CWE-862: Missing Authorization vulnerabilities

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.

CVE-2026-85576 is a vulnerability in the All in One Files Upload WordPress plugin versions before 2.0.17. The plugin lacks capability checks and does not verify the authenticity of requests when saving settings. This allows any authenticated user, including low-privilege roles like subscribers, to modify plugin settings without proper authorization.

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

CVE-2026-86136 is a high-severity vulnerability in WatchGuard Fireware OS affecting multiple versions prior to fixed releases. It involves a missing authorization check in the wgagent management daemon's session initialization, allowing an authenticated low-privileged user, including read-only or guest administrators, to crash the wgagent process and read arbitrary files accessible to the daemon via specially crafted management API requests.

CVE-2026-81841 is a medium severity vulnerability in Grafana Enterprise where pausing a shared public dashboard does not revoke its access token for frontend bootstrap data endpoints. This allows anyone with the link to the paused dashboard to retrieve its data source configuration, including stored credentials for browser-accessible data sources, without authentication. Deleting the shared dashboard properly revokes the token and prevents access.

A critical missing authorization vulnerability (CWE-862) exists in the Wikimedia Foundation Mediawiki TemplateSandbox Extension. This flaw allows unauthorized access to functionality that should be constrained by access control lists (ACLs). The issue affects all versions before 1.46.1, including 1.45.5 and 1.43.10. A fix is available in version 1.46.1.

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.