CWE-284: Improper Access Control vulnerabilities

CVE-2026-110454 is an improper access control vulnerability in Ubiquiti Inc's UniFi Protect AI Key. A malicious actor with network access could exploit this flaw to access internal resources through the device. The vulnerability affects versions from 0 up to but not including 2.2.8. The CVSS 3.1 base score is 5.3, indicating a medium severity level. There are no known exploits in the wild, and no patch or remediation information is currently provided.

CVE-2026-100114 is an improper access control vulnerability in Adobe Content Credentials Rust SDK that allows an attacker to bypass security features and gain unauthorized write access without user interaction. It has a high severity score of 7.5 and does not impact confidentiality or availability but affects integrity.

CVE-2026-100115 is an Improper Access Control vulnerability in Adobe Content Credentials Rust SDK that allows an attacker to bypass security features and gain unauthorized write access without user interaction. The vulnerability is rated high severity with a CVSS score of 7.5. No patch or remediation information is currently provided.

CVE-2026-93895 is a critical vulnerability in IBM WebSphere Application Server - Liberty versions 20.0.0.12 through 26.0.0.10. It allows an unauthenticated remote attacker to bypass access controls configured on gRPC service methods, potentially leading to unauthorized access to sensitive operations. The vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impacts without requiring user interaction or privileges.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.10 suffer from insufficient isolation between servers sharing the same installation. This improper access control vulnerability can lead to high impact on confidentiality and integrity without user interaction. The vulnerability is tracked as CVE-2026-105443 and has a CVSS 3.1 score of 8.2, indicating high severity.

CVE-2026-70217 is an improper access control vulnerability in Microsoft SharePoint Server Subscription Edition that allows an authorized attacker to disclose information over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. Microsoft has released an official fix in version 16.0.20326.20190. The vulnerability has a CVSS score of 4.9, indicating a medium severity level. There are no known exploits in the wild at this time.

CVE-2026-102860 is a high-severity vulnerability in Microsoft SharePoint Server Subscription Edition involving improper access control. It allows an authorized attacker to elevate privileges over a network. The issue affects versions from 16.0.0 up to but not including 16.0.20326.20190. An official fix has been released in version 16.0.20326.20190.

IBM Maximo Application Suite - Location Service for Esri Component versions 9.0, 9.1, and 9.2 contain an improper access control vulnerability due to a misconfigured Kubernetes NetworkPolicy. This vulnerability allows unintended network egress, potentially exposing sensitive data or services. The issue has a high severity rating with a CVSS score of 7.7, indicating significant confidentiality impact but no integrity or availability impact.

CVE-2026-97691 is an improper access control vulnerability in the get-convex convex-backend. Before the self-hosted image and local deployment binary published on August 10, 2026, a malicious user could, in rare cases, read deployment information without authorization. The vendor has withheld detailed technical information to protect unpatched self-hosted deployments. Convex cloud deployments were automatically patched. The issue is fixed in the self-hosted image and local binary published on August 10, 2026. No exploitation in the wild is known.

CVE-2026-18166 is a high severity vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows. It involves improper access control related to the CREATE WRAPPER command, allowing a remote authenticated attacker to obtain sensitive information without user interaction.

CVE-2026-21139 is a high-severity vulnerability in Samsung Continuity Service for Windows prior to version 4.6.1217.0. It involves improper access control that allows adjacent attackers to manipulate the connected mobile device. The vulnerability has a CVSS 4.0 base score of 7.3, indicating significant risk. No explicit affected versions or patch information is provided in the input data.

CVE-2026-21135 is an improper access control vulnerability in Samsung Internet browser versions prior to 30.0.5.6. It allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 score of 5.9. No specific affected versions were explicitly stated beyond being prior to 30.0.5.6. There is no information about available patches or vendor advisories confirming remediation status.

CVE-2026-21118 is an improper access control vulnerability in the DownloadProvider component of Samsung Mobile Devices. It affects versions prior to the SMR Oct-2026 Release 1. This flaw allows local attackers with limited privileges to access files within scoped storage, potentially exposing sensitive data. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity. There are no known exploits in the wild at this time.

CVE-2026-21117 is an improper access control vulnerability in the CocktailBarService component of Samsung Mobile Devices prior to the SMR Oct-2026 Release 1. This flaw allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. No specific affected versions or patches are provided in the available data.

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.

CVE-2026-102781 is a medium severity vulnerability in the OrdaSoft Touch Slider extension for Joomla versions 1.0.0 through 5.4.5. It allows unauthenticated attackers to perform destructive create, read, update, and delete (CRUD) operations due to improper access control. Specifically, the module's AJAX handler lacks user authentication, authorization checks, and CSRF protection. Attackers can delete slider images by guessing sequential IDs or replace entire database tables with attacker-supplied content via a multipart upload.

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control vulnerability in the vertex result caching subsystem. This flaw allows a remote authenticated attacker to access sensitive information or inject malicious data. The vulnerability has a high severity rating with a CVSS score of 8.3.

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control vulnerability that allows a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but compromises confidentiality. It requires authentication and can be exploited remotely with low attack complexity.