CWE-863: Incorrect Authorization vulnerabilities

CVE-2026-77454 is an incorrect authorization vulnerability in the ash-project's ash_sql library. It allows bypassing of authorization filters when a relationship declares both a limit (or from_many?) and a parent-referencing filter or sort. This causes the authorization check to be skipped, potentially allowing unauthorized access. The issue affects versions from 0.4.1 up to but not including 0.7.1.

CVE-2026-81316 is an incorrect authorization vulnerability in ash-project's ash_sql component. It allows an attacker to receive aggregate values computed over data that should have been excluded by more restrictive filters, potentially disclosing sensitive aggregated information across authorization or tenancy boundaries. The issue arises because aggregate queries are considered identical if their filters differ but their sort criteria do not, leading to reuse of aggregate results from broader queries for narrower ones. This affects ash_sql versions from 0.1.0 up to but not including 0.7.1.

CVE-2026-81318 is an incorrect authorization vulnerability in ash-project's ash_sql library affecting versions from 0.1.0 up to but not including 0.7.1. The flaw allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's data due to improper query rebuilding that loses tenant schema context. This results in aggregates being computed against the wrong tenant's rows. The vulnerability has a low severity score and no known exploits or official patches at this time.

CVE-2026-77786 is an authorization vulnerability in the Rank Math SEO WordPress plugin versions including 1.0.271. The plugin fails to verify that users requesting automated SEO fixes have the necessary WordPress capabilities for the settings being changed. This allows users with the Editor role to modify site-wide core WordPress settings that should be restricted to administrators.

CVE-2026-77704 is a low-severity authorization vulnerability in the Booking for Appointments and Events Calendar WordPress plugin before version 2.4.9. It allows users with certain privileges to change the status of appointments without proper capability checks, enabling them to approve their own bookings or alter other customers' booking statuses on shared appointments.

CVE-2026-55485 is a high-severity vulnerability in piccolo_admin prior to version 1.14.0 that allows a non-superuser administrator to obtain another user's live session token via a GET request to the sessions API endpoint. This token can be replayed to impersonate a superuser and escalate privileges permanently. The issue arises because GET requests to user and session tables are allowed without superuser validation, and the session token is exposed as it is not treated as secret. The vulnerability is fixed in version 1.14.0.

CVE-2026-62904 is an incorrect authorization vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to disclose information over a network. The issue affects versions prior to 152.0.4191.52 and 152.0.4191.53. Microsoft has released official fixes for this vulnerability.

A vulnerability in the go-vikunja vikunja task management platform allows an authenticated user with read access to a source project to duplicate it under an arbitrary target parent project without proper write permission checks. This improper authorization occurs because the duplication operation skips the target parent's write-permission verification, enabling injection of attacker-owned content into another user's or team's project hierarchy. The issue affects versions from 0.21.0 up to but not including 2.4.0 and is fixed in version 2.4.0.

CVE-2026-56854 is a high-severity authorization vulnerability in the golang.org/x/crypto/ssh package. The flaw involves incorrect enforcement of the source-address restriction in authentication callbacks, where this restriction was only applied to some authentication paths but ignored in others. This inconsistency could allow unauthorized access if source-address restrictions are used as a security control.

Eclipse Lyo versions 2.0.0 to 7.0.0 contain a vulnerability where OAuth server authorization checks can be bypassed when 2-legged authentication is supported by the server. Applications using the Lyo-provided AbstractAdapterCredentialsFilter for authorization filtering are vulnerable. An attacker can create a provisional trusted client and immediately use it as a trusted client without administrator approval. The 3-legged OAuth path requiring user interaction is not affected. This vulnerability has a critical severity with a CVSS score of 9.1.

TriliumNext Trilium versions up to and including 0.103.0 have a vulnerability in the public share-search endpoint that allows unauthenticated users to access titles, paths, and content of protected shared notes without enforcing share credentials or hidden status. This enables attackers to enumerate and read notes that should be password-protected. The issue is fixed in version 0.104.0.

CVE-2026-47892 is a critical authorization vulnerability in the Spring Framework affecting multiple versions from 5.2.5.RELEASE through 7.0.8. It allows bypass of header predicate checks in pre-flight requests when using WebFlux functional endpoints with DispatcherServlet, potentially compromising confidentiality, integrity, and availability of affected applications.

JetBackup WordPress plugin versions before 3.1.23.5 have an authorization flaw that allows a network main site administrator, who is not a Super Admin, to download full backups of the entire multisite network including all sites' data and the shared webroot. This vulnerability arises from missing multisite authorization checks before serving backup archives and job logs.

Weblate versions prior to 2026.8 have a vulnerability where object-scoped RSS feeds do not enforce permission checks, allowing unauthorized users to access change-history metadata from private projects and restricted components. This metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, but not the translated-string content. The issue affects installations that allow anonymous access and use private or restricted projects. The vulnerability is fixed in version 2026.8.

CVE-2026-41262 is an authorization vulnerability in fleetdm fleet versions prior to 4.85.0. It allows an authenticated user with observer-level access on any team to read detailed policy information from other teams, bypassing team isolation. The flaw arises because the global policy read endpoint does not verify team ownership and authorizes requests against an empty policy object, permitting unauthorized access. This enables enumeration of policy IDs to access sensitive security-monitoring and compliance data across teams. The issue is fixed in version 4.85.0.

CVE-2026-65182 is a critical improper access control vulnerability in Apache Tomcat that allows security constraint bypass when a longer path constraint is specified before a more restrictive constraint for a shorter sub-path. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24. The vulnerability can lead to unauthorized access due to incorrect authorization checks. Fixed versions include 11.0.25, 10.1.58, and 9.0.121.

CVE-2026-16644 is a critical incorrect authorization vulnerability in the Drupal Webform REST module that allows unauthorized users to perform forceful browsing. It affects all versions from 0.0.0 up to but not including 4.1.0. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity without requiring privileges or user interaction. A fix is available in version 4.1.0.

CVE-2026-18985 is a high-severity incorrect authorization vulnerability in the Drupal Edit in-place field module, affecting versions from 0.0.0 up to 2.1.1. It allows forceful browsing due to improper authorization checks, potentially leading to unauthorized access and modification of sensitive data. The vulnerability has a CVSS score of 8.1, indicating a significant impact on confidentiality and integrity without requiring user interaction. No official patch or remediation guidance is currently available from the vendor.