CVE-2026-17183 is a high-severity vulnerability in Grafana OSS where an authenticated user with permission to create or edit alert rules can bypass datasource query authorization. By marking an alert rule query as a server-side expression referencing a real datasource UID, the user can access data through Grafana's datasource credentials without proper permission. This incorrect authorization flaw can expose sensitive data to unauthorized users.
Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The route treats file permissions as optional after the `ExecuteEvents` gate. When the caller has neither file permission, it selects `CredentialsAccess::InvokeNone`. In the Azure credential provider, `InvokeNone` still mints a `content_sas_token` for `apps/{app_id}` with `sp=rwdl`, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch.
CVE-2026-41424 is an incorrect authorization vulnerability in Wazuh versions from 4.9.0 up to but not including 4.10.4, and from 4.11.0 up to but not including 4.14.6. It allows an authenticated user with the users_admin role to overwrite passwords of protected administrator accounts, including the superuser, by exploiting improper user identity verification in the API. This flaw is fixed in versions 4.10.4 and 4.14.6.
Wazuh Manager versions from 4.0.0 up to but not including 4.14.5 contain an authorization vulnerability allowing a low-privilege read-only API user to retrieve the cluster key. This key can be used to impersonate a cluster worker and escalate privileges to perform administrative actions. The issue is fixed in version 4.14.5.
Dell Command Update (DCU) versions prior to 5.7.1 contain an incorrect authorization vulnerability (CWE-863). This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability does not impact confidentiality or availability but can impact integrity. The CVSS 3.1 base score is 5.5 (medium severity).
stigmem-node versions before 0.9.0a12 have an object level authorization vulnerability in the decay sweep endpoint. Authenticated users with write access to one tenant can perform decay operations that affect all tenants, leading to cross-tenant data expiration or information disclosure via dry runs.
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.
A vulnerability in Netflix's Lemur prior to version 1.9.2 allowed non-administrator members of a role to update that role's membership and rename the role via a PUT API endpoint. This incorrect authorization flaw enabled lateral privilege escalation within roles that control TLS certificate and authority access. The issue was fixed in Lemur version 1.9.2 by restricting the PUT handler to administrators only.
Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the .can() authorization gate permits every authenticated identity, including the read-only role. A read-only user can access POST /api/1/authorities, POST /api/1/certificates/upload, POST /api/1/pending_certificates//upload, POST /api/1/notifications, PUT or DELETE /api/1/notifications/, and POST /api/1/domains to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that reach an SSRF sink, and create domain entries. Explicitly setting either flag to False continues to opt into the permissive behavior. This issue is fixed in version 1.9.1.
authentik versions prior to 2026.2.6 and between 2026.5.0 and before 2026.5.5 contain an authorization bypass vulnerability in the Remote Access Control endpoint listing. Authenticated users can retrieve all configured endpoints and their connection settings, including stored credentials, regardless of their access rights. This flaw allows unauthorized access to managed RDP, SSH, and VNC targets, exposing sensitive credentials and enabling interactive access to systems outside the user's authorization scope. Deployments not using the enterprise Remote Access Control provider are not affected. The issue is fixed in versions 2026.2.6 and 2026.5.5.
CVE-2026-70657 is an incorrect authorization vulnerability in copyparty, a portable file server. Versions prior to 1.20.17 allow a combination of directory-key and file-key flags to convert a valid file key into a directory key, granting unintended read access to the containing folder. This issue requires manual enabling of both filekeys and dirkeys simultaneously. The vulnerability is fixed in version 1.20.17.
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.
Onyx versions prior to 3.1.10, 3.2.14, and 4.0.0 contain a vulnerability where certain API endpoints expose another user's OAuth Authorization header to unauthorized BASIC_ACCESS users. This occurs due to per-user tokens being copied into a shared admin configuration and then returned in API responses. The issue has been fixed in versions 3.1.10, 3.2.14, and 4.0.0.
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
CVE-2026-18674 is a vulnerability in Kong Inc.'s Kong Mesh affecting specific versions where the global control plane incorrectly attributes resources received over the zone-to-global KDS sync using a sender-controlled identifier rather than the authenticated zone identity. This flaw allows an authenticated zone to inject, attribute, and overwrite resources in another zone's namespace, resulting in a cross-zone isolation bypass.
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own interface denies them, and to retrieve every chart's configuration in a single request. The disclosed configuration can include the credentials of a remote data source a chart reads from.
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the pods_admin AJAX router funnels every access check — including the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which under the JSON meta-box-loader compatibility path only writes failures to the PHP error log and returns false instead of terminating the request, rendering all guards ineffective. This makes it possible for unauthenticated attackers to escalate their privileges to Administrator or overwrite the password of any user account, including the site owner's, enabling complete site takeover, or perform another administrator action.
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy. All Octavia deployments are affected.
A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.
Incorrect Authorization (CWE-863) in Kibana Fleet can lead to privilege escalation via Privilege Abuse (CAPEC-122). Fleet restricts some callers to managing integration policies for one specific integration. When an existing integration policy was updated, that restriction was evaluated against the integration recorded on the stored policy rather than against the replacement integration supplied with the update. An authenticated user holding only the Elastic Defend endpoint policy management privilege was therefore able to convert an endpoint policy they administer into a policy for a different integration, and to supply that integration's configuration at the same time.