CWE-863: Incorrect Authorization vulnerabilities

CVE-2026-114553 is an Incorrect Authorization vulnerability in the Drupal Frontend Editing module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.9.3. The issue has been fixed in version 1.9.3.

CVE-2026-114544 is an Incorrect Authorization vulnerability in the Drupal Media Bulk Upload module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 3.0.6. The issue has been fixed in version 3.0.6.

CVE-2026-114545 is an Incorrect Authorization vulnerability in the Drupal Fullcalendar View module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 5.2.6. The issue is fixed in version 5.2.6.

CVE-2026-114554 is an Incorrect Authorization vulnerability in the Drupal AI File to Text module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.0.1. The issue has been fixed in version 1.0.1.

CVE-2026-114571 is an incorrect authorization vulnerability in the Drupal Rabbit Hole module that allows forceful browsing. It affects Rabbit Hole versions from 0.0.0 up to but not including 1.3.0. The issue is fixed in version 1.3.0.

CVE-2026-118540 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.2.0. Fixed versions are 2.41 and 3.2.0.

CVE-2026-118541 is an incorrect authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

CVE-2026-118542 is an Incorrect Authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41.0, and from 3.0.0 up to but not including 3.3.13. The issue has been fixed in versions 2.41.0 and 3.3.13.

CVE-2026-118555 is an incorrect authorization vulnerability in the Drupal Commerce License module that allows forceful browsing. This affects Commerce License versions from 0.0.0 up to but not including 3.1.1. The issue is fixed in version 3.1.1.

CVE-2026-118556 is an incorrect authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. Fixed versions are 2.16.0 and 3.0.6.

CVE-2026-118557 is an Incorrect Authorization vulnerability in Drupal Commerce Shipping that allows forceful browsing. It affects Commerce Shipping versions from 0.0.0 up to but not including 2.16.0, and from 3.0.0 up to but not including 3.0.6. The issue has been fixed in versions 2.16.0 and 3.0.6.

An Incorrect Authorization vulnerability (CWE-863) exists in Drupal AI (Artificial Intelligence) allowing resource injection. This affects versions from 0.0.0 up to but not including 1.4.11, and from 1.5.0 up to but not including 1.5.2. Fixed versions are 1.4.11 and 1.5.2.

CVE-2026-118569 is an incorrect authorization vulnerability in the Drupal Fasttoggle module that allows forceful browsing. This affects Fasttoggle versions from 0.0.0 up to but not including 4.1.1. The issue has been fixed in version 4.1.1.

CVE-2026-118567 is an incorrect authorization vulnerability in the Drupal Bulk Update User Roles module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.0.5. The issue has been fixed in version 1.0.5.

CVE-2026-118583 is an incorrect authorization vulnerability in the Drupal Field Permissions module that allows forceful browsing. This affects versions from 0.0.0 up to but not including 1.6.0. The issue has been fixed in version 1.6.0.

CVE-2026-118584 is an incorrect authorization vulnerability in the Drupal Field Permissions module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 1.6.0. The issue has been fixed in version 1.6.0.

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability (CVE-2026-102260) is fixed in Nomad Community Edition 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 requires issuerRef.kind to be exactly AWSPCAIssuer or AWSPCAClusterIssuer and to match the issuer it references.

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user