated regardless of access control and field level access control. **You are affected if:** - You are configuring `orderable: true` with any collection or join field. ## Patches In the patched version access control is properly enforced. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

## Impact A readable collection could expose information about protected documents in a related collection. **You are affected if:** - You expose a readable collection with a relationship to a collection protected by access.read where constraints. ## Patches Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ## Workarounds There is no complete workaround. Upgrade Payload packages `>= 3.90.0` or `>= 4.0.0-canary.34`.

### Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables `useAPIKey`. - Users have read access to other user documents containing active API keys. ### Patches Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`. ### Workarounds Disable `useAPIKey` or restrict users to reading only their own authentication document. Rotate any API key that may have been exposed.

PayloadCMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 contain a vulnerability in the optional Stripe REST proxy plugin. Authenticated users with access to this proxy can perform unintended Stripe operations. This issue is addressed in versions 3.90.0 and 4.0.0-canary.34.

### Impact Under certain conditions, an authenticated user could manage MCP API keys outside their intended account allowing an attacker to escalate privileges through account takeover. Applications that do not use `@payloadcms/plugin-mcp` are not affected. ### Patches Users should upgrade to `@payloadcms/plugin-mcp` version `3.88.0` or later. ### Workarounds Upgrading is recommended. Until then, disable the MCP plugin or restrict MCP API-key management to trusted users.

Dell Container Storage Modules prior to version 1.18.0 have a missing authorization vulnerability in the Dell CSI Driver for PowerMax component (csireverseproxy). This flaw allows an unauthenticated attacker with adjacent network access to potentially gain unauthorized access. The vulnerability is tracked as CVE-2026-63691 and has a medium severity rating with a CVSS score of 6.1.

CVE-2026-105059 is a missing authorization vulnerability in the 'Delete All Comments of wordpress' plugin by royalnavneet. The flaw allows actions without proper access control, potentially leading to denial of service by deleting all comments. It affects versions from 0 up to but not including 7.2. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity. No official patch or remediation is currently documented.

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

CVE-2026-42638 is a missing authorization vulnerability in Awesomemotive Easy Digital Downloads affecting versions before 3.7.1.1. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit. No official patch or vendor advisory is currently provided.

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.