An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, a user with create Workflow permission can bypass templateReferencing: Strict to get host network access, switch service accounts, override pod security context, add tolerations to schedule on control-plane nodes, or enable SA token mounting. This defeats the stated purpose of the feature. The practical impact depends on what Kubernetes-level controls are in place. Clusters with PodSecurity admission or OPA/Gatekeeper would independently block some of these (like hostNetwork). Clusters that rely on Argo's Strict mode as the primary enforcement layer are fully exposed. This issue has been patched in versions 3.7.14 and 4.0.5.
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without making any payment. This issue has been patched in version 0.12.10.
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PENDING" organization / user accounts. This issue has been patched in version 7.3.2.
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup.
Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
CVE-2026-41903 is an authorization vulnerability in FreeScout versions prior to 1.8.217. Users with the PERM_EDIT_USERS permission, intended only for general user-profile editing, can exploit this flaw to read and modify notification subscriptions of any other user, including administrators, by sending a crafted POST request. This allows a non-admin attacker to silently disable admin notifications such as email, browser, and mobile alerts, potentially suppressing important security and operational messages. The issue is a variant of a previously addressed notification authorization bypass but affects a different code path. A patch fixing this vulnerability is available in FreeScout version 1.8.217. The CVSS score is 5.
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.
Admidio versions prior to 5.0.9 contain an authorization logic error in the two-factor authentication (2FA) reset functionality. This flaw allows non-admin users with certain profile edit rights to remove the TOTP-based 2FA configuration of other users, including administrators, while they cannot remove their own 2FA. The issue has been fixed in version 5.0.9.
CVE-2026-41657 is an authorization vulnerability in Admidio prior to version 5.0.9. The contacts_data.php endpoint uses a weaker permission check than the frontend UI, allowing user managers without full administrator rights to access all user records across organizations, bypassing intended multi-tenant isolation. This issue has been fixed in version 5.0.9.
CVE-2026-40213 is an authorization vulnerability in OpenStack Cyborg versions before 16.0.1. The default policy for multiple API endpoints uses rule:allow with check_str='@', which authorizes any request with a valid Keystone token regardless of roles, project membership, or scope. This allows an authenticated user without any role assignments to perform privileged actions such as reprogramming FPGA bitstreams on arbitrary compute nodes via agent RPC.
OpenClaw versions before 2026.4.15 have an authorization bypass vulnerability in the Matrix room control-command authorization mechanism. The flaw arises because the system trusts direct message (DM) pairing-store entries, allowing attackers with DM-paired sender IDs to execute privileged room control commands without being on configured allowlists. This can lead to unauthorized privileged actions within OpenClaw bot rooms.
Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org.
However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org.
Quarkus is a Java framework for building cloud-native applications. In versions prior to 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2, a path normalization inconsistency between the security layer and the routing layer allows unauthenticated or lower-privileged users to bypass HTTP path-based authorization policies. Quarkus's security layer performs authorization checks on the raw URL path which preserves matrix parameters (semicolons), while RESTEasy Reactive's routing layer strips matrix parameters before matching endpoints. An attacker can append a semicolon and arbitrary text to a request URL (e.g., /api/admin;anything) to bypass policies protecting /api/admin while still routing to the protected endpoint. This issue has been fixed in versions 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1, 3.34.7, and 3.35.2.
CVE-2026-39402 is an authorization logic flaw in the lxc container runtime's setuid helper lxc-user-nic. The vulnerability allows an unprivileged user to delete OpenVSwitch-attached network interfaces owned by other users in multi-tenant environments. This occurs because the interface name comparison in the delete path can incorrectly authorize deletion based on name match alone, bypassing ownership checks. The flaw enables denial of service by disconnecting networking from containers of other tenants sharing the same infrastructure. The issue is fixed in lxc version 7.0.0.
CVE-2026-33489 is an authorization vulnerability in CoreDNS versions prior to 1.14.3 affecting the transfer plugin. The plugin incorrectly selects ACL rules due to a lexicographic string comparison instead of a longest-suffix match, allowing unauthorized remote clients to perform zone transfers on subzones. This issue is fixed in CoreDNS version 1.14.3.
CVE-2026-43530 is a high-severity vulnerability in OpenClaw version 2026.2.23 that involves incorrect authorization. It affects the exec approval binding in busybox and toybox applet execution, allowing attackers to obscure which applet actually runs. This enables bypassing of exec approval mechanisms and weakens the risk classification of unsafe applet invocations.
OpenClaw version 2026.4.9 contains an authorization bypass vulnerability in the outbound host-media attachment read helper. This flaw allows attackers with limited read permissions to bypass sender and group policy restrictions and access local files that should be denied. The vulnerability is fixed in version 2026.4.10.
OpenClaw versions 2026.4.5 before 2026.4.10 have an incorrect authorization vulnerability (CWE-863) that allows sandboxed agents to escape their sandbox by specifying host=node. This enables attackers to bypass sandbox boundaries and reroute execution to remote nodes instead of the intended sandbox paths.
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header (or node_secret query parameter), causing the request to be treated as authenticated via the trusted-node path and associated with the init user. This issue has been patched in version 2.3.8.