CWE-862: Missing Authorization vulnerabilities

Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5 contain an authorization bypass vulnerability in the handling of the internal-only deleteContainer opcode. This flaw allows any client able to open a TCP connection to the ZooKeeper client port to delete empty persistent znodes without proper ACL checks or authentication. The issue is fixed in versions 3.8.7 and 3.9.6.

CVE-2026-59739 is a missing authorization vulnerability in Apache ZooKeeper that allows information disclosure of ACL-restricted paths. An attacker can register exists-watches on non-existent paths and then reconnect after those paths are created with restricted ACLs, thereby discovering the paths. The vulnerability arises from an incomplete fix for a previous issue, where ACL checks were not applied during the SetWatches reconnect replay handler. Although the data of the znode is not exposed, the path itself may contain sensitive information such as usernames or login IDs. The issue affects Apache ZooKeeper versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. Upgrading to versions 3.8.7 or 3.9.6 resolves the vulnerability.

Subscriptions for WooCommerce plugin versions before 2.0.3 contain a missing authorization vulnerability that allows logged-in customers to cancel their own active subscriptions via crafted requests without proper security token verification.

CVE-2026-84907 is a vulnerability in the Eventin WordPress plugin versions 4.1.5 up to but not including 4.1.24. It involves missing authorization checks during order finalisation when the offline (local) payment method is enabled. The plugin relies on a nonce exposed to unauthenticated visitors and does not verify ownership of the order, allowing attackers to reset orders and their attendees to a pending state, invalidating paid tickets.

CVE-2026-84905 is a missing authorization vulnerability in the Eventin WordPress plugin versions before 4.1.24. It allows users with contributor-level access or higher to create new WordPress user accounts with capabilities beyond their own. This includes the ability to publish content and upload files. Attackers can supply an email address they control to obtain working login credentials for the created accounts.

The Eventin WordPress plugin versions before 4.1.24 contain a missing authorization vulnerability. This flaw allows unauthenticated users to reuse a token issued to a guest at checkout to modify the order's tickets, enabling them to replace a paid ticket with a free one and complete the order without payment.

MultiVendorX WordPress plugin versions from 5.0.0 up to but not including 5.0.16 contain a missing authorization vulnerability in one of its REST API routes. This flaw allows any authenticated user, including low-privileged roles such as subscribers, to overwrite store details, payout settings, and ownership records of any store. The vulnerability is identified as CWE-862 (Missing Authorization).

The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin up to version 2.8.16 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to access administrator-configured header and footer code blocks that are intended to be hidden from public view. The vulnerability is due to a missing capability check on the 'ai-debug-code' URL parameter.

The TrueBooker – Appointment Booking and Scheduler System WordPress plugin up to version 1.2.3 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to modify the email address of any user account, including administrators. Exploiting this can enable attackers to reset passwords and gain unauthorized access to accounts.

CVE-2026-82567 is a medium severity vulnerability in mySCADA Technologies mySCADA myPRO affecting versions 0 through 2.1. The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint that allows sending SMS messages via a connected GSM modem without requiring authentication. An attacker with network access can exploit this to send arbitrary SMS messages.

CVE-2026-73807 is a critical vulnerability in the mySCADA myPRO Manager command API where authentication is not properly enforced for privileged functions. This allows an unauthenticated attacker with network access to invoke privileged management operations. The vulnerability affects versions from 0 up to and including 2.1 of mySCADA myPRO. The CVSS score is 9.8, indicating a high severity with full confidentiality, integrity, and availability impact.

CVE-2026-66887 is a critical vulnerability in the Digital Watchdog VMAX A1 G4 DVR where authorization is missing on state-changing CGI endpoints and session checks are not performed. This allows unauthorized users to perform actions that should require authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the device.

CVE-2026-56830 is a missing authorization vulnerability in shopperlabs shopper versions prior to 2.9.2. An authenticated staff user with browse_products permission can replace product thumbnail and gallery images without having product-edit permission. The vulnerability is limited to products whose edit pages were loaded and does not allow modifying arbitrary products. This issue is fixed in version 2.9.2.

CVE-2026-56827 is a missing authorization vulnerability in shopperlabs shopper versions prior to 2.9.2. It allows browse-only staff users to perform unauthorized bulk delete and visibility change actions on attributes, tags, brands, categories, or suppliers via certain bulk action endpoints. This can disrupt product variants and storefront catalog visibility. The issue is fixed in version 2.9.2.

CVE-2026-56829 is a missing authorization vulnerability in shopperlabs shopper Admin Panel versions prior to 2.9.2. It allows any authenticated admin-panel user, including those with only browse_products permission, to manipulate product variant stock quantities without proper authorization. This can lead to unauthorized inflation or reduction of stock and forced out-of-stock states. The issue is fixed in version 2.9.2.

CVE-2026-56825 is a missing authorization vulnerability in shopperlabs shopper versions prior to 2.9.2. Authenticated staff users with only browse_collections permission can perform unauthorized delete actions on collections, detaching products or emptying collections. This can disrupt catalog landing pages and promotions. The issue is fixed in version 2.9.2.

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls.

motionEye versions prior to 0.44.0 have a missing authorization vulnerability in the ActionHandler.post() method. This flaw allows unauthenticated remote attackers to invoke actions such as snapshot, record start/stop, PTZ controls, alarm, and lighting commands via the /action/<camera_id>/<action> endpoint. The issue is fixed in version 0.44.0.

The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the database command/query HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints. The issue does not directly disclose or write record data, but unauthorized schema mutation can corrupt the meaning of stored records and breach the documented permission model. This issue is fixed in version 26.6.1.