Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and trusted CA certificate, impersonate a trusted node, and take control of the node. This issue is fixed in versions 2.14.9, 2.15.4, and 2.16.2.
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.
The Master Addons for Elementor plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 3.2.2. This flaw allows authenticated users with contributor-level access or higher to modify or delete arbitrary WordPress posts by exploiting improper authorization checks related to popup management. The vulnerability arises because the plugin does not properly verify user permissions when handling actions involving popup IDs.
The WP Easy Pay – Payment and Donation Form Builder for Square WordPress plugin contains an authorization bypass vulnerability in all versions up to and including 4.5.0. This flaw allows authenticated users with subscriber-level access or higher to delete posts permanently or change published posts to draft status without proper authorization checks.
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to demote administrator-owned published builder templates (header, footer, front page, single, archive, 404, and search) to draft status and replace them with attacker-authored block content rendered site-wide, enabling defacement, phishing, and SEO spam. This is possible because the mzb-builder-template post type is registered with capability_type='post' and exposed via the REST API, and the _mzb_template meta key is accessible to any user with edit_posts capability, meaning Contributor-level users and above can trigger the vulnerable save_post() hook.
The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the title and content of arbitrary WordPress posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options.
The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary subkeys of the foxtool_settings option, including enabling site-wide SVG uploads by toggling the media-up3 key, which can facilitate stored cross-site scripting via malicious SVG files.
The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete any arbitrary Filter Gallery records — including all associated filters, image mappings, settings, and details options — by supplying attacker-controlled gallery IDs. The nonce bypass requires omitting the nonce POST field entirely rather than submitting an invalid value, as a present-but-invalid nonce is correctly rejected.
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.
CubeCart v6 prior to version 6.7.5 contains a missing authorization vulnerability in the delete-note handler within the admin order management code. This flaw allows an authenticated administrator without order modification privileges to delete order-history notes by invoking the handler with valid parameters. The vulnerability permits removal of operational records and audit-trail data, potentially impacting order integrity and traceability. The issue is resolved in CubeCart version 6.7.5.
CubeCart v6 prior to 6.7.5 contains a missing authorization vulnerability in its GDPR tools. Authenticated administrators with read-only customer privileges can bypass intended interface restrictions to delete customer records, accounts without orders, or guest accounts. This leads to irreversible deletion of data, impacting data integrity and availability. The issue is resolved in version 6.7.5.
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory _id without verifying through the related Agent that the record belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read victim AgentMemory content, including conversation history, agent context, task data, embeddings, and metadata, delete an individual victim memory, or clear all memory belonging to a victim agent. This breaks tenant isolation and causes unauthorized disclosure and data loss. This issue is fixed in version 0.9.1.
CVE-2026-54671 is an authorization bypass vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.5 improperly map an internal control resource to an empty array, which the system treats as granting unconditional access to authenticated users. This flaw allows low-privileged users to read, modify, or delete other users' sensitive personal and medical records without verifying ownership. The issue is fixed in version 3.8.5.
CVE-2026-54608 is a vulnerability in MythicalLTD's MythicalDash (version 3.5.4-aurora and earlier) involving insufficient verification of data authenticity in the Stripe payment processing API. The flaw allows authenticated users to exploit the payment process by submitting a pending payment code without actual payment confirmation, resulting in free virtual currency top-ups. This leads to direct financial loss through unauthorized consumption of hosting resources. No fixed version is currently available.
The Booking for Appointments and Events Calendar – Amelia WordPress plugin (Premium version) up to and including version 2.4.4 contains a missing authorization vulnerability. Authenticated users with the wpamelia-provider role can access and modify arbitrary customer data via the /users/customers/<id> endpoint without proper ownership verification. This includes the ability to reset customer passwords and potentially take over WordPress user accounts with roles up to Editor if those users had made an Amelia booking.
The Booking for Appointments and Events Calendar – Amelia WordPress plugin contains a missing authorization vulnerability in all versions up to and including 2.4.5. This flaw allows unauthenticated attackers to create approved appointment bookings without completing payment by exploiting the plugin's acceptance of a client-supplied package-redemption identifier without validation.
The Motors – Car Dealership & Classified Listings Plugin for WordPress contains a missing authorization vulnerability in the mvl_ajax_dealer_load_cars() function. This flaw affects all versions up to and including 1.4.120 and allows unauthenticated attackers to access draft, pending, private, and future car listings of arbitrary users. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Kiwi TCMS versions prior to 16.0 contain a missing authorization vulnerability where the unauthenticated /init-db/ endpoint remains accessible after initial setup. This endpoint triggers database migrations via manage.py migrate. Although the migration command is reentrant and repeated access does not cause data loss, state changes, information disclosure, or availability impact, the lack of authorization is a security weakness. The issue is fixed in version 16.0.