CWE-863: Incorrect Authorization vulnerabilities

CVE-2026-116238 is a vulnerability in pgAdmin 4 server mode before version 9.19 that allows bypassing the limit on failed login attempts for internal accounts. This flaw enables an unauthenticated attacker to make unlimited password guesses against internal accounts, including administrator accounts, due to improper handling of authentication attempts and password reset processes. The issue arises from the coexistence of Flask-Security views and pgAdmin's own authentication logic, case-insensitive username matching, and interactions with other authentication sources like LDAP and Kerberos. The vulnerability does not affect desktop mode and has been fixed in version 9.19.

In Secret Server on-prem versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can therefore match a paper with a visible comment authored by USER even when the comment is supposed to be anonymous. An authenticated user with access to the search can infer the author of an anonymous comment, compromising reviewer anonymity. Comments that the user cannot see remain excluded from search results. The advisory prose identifies 3.3 as fixed, its affected-version metadata excludes 3.3, and the verified repository tag 3.3 already contains the identity-check fix; however, its patched-version metadata instead lists 3.3.1. This fixed-version source conflict remains unresolved.

Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension table with a string literal argument rather than through the FROM clause, so that table was never included in the authorization check. An authenticated user who is authorized for at least one table can therefore read columns from any dimension table in the cluster, including tables they have no access to, and can retrieve arbitrary rows of it by supplying primary key values directly. Per-principal row-level security filters configured on the dimension table are likewise not applied. The multi-stage query engine is not affected. This issue affects Apache Pinot: through 1.5.1 Users are recommended to upgrade to version 1.6.0, which fixes this issue.

Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.

CVE-2026-115642 is an incorrect authorization vulnerability in OpenStack keystonemiddleware versions before 13.0.2. An attacker with access to a restricted application credential can bypass restrictions by supplying a custom X-Service-Token header, leading to privilege escalation.

CVE-2026-61789 is a vulnerability in bytebase's dbhub prior to version 0.22.6 that allows bypassing read-only SQL validation on MySQL and MariaDB connectors. The issue arises from a mismatch in comment parsing between the SQL validator and the database connectors, enabling an attacker to hide write or destructive statements from validation. This can lead to unauthorized modification or deletion of database data if the attacker can influence SQL input. The vulnerability does not affect PostgreSQL due to consistent parsing and execution behavior. The issue is fixed in version 0.22.6.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to `LibreOfficeKit` in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted `WebSocket` messages to execute document-mutating `UNO` commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.

ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.  This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67

Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3.

Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.

CVE-2026-107255 is an incorrect authorization vulnerability in the Drupal Restrict route by IP module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.3.1, and from 2.0.0 up to but not including 2.0.1. Fixed versions are 1.3.1 and 2.0.1.

CVE-2026-114530 is an incorrect authorization vulnerability in the Drupal Dopup module that allows forceful browsing. This affects Dopup versions from 0.0.0 up to but not including 1.0.7. The issue has been fixed in version 1.0.7.

CVE-2026-114537 is an incorrect authorization vulnerability in the Drupal View Unpublished module that allows forceful browsing. Versions from 0.0.0 up to but not including 1.5.0 are affected. The issue has been fixed in version 1.5.0.

CVE-2026-114540 is an incorrect authorization vulnerability in the Drupal Domain module versions 3.0.0 through 3.0.1. It allows unauthorized users to perform forceful browsing, potentially accessing restricted resources. The issue is fixed in version 3.0.2.

CVE-2026-114543 is an Incorrect Authorization vulnerability in the Drupal Simple User Management module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.11.0. The issue has been fixed in version 1.11.0.