CWE-862: Missing Authorization vulnerabilities

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.

CVE-2026-76963 is a vulnerability in SAP NetWeaver and ABAP Platform caused by a missing authorization check in the Application Server ABAP. An authenticated attacker could exploit this to gain unauthorized access to sensitive system configuration information. The impact is limited to confidentiality with no effect on integrity or availability. The vulnerability has a medium severity rating with a CVSS score of 4.3. No affected versions or patch information are provided.

CVE-2026-76962 is a vulnerability in the SAP S/4HANA Manage Bank Chains app where insufficient authorization checks allow a low-privileged attacker to delete certain entries they should not access. This flaw impacts availability with no effect on confidentiality or integrity. The vulnerability affects SAP S/4HANA versions 108 and 109 and has a medium severity rating with a CVSS score of 4.3.

CVE-2026-86499 is a vulnerability in JetBrains YouTrack before version 2026.1.14047 where predefined search fields exposed all group names to any user regardless of their visibility permissions. This issue relates to improper access control (CWE-862). The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact integrity or availability. No known exploits are reported in the wild. A fix is available in version 2026.1.14047.

CVE-2026-86496 is a medium severity vulnerability in JetBrains YouTrack before version 2026.2.18769. It involves missing access control on Helpdesk authorized reporters, which results in exposure of reporter email addresses. The vulnerability does not allow modification or denial of service but does impact confidentiality of reporter information.

CVE-2026-86495 is a vulnerability in JetBrains YouTrack before version 2026.2.18687 where missing permission checks allowed users with limited privileges to create knowledge base articles in projects they should not have access to. This issue is classified under CWE-862 (Missing Authorization). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No known exploits are reported in the wild, and the product is not a cloud service. A fix is implied by the versioning but no explicit patch link is provided.

CVE-2026-86494 is a vulnerability in JetBrains YouTrack versions before 2026.2.18634 that allows unauthorized changes to links on inaccessible issues when cloning a whiteboard. This issue is classified under CWE-862 (Missing Authorization). The vulnerability has a high severity with a CVSS score of 7.7, indicating it requires low privileges to exploit and can cause a significant integrity impact without affecting confidentiality or availability.

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

CVE-2026-86307 is a cross-site request forgery (CSRF) vulnerability affecting the light0011 cms. The vulnerability allows remote attackers to perform unauthorized actions by tricking authenticated users into submitting forged requests. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.

Masteriyo LMS plugin for WordPress versions up to 2.2.0 contains a missing authorization vulnerability that allows unauthenticated attackers to delete arbitrary course progress records of any student. This is due to a missing capability check in the 'delete_item_permissions_check' function within the CourseProgressItemsController. The vulnerability has a medium severity with a CVSS score of 5.3.

The Flamingo WordPress plugin up to version 2.6.2 has an authorization bypass vulnerability. Authenticated users with contributor-level access or higher can enumerate taxonomy terms, including sensitive internal form and workflow information. This occurs because the plugin does not properly verify user authorization for certain WordPress core API calls such as XML-RPC wp.getTerms and admin-ajax ajax-tag-search.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerability is considered critical because it allows an attacker to execute commands remotely on a target system by sending a specially crafted request to the application, bypassing intended restrictions on code execution.Dell recommends customers to upgrade at the earliest opportunity.

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually offered on the registration form, allowing unauthenticated users to assign themselves to restricted B2B customer groups and to skip the manual account-approval workflow during self-registration.

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add new Subscriber users with employer account member permissions, who in turn can escalate privileges by updating the email address of any user, including Administrator users.

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.