CWE-285: Improper Authorization vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

Note Mark versions prior to 0.19.5 have an unauthenticated API endpoint that allows enumeration of metadata for soft-deleted notes in public books. This occurs because the endpoint improperly applies authorization checks when the "deleted=true" query parameter is used, exposing information that owners intended to be hidden. The issue is fixed in version 0.19.5.

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

CVE-2026-82553 is an improper authorization vulnerability in the sambitraj Student Management System affecting the mysqli_query function in student_dashboard.php. The issue arises from manipulation of the roll_no argument, allowing unauthorized access. The vulnerability can be exploited remotely and public exploit code is available. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The vendor has been informed but has not yet responded or provided a fix. The CVSS score is 5.3, indicating medium severity.

A vulnerability in Vikunja versions from 0.24.6 up to but not including 2.4.0 allows an authenticated user to delete Kanban assignments and ordering across projects due to improper authorization checks in the DELETE /api/v1/projects/:project/views/:view endpoint. The flaw arises because the authorization logic does not verify that the view belongs to the specified project, enabling cross-tenant destructive actions on task buckets and positions. This issue is fixed in version 2.4.0.

A vulnerability in the go-vikunja vikunja task management platform allows an authenticated user with read access to a source project to duplicate it under an arbitrary target parent project without proper write permission checks. This improper authorization occurs because the duplication operation skips the target parent's write-permission verification, enabling injection of attacker-owned content into another user's or team's project hierarchy. The issue affects versions from 0.21.0 up to but not including 2.4.0 and is fixed in version 2.4.0.

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.

Weblate versions prior to 2026.7 contain a vulnerability where authenticated users with project access can retrieve change history of restricted components via nested API endpoints without proper component-level access checks. This exposure allows unauthorized viewing of sensitive translation data. The issue is fixed in version 2026.7.

Winter CMS versions prior to 1.2.13 contain an improper authorization vulnerability in the backend handler dispatch mechanism. Authenticated backend users could invoke arbitrary controller methods, including protected and private ones, bypassing role and permission checks. The Users controller was specifically affected, allowing user-management actions without proper permissions. This issue is fixed in version 1.2.13.

Doorkeeper OpenID Connect versions prior to 1.10.4 have an improper authorization vulnerability in the Dynamic Client Registration endpoint. The endpoint accepts client-supplied scopes without validating them against the server's configured scopes, allowing self-registered clients to obtain unauthorized scopes. This privilege escalation is due to the scopes attribute being assigned directly from user input without validation, combined with default configuration settings that do not enforce scope restrictions. The issue is fixed in version 1.10.4.

CVE-2026-66422 is an improper authorization vulnerability in Apache Tomcat caused by incorrect use of security-role-ref definitions as role aliases within the Realm, in addition to their correct use with Request.isUserInRole(). This affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.25 through 9.0.120, and some older EOL versions. The issue allows unauthorized actions due to flawed role authorization checks. Upgrading to versions 11.0.25, 10.1.58, or 9.0.121 resolves the vulnerability.

CVE-2026-55571 is an improper authorization vulnerability in djust prior to version 1.0.4. The issue occurs because the LiveViewConsumer.handle_mount method sends a navigation frame on authorization failure but does not close the WebSocket or clear the view instance. This allows raw WebSocket clients to bypass authentication checks and invoke event handler methods without a valid session, potentially leading to unauthorized sensitive reads or mutations. The vulnerability is fixed in version 1.0.4.

CVE-2026-78144 is an authorization bypass vulnerability in code-projects Barangay Resident Profiling Management System version 1.0. It allows remote attackers to bypass authorization by manipulating the ID argument in the /boarders.php file of the Boarder Management Module. The vulnerability has a moderate severity with a CVSS score of 5.3. Exploit code is publicly available, but no known exploits in the wild have been reported. No patch or remediation information is currently provided by the vendor.

CVE-2026-78142 is an authorization bypass vulnerability in code-projects Barangay Resident Profiling Management System version 1.0. It affects the Restore/Delete component, specifically the /archived_records.php file, where manipulation of the resident_id argument allows unauthorized access. The vulnerability can be exploited remotely without user interaction. An exploit has been publicly disclosed. The vulnerability has a medium severity rating with a CVSS score of 5.3.

SourceCodester Class and Exam Timetabling System version 1.0 contains an authorization vulnerability in the /admin/edit_user_account.php component. An attacker with limited privileges can manipulate the id or username parameters to modify user accounts without proper authorization. The vulnerability is remotely exploitable. No patch or official remediation is currently available.

CVE-2026-66722 is an improper authorization vulnerability in Apache CloudStack affecting versions 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It allows a Domain Admin to perform create, update, delete, and list operations on project roles and permissions across any domain, not limited to their own. This occurs because the authorization check only verifies the caller's Domain Admin status without confirming domain ownership of the target project. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

A vulnerability in django CMS versions prior to 5.0.8 allows any staff user to access restricted page structure data without proper authorization checks when CMS_PERMISSION is enabled. This exposure includes plugin descriptions such as link names, URLs, and text snippets, potentially leaking sensitive content details. The issue is fixed in version 5.0.8.

CVE-2026-18283 is an improper authorization vulnerability in Sony XAV-9500ES devices related to udev USB rules. It allows a physically present attacker to bypass authorization by connecting a crafted USB device, triggering instantiation of restricted USB device types without requiring authentication. The vulnerability affects version 3.02.00 of the product. The CVSS score is low (2.4), indicating limited impact primarily on integrity without confidentiality or availability consequences.

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization.