CWE-862: Missing Authorization vulnerabilities

Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions.

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5.

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured low-privilege local user account. This account is intended for field technicians who need shell access for maintenance and diagnostics but should not have full administrative control over the device. This built-in account provides the initial access required to exploit this vulnerability. No additional credentials need to be obtained or brute-forced.

BuddyPress plugin for WordPress versions up to and including 14.3.3 suffers from an Insecure Direct Object Reference vulnerability due to missing authorization checks in the bp_notifications_action_bulk_manage function. This flaw allows authenticated users with Subscriber-level access or higher to manipulate notifications of other users, including deleting or marking them as read or unread.

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.

The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are reachable with no authorization enforced. An unauthenticated attacker able to reach the web UI can disable event definitions and SNMP data collection, suppressing event and alarm generation and stopping metric collection - silently degrading monitoring and detection - with the change persisted and reloaded into the running system. The solution is to upgrade to Horizon 36.0.4 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVE-2026-4129 is an improper access control vulnerability in NI SystemLink and NI SystemLink Server versions prior to 26.5.0. It allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The vulnerability has a high severity with a CVSS score of 8.1.

Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.

Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.

CVE-2026-81799 is a missing authorization vulnerability in the WP Swings Return Refund and Exchange For WooCommerce plugin versions prior to 4.6.5. This flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized actions related to refunds and exchanges. The vulnerability has a high severity rating with a CVSS score of 7.5 and is fixed in version 4.6.5.

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.

CVE-2026-81793 is a Missing Authorization vulnerability in the Dimitri Grassi Salon booking system affecting versions from initial through 10.31.9. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. There is no evidence of known exploits in the wild, and no official patch or remediation guidance has been provided yet.

Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.