CWE-862: Missing Authorization vulnerabilities

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System (LMS): through 2026-09-18.

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as that setting is what causes outbound WordPress password-reset emails — including the reset URL and key — to be mirrored into the push row queue where they become accessible to the attacker.

CVE-2026-80337 is a Missing Authorization vulnerability in HAVELSAN Inc.'s Sef - AI Chatbot Platform that allows unauthorized access to functionality not properly constrained by access control lists (ACLs). This affects versions prior to 2.1. The vendor no longer supports the product. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with high impact on confidentiality but no impact on integrity or availability.

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.

The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.

CVE-2026-79618 is a vulnerability in the WP User Frontend WordPress plugin before version 4.3.12. It involves missing authorization checks in a post-creation handler, allowing authenticated users with subscriber-level access or higher to create and potentially publish posts via forms that should be restricted to paying subscribers.

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

CVE-2026-93832 is a medium severity vulnerability in the Motorola Setup App where a component is exported without proper authorization. This flaw allows an attacker with limited privileges to revoke runtime permissions from other apps on the device. The vulnerability does not require user interaction and has a low attack complexity but requires local access with some privileges.

Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.

Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

CVE-2026-97258 is a medium severity vulnerability in Aruba.it's Aruba Migration Tool versions up to 1.0.4. It involves missing authorization controls, classified as CWE-862, which could allow unauthorized access to subscriber-related functions. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a network attack vector with low complexity and no user interaction required. There is no indication of known exploits in the wild or an official patch available at this time.

CVE-2026-62073 is a high-severity vulnerability in the WP Full Stripe Free plugin by Themeisle. It involves missing authorization controls in versions up to 8.5.6, allowing unauthenticated users to perform actions that should require authorization. The vulnerability does not impact confidentiality or availability but can lead to integrity violations. No patch or remediation information is currently provided.

In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

CVE-2026-103490 is a privilege escalation vulnerability in JetBrains YouTrack versions prior to 2026.2.19422. The issue arises from improper access control related to user group links, classified under CWE-862. This vulnerability allows users with certain privileges to escalate their access rights, potentially leading to full control over the affected system. The vulnerability has a high severity rating with a CVSS score of 7.2. No known exploits are reported in the wild, and no official patch links are provided in the input data.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.