CWE-863: Incorrect Authorization vulnerabilities

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these delivery paths did not consistently recheck the concrete original topic before sending the MQTT PUBLISH to the subscriber. This issue is fixed in versions 2.14.3 and 2.12.12.

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account. This issue is fixed in versions 2.14.3 and 2.12.12.

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode operator to send trace events to subjects that would not otherwise be permitted and to use trace-only behavior to prevent normal delivery or storage of affected messages. This issue is fixed in versions 2.14.3 and 2.12.8.

Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.

CVE-2026-56778 is an authorization bypass vulnerability in n8n versions before 2.25.7 and 2.26.x before 2.26.2. The flaw occurs in the Public API execution retry endpoint, which incorrectly authorizes users with the workflow:read scope to retry workflow executions, a capability intended only for users with workflow:execute permission. This allows authenticated users with read-only access to shared workflows to perform execution retries, violating the intended permission boundaries.

CVE-2026-56220 is an authorization bypass vulnerability in Capgo versions before 12.128.2. It allows attackers with read-only organization access to insert unauthorized OTA manifest entries via the public.manifest INSERT policy. These malicious entries can specify arbitrary s3_path values, which are served to devices through an unauthenticated endpoint, potentially enabling over-the-air metadata poisoning and delivery of malicious assets.

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45.5, a user can use a where clause on a table computed field (returning SETOF some_table) to infer row values that ought to be filtered for their role based on some_table's row-level permissions. While such rows cannot be returned directly, like predicates on strings for instance allow values to be brute forced efficiently with the where clause as an oracle. This issue is fixed in versions 2.49.2 and 2.45.5.

This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers. This issue is fixed in version 4.0.0-beta.466.

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

Gitea versions up to and including 1.26.2 contain a vulnerability that allows Git LFS object reuse to improperly authorize access to private source objects. This affects users who have repository access but do not have Code-unit access, potentially exposing sensitive data. The vulnerability is identified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-863 (Incorrect Authorization).

Gitea version 1.25.5 has a vulnerability where branch-specific write permissions are cached improperly during a pre-receive hook session. This flaw allows a user with per-branch maintainer-edit rights to reuse that permission across other refs, effectively escalating their access to full repository write privileges. The vulnerability is classified under CWE-863 and carries a high severity score of 8.8.

Gitea versions up to and including 1.26.2 have a vulnerability where repository RSS and Atom feed endpoints bypass API access token scope checks. This allows tokens without the required repository scope to access private repository commit data via these feeds. The issue is classified as CWE-863 (Incorrect Authorization).

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect authorization vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized command execution.

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been removed.