CVE-2026-54676 is a missing authorization vulnerability in Erudika's Scoold platform prior to version 1.69.0. It allows users with personal API tokens to retrieve replies from questions in private spaces they should not access. This occurs because the API endpoint for fetching answers does not properly check access permissions, exposing confidential replies. The issue is fixed in version 1.69.0.
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in questions belonging to that space because src/main/java/com/erudika/scoold/controllers/QuestionController.java in QuestionController.reply() and src/main/java/com/erudika/scoold/controllers/CommentController.java in CommentController.createAjax() do not apply the canAccessSpace authorization check used by the question read path. With scoold.is_default_space_public set to false and private spaces in use, a user with a valid session and a known or enumerable question identifier can send requests to POST /question/{id} and POST /comment, causing replies and comments to be stored in a thread the user cannot read. This permits unauthorized modification of private discussions and can trigger notifications that reveal the existence or metadata of private activity. This issue is fixed in version 1.69.0.
Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested node but not to referenced nodes serialized through Content Picker or Multi-Node Tree Picker properties, including pickers nested in Block List, Block Grid, or Rich Text Editor blocks. When DeliveryApi:PublicAccess is enabled, an anonymous caller can retrieve a protected node's name, route, and id through an unprotected referencing node and use ?expand to retrieve full property values. When the Delivery API is instead gated by the organization-wide API key, a key holder can still bypass per-node Public Access through the same expansion path. The same RequestContextOutputExpansionStrategyV2 and ElementOnlyOutputExpansionStrategy path also bypasses allowed or disallowed content-type alias restrictions for referenced content. Direct requests for the protected node still return 401, and no integrity or availability impact is established. This issue is fixed in versions 13.15.1, 17.5.3, and 18.0.2.
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.
CVE-2026-61596 is an authorization bypass vulnerability in djust prior to version 1.0.7. The flaw allows authenticated users to view or act on objects they are not authorized for via certain render entry points that did not enforce per-object authorization. This includes the initial HTTP GET render, SPA url_change navigation, and embedded child views using {% live_render %}. The issue is fixed in version 1.0.7 by routing all render entry points through a shared permission enforcement chokepoint. No reliable workaround exists other than upgrading.
CVE-2026-61594 is a critical vulnerability in djust versions prior to 1.0.7 where WebSocket transport bypasses standard Django authorization mechanisms. This allows anonymous or under-privileged clients to mount views and dispatch handlers over WebSocket that should be protected, including admin functions. The issue arises because authorization is checked via a custom method that does not enforce Django's usual access controls on WebSocket connections. The vulnerability is fixed in djust 1.0.7 by enforcing Django AccessMixin checks on all transports and introducing startup checks for unsafe auth patterns.
CVE-2026-61592 is a session fixation vulnerability in djust versions prior to 1.0.7. The issue arises because SSE sessions were keyed solely by a client-chosen session_id without binding to the authenticated user, allowing an attacker who obtains a valid session_id to impersonate the victim. This vulnerability is fixed in version 1.0.7 by binding SSE sessions to the owning principal and rejecting cross-principal access. A workaround is to disable the SSE transport.
Apache NiFi versions 2.9.0 through 2.11.0 have a missing authorization vulnerability in the Connector configuration update and verification REST API methods. These methods do not properly enforce authorization checks on Assets and Secrets referenced in the configuration, allowing authenticated users with write privileges on a Connector to apply Secret values from Parameter Providers they are not authorized to read. Additionally, Asset identifiers are accepted without verifying ownership by the Connector. This issue is mitigated by upgrading to Apache NiFi 2.12.0, which enforces read access checks on Parameter Providers and verifies Asset ownership during configuration updates.
Apache NiFi versions 1.5.0 through 2.11.0 have a missing authorization vulnerability in REST API methods that replace the entire contents of a Process Group. Authenticated users with write access to a Process Group could modify or remove components in descendant Process Groups without proper authorization. This issue affects deployments using component-level authorization policies and is limited by existing checks to stopped components. Upgrading to Apache NiFi 2.12.0 addresses this inconsistency in authorization enforcement.
Apache NiFi 2.11.0 contains a missing authorization vulnerability in its REST API methods for migrating version-controlled Process Groups into Connectors. The vulnerability allows authenticated users with read or write access to a Connector to access or migrate Process Groups without proper authorization checks on those Process Groups. This can lead to unauthorized enumeration of Process Group details or migration of Process Groups without write access. The vulnerability is mitigated in Apache NiFi 2.12.0 by enforcing authorization checks on the source Process Groups during migration requests.
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolation was enforced only on the HTTP path. The current tenant was stored in `threading.local()` and set exclusively by the HTTP-only `TenantMiddleware`, so on the live (WebSocket/SSE) path `get_current_tenant()` was always `None` during mount and every event handler — and the tenant-aware `QuerySet` manager failed OPEN (returned the unfiltered queryset, ignoring `STRICT_MODE`), disclosing every tenant's rows to whoever held the socket. `threading.local` was additionally shared across connections on the `sync_to_async` executor thread. This issue is fixed in djust 1.0.7. Tenant storage moved to a `contextvars.ContextVar` (per async task); the resolved tenant is bound around WS/SSE mount and every dispatch; both managers scope the base queryset once and fail CLOSED (`.none()` under the default `STRICT_MODE`); and system check S006 warns when `STRICT_MODE=False`. No known workarounds are available on the live path.
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
CVE-2026-82964 is a high-severity vulnerability in Gen Digital's Avast security products affecting versions prior to 26.8. It involves improper preservation of permissions in the Avast sandbox minifilter driver on Windows, allowing a local low-privileged attacker inside the sandbox to escape file isolation and escalate privileges to SYSTEM. The flaw arises because the driver fails to correctly apply the original security descriptor when virtualizing files, resulting in permissive permissions on virtualized copies. This enables a sandboxed process to rewrite security descriptors, access sensitive files like the SAM database, extract NTLM password hashes, and execute code with SYSTEM privileges.