CWE-863: Incorrect Authorization vulnerabilities

CVE-2026-55485 is a high-severity vulnerability in piccolo_admin prior to version 1.14.0 that allows a non-superuser administrator to obtain another user's live session token via a GET request to the sessions API endpoint. This token can be replayed to impersonate a superuser and escalate privileges permanently. The issue arises because GET requests to user and session tables are allowed without superuser validation, and the session token is exposed as it is not treated as secret. The vulnerability is fixed in version 1.14.0.

CVE-2026-62904 is an incorrect authorization vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to disclose information over a network. The issue affects versions prior to 152.0.4191.52 and 152.0.4191.53. Microsoft has released official fixes for this vulnerability.

A vulnerability in the go-vikunja vikunja task management platform allows an authenticated user with read access to a source project to duplicate it under an arbitrary target parent project without proper write permission checks. This improper authorization occurs because the duplication operation skips the target parent's write-permission verification, enabling injection of attacker-owned content into another user's or team's project hierarchy. The issue affects versions from 0.21.0 up to but not including 2.4.0 and is fixed in version 2.4.0.

CVE-2026-56854 is a high-severity authorization vulnerability in the golang.org/x/crypto/ssh package. The flaw involves incorrect enforcement of the source-address restriction in authentication callbacks, where this restriction was only applied to some authentication paths but ignored in others. This inconsistency could allow unauthorized access if source-address restrictions are used as a security control.

Eclipse Lyo versions 2.0.0 to 7.0.0 contain a vulnerability where OAuth server authorization checks can be bypassed when 2-legged authentication is supported by the server. Applications using the Lyo-provided AbstractAdapterCredentialsFilter for authorization filtering are vulnerable. An attacker can create a provisional trusted client and immediately use it as a trusted client without administrator approval. The 3-legged OAuth path requiring user interaction is not affected. This vulnerability has a critical severity with a CVSS score of 9.1.

TriliumNext Trilium versions up to and including 0.103.0 have a vulnerability in the public share-search endpoint that allows unauthenticated users to access titles, paths, and content of protected shared notes without enforcing share credentials or hidden status. This enables attackers to enumerate and read notes that should be password-protected. The issue is fixed in version 0.104.0.

CVE-2026-47892 is a critical authorization vulnerability in the Spring Framework affecting multiple versions from 5.2.5.RELEASE through 7.0.8. It allows bypass of header predicate checks in pre-flight requests when using WebFlux functional endpoints with DispatcherServlet, potentially compromising confidentiality, integrity, and availability of affected applications.

JetBackup WordPress plugin versions before 3.1.23.5 have an authorization flaw that allows a network main site administrator, who is not a Super Admin, to download full backups of the entire multisite network including all sites' data and the shared webroot. This vulnerability arises from missing multisite authorization checks before serving backup archives and job logs.

Weblate versions prior to 2026.8 have a vulnerability where object-scoped RSS feeds do not enforce permission checks, allowing unauthorized users to access change-history metadata from private projects and restricted components. This metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, but not the translated-string content. The issue affects installations that allow anonymous access and use private or restricted projects. The vulnerability is fixed in version 2026.8.

CVE-2026-41262 is an authorization vulnerability in fleetdm fleet versions prior to 4.85.0. It allows an authenticated user with observer-level access on any team to read detailed policy information from other teams, bypassing team isolation. The flaw arises because the global policy read endpoint does not verify team ownership and authorizes requests against an empty policy object, permitting unauthorized access. This enables enumeration of policy IDs to access sensitive security-monitoring and compliance data across teams. The issue is fixed in version 4.85.0.

CVE-2026-65182 is a critical improper access control vulnerability in Apache Tomcat that allows security constraint bypass when a longer path constraint is specified before a more restrictive constraint for a shorter sub-path. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24. The vulnerability can lead to unauthorized access due to incorrect authorization checks. Fixed versions include 11.0.25, 10.1.58, and 9.0.121.

CVE-2026-16644 is a critical incorrect authorization vulnerability in the Drupal Webform REST module that allows unauthorized users to perform forceful browsing. It affects all versions from 0.0.0 up to but not including 4.1.0. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity without requiring privileges or user interaction. A fix is available in version 4.1.0.

CVE-2026-18985 is a high-severity incorrect authorization vulnerability in the Drupal Edit in-place field module, affecting versions from 0.0.0 up to 2.1.1. It allows forceful browsing due to improper authorization checks, potentially leading to unauthorized access and modification of sensitive data. The vulnerability has a CVSS score of 8.1, indicating a significant impact on confidentiality and integrity without requiring user interaction. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-68525 is a critical incorrect authorization vulnerability in Apache Tomcat's FORM authentication process. It allows bypassing a security constraint that restricts user access to a resource's POST method but not the GET method. This affects multiple versions of Apache Tomcat from 7.0.0 through 11.0.24, including some end-of-life versions. The issue is fixed in versions 11.0.25, 10.1.58, and 9.0.121.

OpenStack Keystone versions 13.0.0, 28.0.0, and 29.0.0 contain an authorization flaw where tokens obtained via delegated authentication can be used to bypass intended project scope boundaries. Specifically, application credential tokens without explicit scope are incorrectly reauthenticated and scoped to the credential owner's default project instead of the intended project. This affects all Keystone deployments that allow delegated authentication through OAuth1 access tokens, application credentials, or trusts.

CVE-2026-80182 is a high-severity authorization vulnerability in OpenStack Keystone before version 29.0.3. It allows tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication to create new long-lived credentials or authorize new delegations that persist independently and outlive the original credential. The vulnerability arises because delegation restrictions do not consistently apply to all delegated token types, enabling unauthorized creation of application credentials or OAuth1 request tokens. This affects all Keystone deployments that permit delegated authentication through these token types.

Apache DolphinScheduler before version 3.4.2 contains an authorization vulnerability (CWE-863) that allows a general user to mint admin access tokens via the /access-tokens endpoint. This flaw enables privilege escalation to administrative access. The issue is fixed in version 3.4.2.

CVE-2026-77134 is a high-severity authorization vulnerability in the TYPO3 extension "femanager." The flaw allows a regular user to self-approve a pending account that requires admin approval by using a user confirmation hash obtainable through a public action, bypassing the intended admin confirmation token requirement.

KAON PG5298A and PG5298B routers have a firmware vulnerability that allows an authenticated user to send crafted JSON-RPC requests to perform unauthorized operations such as reading system files or executing commands. This issue is due to incorrect authorization (CWE-863). The vulnerability is fixed in firmware versions 3.0.82 for PG5298A and 4.0.82 for PG5298B.