Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request.
This issue affects :
* Devolutions Server 2026.2.4.0 through 2026.2.12.0
* Devolutions Server 2026.1.23.0 and earlier
An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.
In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router.
The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However, the ABAC middleware evaluated the original request path including the trailing slash. If ABAC route lookup did not find a matching slash-suffixed route, the request was passed onward and the router then stripped the slash and executed the protected handler without the intended ABAC authorization decision and without the expected ABAC query filters.
An unauthenticated or unauthorized network attacker could append a trailing slash to protected API routes to reach handlers that should have been denied by ABAC policy. Depending on the exposed component, HTTP method, and deployed policy, this could allow unauthorized read, create, update, delete, or upload operations.
The issue affects ABAC-enabled deployments of services that use the shared router and ABAC middleware, including AAS Repository, Submodel Repository, AAS Registry, Submodel Registry, Concept Description Repository, Discovery, AAS Environment upload, and related services. The issue is fixed in Eclipse BaSyx Go Components v1.0.1.
An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and unmount arbitrary file systems and modify the network configuration via NetworkManager.
This issue affects PortProtonQt before 0d0f0950ebd948cdf82e8c3e1ebd2bcb9b8bafbe.
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.
CVE-2026-13061 is a medium-severity vulnerability in MongoDB Server where an authenticated user can view session metadata of other users via the $listSessions aggregation stage. This metadata, normally restricted to cluster-level administrators, includes active session IDs, usernames, and activity timestamps. The vulnerability affects MongoDB Server versions 7.0, 8.0, and 8.3.0. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority.
CVE-2026-13068 is an authorization vulnerability in MongoDB Server where an authenticated user with cursor termination privileges on one database may improperly terminate active cursors on another database. This occurs due to an authorization check that does not correctly limit privileges to the intended database namespace, potentially disrupting query operations for other users. The vulnerability affects multiple MongoDB Server versions including 7.0, 8.0, 8.2.0, and 8.3.0. The severity is rated low with a CVSS score of 2.3. No official patch or remediation guidance has been provided yet.
Gitea versions prior to 1.27.0 contain a vulnerability where a fork pull-request Actions workflow can read a third private repository if that repository trusts the fork's base repository owner as a collaborative owner. This occurs due to a missing permission guard against fork pull-requests in the collaborative-owner branch, resulting in unauthorized read access. The vulnerability leads to a confidentiality breach exposing the full source code of a private repository to an untrusted fork PR author. A patch is available to address this issue.
Gitea versions prior to 1.27.0 contain a vulnerability in the organization-level Actions API that allows any member of the organization to enumerate workflow runs and jobs across all repositories within that organization. This includes private repositories and repositories where the user lacks explicit permissions. The issue is due to missing repository-level access control checks in the API endpoints, which rely solely on organization membership for authorization.
Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1).
A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management endpoint performs an insufficient authorization check. The endpoint validates only a coarse privilege level but does not verify that the requesting user has access to the specific Machine Learning job or notification resources provided in the request. As a result, a low-privileged user with Machine Learning access in any Kibana space can manipulate Machine Learning audit and notification records for arbitrary jobs—including jobs in other spaces or belonging to other users—by leveraging Kibana's internally elevated credentials to write to restricted Machine Learning system indices that the user cannot access directly.
Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by the configured security policy.
FUXA version 1.3.0 contains an unauthenticated remote code execution vulnerability in the POST /api/runscript endpoint when secureEnabled is true. An attacker can exploit the test mode feature to execute arbitrary code by supplying a valid script ID and name. This occurs because the endpoint executes attacker-supplied code instead of the stored script's code when test: true is set. The vulnerability is fixed in version 1.3.1.
CVE-2026-56144 is an incorrect authorization vulnerability in Elasticsearch's ingest simulation feature. It allows authenticated users with limited index privileges to trigger ingest pipelines on indices they are not authorized to access and retrieve index mapping metadata for those indices. The vulnerability has a CVSS score of 5.3, indicating medium severity.
CVE-2026-56146 is an improper access control vulnerability in Kibana affecting version 9.4.0. It allows a low-privileged authenticated user with read-only Security Solution access to perform unauthorized write operations on Entity Analytics Watchlist configurations. Under certain deployment conditions, this flaw may also permit access to data beyond the user's authorized scope.
CVE-2026-49092 is a medium severity vulnerability in Kibana involving an unintended proxy or intermediary ('Confused Deputy') issue. It allows a lower-privileged user to access data from sources they are not authorized to access by leveraging another user's privileges due to improper access control enforcement.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
FUXA versions 1.2.11 through 1.3.0 contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code as root. This vulnerability persists even when the software is configured with its most secure settings enabled. The issue is resolved in version 1.3.1.
CVE-2026-47697 is an authorization vulnerability in shelf.nu, a multi-tenant platform for tracking physical assets. Versions prior to 1.20.2 allow authenticated users to access or modify data belonging to other organizations by exploiting insufficient verification of entity IDs. This cross-tenant IDOR (Insecure Direct Object Reference) flaw also permits bypassing a loader-only restriction on personal-workspace bookings. The issue is patched in version 1.20.2. No known workarounds exist.