CWE-284: Improper Access Control vulnerabilities

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILO_CONFIG_CONTENT can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-8752 is a medium severity vulnerability in h2oai h2o-3 version 7402 that involves improper access controls in the Rapids setproperty Primitive Handler component. The issue exists in the exec function of the file AstSetProperty.java. This vulnerability can be exploited remotely without authentication or user interaction. Although a public exploit is available, there is no vendor response or patch at this time. The vulnerability could allow unauthorized manipulation due to improper access control enforcement.

CVE-2026-8750 is an information disclosure vulnerability in the h2oai h2o-3 product, specifically affecting the importFiles function in the ImportFile API component. The issue exists in version 7402 and allows remote attackers to disclose information. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor has not responded to the disclosure, and no official patch or remediation guidance is currently available. Exploit code is publicly available, but there are no confirmed reports of exploitation in the wild.

Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the contents of cross-chip debug (XCD) registers potentially resulting in loss of data integrity or confidentiality.

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1.

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, an adversary with knowledge of an investigation ID, could update the metadata of an investigation of another user. This vulnerability is fixed in 1.2.3.

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.

Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.

CVE-2026-42177 is an improper access control vulnerability in the Siemens linux-entra-sso browser plugin for Linux versions prior to 1.8.1. The vulnerability arises because the Chrome adapter registers a broad URL matching rule that attaches the Entra ID Primary Refresh Token (PRT) cookie to requests matching a substring pattern, without properly restricting the URL scope. This can cause the PRT cookie to be sent to attacker-controlled hosts if the URL path embeds the legitimate login URL, potentially exposing sensitive authentication tokens. The issue is fixed in version 1.8.1.

Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.