Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse.
This issue affects QR Menu: before s1.05.12.
Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
CVE-2026-24740 is a high-severity improper access control vulnerability in Dozzle, a realtime log viewer for Docker containers. Versions prior to 9.0.3 allow users restricted by label filters to bypass these restrictions and obtain an interactive root shell in containers outside their authorized scope by directly targeting container IDs. This flaw enables privilege escalation within the same host, potentially compromising container integrity and confidentiality. The vulnerability requires no user interaction and can be exploited remotely over the network with low complexity. Although no known exploits are currently in the wild, affected users should upgrade to Dozzle 9.0.3 immediately to mitigate risk. European organizations using Dozzle in containerized environments are at risk, especially those with multi-tenant or segmented container deployments.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys. Version 4.11.7 contains a patch for the issue.
phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below allow an authenticated user without the dlattachment permission to download FAQ attachments due to a incomprehensive permissions check. The presence of a right key is improperly validated as proof of authorization in attachment.php. Additionally, the group and user permission logic contains a flawed conditional expression that may allow unauthorized access. This issue has been fixed in version
Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.
CVE-2026-20904 is a medium severity vulnerability in the Gitea open source Git server where authenticated users can improperly toggle the visibility of other users' OpenID URIs due to insufficient ownership validation. This improper access control flaw allows attackers to alter identity visibility settings without authorization, potentially impacting user privacy and trust. The vulnerability requires authentication but no user interaction beyond that, and does not affect confidentiality directly but impacts integrity of user settings. There are no known exploits in the wild yet. European organizations using Gitea for source code management should assess their exposure and apply mitigations promptly. The vulnerability is particularly relevant for countries with strong open source adoption and active software development communities. Mitigation involves restricting access controls, auditing user permissions, and monitoring changes to OpenID visibility settings. No official patch links are currently available, so organizations should follow Gitea updates closely. Overall, this vulnerability highlights the importance of strict access control enforcement in collaborative development platforms.
Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.
CVE-2026-20888 is a medium severity vulnerability in the Gitea Open Source Git Server where improper access control allows users with read access to pull requests to cancel scheduled auto-merges initiated by other users. This flaw arises from insufficient authorization checks in the web interface when handling auto-merge cancellations. Exploitation does not require user interaction but does require at least read-level privileges. The vulnerability impacts the integrity of the development workflow by enabling unauthorized interference with merge operations, though it does not affect confidentiality or availability. No known exploits are currently reported in the wild. European organizations using Gitea for source code management should review their access control policies and update or patch affected versions once fixes are available.
CVE-2026-20883 is an improper access control vulnerability in Gitea's stopwatch API that allows users whose access to private repositories has been revoked to still view issue titles and repository names via previously started stopwatches. This vulnerability affects Gitea, an open-source Git server widely used for source code management. The flaw arises because the stopwatch API does not re-validate repository permissions after access revocation, leading to unauthorized information disclosure. The CVSS score of 6.5 indicates a medium severity with high confidentiality impact but no integrity or availability impact. Exploitation requires at least low privileges and no user interaction, making it moderately easy to exploit. European organizations using Gitea for private repository hosting could face information leakage risks, potentially exposing sensitive project details. Mitigation involves updating Gitea to a fixed version once available, auditing stopwatch API usage, and restricting stopwatch functionality to trusted users. Countries with strong software development sectors and high adoption of open-source tools, such as Germany, France, and the UK, are most likely to be affected. Overall, defenders should prioritize patching and access control reviews to prevent unauthorized data exposure through this vulnerability.
Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.
Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different repository they can access.
CVE-2026-0798 is a low-severity improper access control vulnerability in the Gitea open source Git server. It causes release notification emails for private repositories to be sent to users who no longer have access, potentially leaking release titles, tags, and content. This occurs when a repository is changed from public to private but prior watchers still receive notifications. Exploitation requires the user to have had prior access and involves user interaction (email receipt). The vulnerability impacts confidentiality but not integrity or availability. No known exploits are reported in the wild. European organizations using Gitea for private code hosting should review notification settings and access controls to prevent unintended information disclosure.
### Summary
The contents of arbitrary files can be returned to the browser.
### Impact
Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.
### Details
- base64 encoded content of non-allowed files is exposed using `?inline&import` (originally reported as `?import&?inline=1.wasm?init`)
- content of non-allowed files is exposed using `?raw?import`
`/@fs/` isn't needed to reproduce the issue for files inside the project root.
### PoC
Original report (check details above for simplified cases):
The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice
```
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
```
Example full URL `http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init`
Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any user. When a victim previews a malicious typebot by clicking "Run", JavaScript executes in their browser and exfiltrates their OpenAI keys, Google Sheets tokens, and SMTP passwords. The `/api/trpc/credentials.getCredentials` endpoint returns plaintext API keys without verifying credential ownership. Version 3.13.2 fixes the issue.
CVE-2026-24039 is an improper access control vulnerability in Horilla HRMS version 1.4.0 that allows low-privileged employees to self-approve documents they upload. The approval UI is intended for administrators or high-privilege roles only, but insufficient server-side authorization lets standard employees alter approval status of their own documents. This undermines the integrity of HR processes by enabling unvetted document acceptance. The vulnerability has a CVSS score of 4.3 (medium severity) and does not require user interaction. It affects versions >=1.4.0 and <1.
CVE-2026-24036 is a medium severity improper access control vulnerability in Horilla, an open-source Human Resource Management System. Versions 1.4.0 through 1.4.x expose unpublished job postings via an unauthenticated endpoint, leaking draft job titles, descriptions, and application links. This unauthorized access can reveal sensitive internal hiring information and disrupt recruitment processes. The vulnerability does not allow modification of data or system compromise but poses confidentiality risks. It has been fixed in version 1.5.
