CVE-2026-76152 is a path traversal vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote authenticated attacker with Catalog view permission to read arbitrary image-parsable files accessible by the OFBiz process and write re-encoded images to arbitrary writable directories. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain an authorization vulnerability in ContentPermissionServices. A remote authenticated attacker with limited content-create permission can exploit this flaw to self-assign the OWNER role on arbitrary content. This occurs because the permission check incorrectly defaults to granting access when no matching ContentPurposeOperation entry is found. The OWNER role enables full control over the content, including update, removal, and status changes. The issue is fixed in version 24.09.08.
Apache OFBiz versions before 24.09.08 contain a missing authorization vulnerability in ProductSearchEvents. A remote authenticated user with only catalog view permission can bulk-modify product category and feature associations across arbitrary search results. This occurs because the servlet authorizes requests only against the base view-level permission, while underlying event methods perform bulk deletes and inserts without enforcing proper DELETE/CREATE permissions. The issue is fixed in version 24.09.08.
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to the signed-integer maximum, by submitting a single small HTTP request whose parameter names encode a row count via the "o" suffix used by multi-form submissions, because UtilHttp.getMultiFormRowCount derives that count from the largest such suffix with no upper bound and ServiceMultiEventHandler.invoke then loops that many times calling dispatcher.runSync, with the request-map for getFinAccountTransRunningTotalAndBalances reaching this handler with no authentication or CSRF requirement on a stock deployment. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITY_MAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Apache OFBiz versions prior to 24.09.08 contain a missing authorization vulnerability that allows remote unauthenticated attackers to access internal business records without permission. This affects several helper endpoints in the Human Resources, Catalog, and Order Manager applications, exposing sensitive data such as organization details, employee information, product catalog, and product-store data. The issue is fixed in version 24.09.08.
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
CVE-2026-69002 is a vulnerability in Samsung Semiconductor's Exynos 1580 chipset involving missing authorization checks in framework services. This flaw allows unauthorized access due to improper permission validation. The issue was identified and fixed in November 2026.
A vulnerability in Open edX Platform's CourseTeamManageAPIView endpoint allows any authenticated user to distinguish active user accounts from inactive or absent ones by observing different HTTP responses. This affects versions from the Ulmo release until release/ulmo.4 and release/verawood.1. The issue is fixed in release/ulmo.4 and release/verawood.1. Anonymous users are not affected, and the PUT method is separately authorized and not vulnerable.
GLPI versions from 0.83 up to but not including 10.0.27, and from 11.0.0 up to but not including 11.0.9, contain a missing authorization vulnerability. Authenticated users could exploit this flaw to change the visibility of knowledge base items, reminders, or RSS feeds, thereby accessing content that should be restricted. The issue is resolved in versions 10.0.27 and 11.0.9.
GLPI versions from 0.85 up to but not including 10.0.26, and from 11.0.0 up to but not including 11.0.8, contain a missing authorization vulnerability. Under certain conditions, the permission logic could allow users to access documents not linked to the targeted item, exposing files to unauthorized users. This issue has been fixed in versions 10.0.26 and 11.0.8.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.
Telepresence versions prior to 2.31.0 contain a vulnerability in the Traffic Manager gRPC API that allows unauthenticated callers within the cluster network to register in any managed namespace and create service intercepts without proper Kubernetes RBAC checks. This flaw enables an attacker with network access to the manager pod to intercept traffic and access sensitive container environment data, including secrets and tokens. The issue is fixed in version 2.31.0.
Sonatype Nexus Repository 3 versions from 3.0.0 up to but not including 3.98.0 contain a missing authorization vulnerability. A user with valid credentials and the add or edit privilege on a group repository can add a repository they are not authorized to access as a member of that group, thereby gaining unauthorized read access to its content. Anonymous users can exploit this only if explicitly granted the necessary privilege by an administrator. This issue is fixed in version 3.98.0.
Sonatype Nexus Repository 3 versions from 3.0.0 up to but not including 3.98.0 contain a missing authorization vulnerability (CWE-862). This flaw allows a user with only the capability creation permission to create a Rut Auth capability, enabling header-based authentication. Consequently, a remote client can authenticate as any existing user, including administrators, without providing credentials. This vulnerability has a high severity score of 8.6 and is fixed in version 3.98.0.