CWE-862: Missing Authorization vulnerabilities

CVE-2026-69453 is a vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and other versions. It involves missing authorization that allows an authorized local attacker to perform tampering. The vulnerability has a medium severity with a CVSS score of 5.5. Official fixes have been released in multiple Windows 10 builds to address this issue.

CVE-2026-69403 is a medium severity vulnerability in Microsoft Windows 10 Version 1607 SMB Server where missing authorization allows a locally authorized attacker to disclose information. This flaw affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-83942 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 and related builds. It involves missing authorization checks in the Windows Kernel, allowing a locally authorized attacker to elevate privileges. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has issued official fixes for all affected versions.

CVE-2026-69724 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition caused by missing authorization checks. It allows an authorized attacker with network access to execute code remotely. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20090. Microsoft has released an official fix in version 16.0.20326.20090.

CVE-2026-69641 is a critical missing authorization vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23. It allows an authorized attacker to elevate privileges over a network without user interaction. The flaw affects multiple builds prior to fixed versions and has a high impact on confidentiality, integrity, and availability. Microsoft has released official fixes for the affected versions.

CVE-2026-69380 is a high-severity vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23 involving missing authorization. It allows an authorized attacker to elevate privileges over a network without user interaction. The vulnerability affects multiple specific builds of Exchange Server 2016 and has been officially fixed in later versions.

CVE-2026-69553 is a missing authorization vulnerability in Microsoft Windows 10 Version 1809 and related builds that affects the Hyper-V component. It allows an authorized attacker to elevate privileges over a network. The vulnerability has a high severity score of 7.1 and is addressed by official patches from Microsoft.

CVE-2026-69377 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 and related builds. It involves missing authorization in the Windows Modern Device Management (MDM) component, allowing an authorized local attacker to elevate privileges. The vulnerability affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-83941 is a critical vulnerability in Microsoft Entra involving missing authorization controls. This flaw allows an authorized attacker to elevate their privileges over a network, potentially leading to complete compromise of confidentiality, integrity, and availability. An official fix is available from Microsoft.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.

CVE-2026-12647 is a critical missing authorization vulnerability in Ivanti Neurons for ITSM versions before 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server, impacting confidentiality, integrity, and availability.

CVE-2026-12646 is a critical Missing Authorization vulnerability in Ivanti Neurons for ITSM before version 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server without user interaction. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-12645 is a critical missing authorization vulnerability in Ivanti Neurons for ITSM versions before 2026.2. It allows a remote authenticated attacker to execute arbitrary code on the server without user interaction. The vulnerability has a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-18851 is a high-severity vulnerability in Ivanti Endpoint Manager Mobile prior to versions 12.10.0.0, 12.9.0.2, and 12.8.0.4. It involves missing authorization controls that allow a remote authenticated attacker to escalate their privileges to admin.

CVE-2026-77106 is a high-severity vulnerability in Commvault Cloud involving a missing authorization check in the cvlaunchd component. This flaw affects command execution authorization, potentially allowing unauthorized actions. Multiple Commvault components including Commserve, Webserver, Command Center, Media Agents, Clients, and HyperScale X are impacted. Users are advised to upgrade to the resolved maintenance releases to mitigate the issue.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.

The Event Tickets and Registration plugin for WordPress has a missing authorization vulnerability in its Stripe OAuth return endpoint. This flaw affects all versions up to and including 5.27.4 and allows unauthenticated attackers to overwrite the site's Stripe merchant credentials. Exploitation can redirect payment processing to an attacker-controlled Stripe account.

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.