CWE-284: Improper Access Control vulnerabilities

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an improper access control vulnerability that allows a remote authenticated attacker to execute arbitrary code. This vulnerability is identified as CWE-284 and has a high severity rating with a CVSS score of 8.8. The flaw affects versions from 1.0.0 up to and including 1.12.2. No patch or remediation information is currently provided.

Dell System Update versions prior to 2.3.0.0 contain an improper access control vulnerability (CWE-284) that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability has a high severity with a CVSS score of 8.2. Exploitation requires local access and user interaction. No known exploits in the wild have been reported. No official patch or remediation details are provided in the available data.

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the password field of an authentication collection. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.

Plane, an open-source project management tool, has an improper access control vulnerability in versions prior to 1.4.0. The GraphQL joinProject mutation allows any workspace member to add themselves to any project within that workspace, including secret/private projects, without proper project-level permission checks. This grants unauthorized full Member role access to confidential projects. The issue is fixed in version 1.4.0.

Plane, an open-source project management tool, has an improper access control vulnerability prior to version 1.4.0. In affected versions, a user account deactivated by setting is_active=False can still log in using existing credentials. Upon successful login, the account is silently reactivated by setting is_active back to True without notifying administrators. This vulnerability is fixed in version 1.4.0.

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.

A vulnerability in the User Private Files WordPress plugin before version 2.2.0 allows unauthenticated users on multisite installations to access other users' private files. This occurs because the rewrite rule that enforces access control is bypassed, exposing private files directly. The issue is classified as improper access control (CWE-284).

CVE-2026-102795 is an improper access control vulnerability in Apache Traffic Server versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3. The issue allows unauthorized access due to insufficient access control mechanisms. The vulnerability is fixed in versions 9.2.15 and 10.1.4.

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications.

CVE-2026-63045 is an improper access control vulnerability in the mod_proxy_ftp module of Apache HTTP Server up to version 2.4.68. It allows an untrusted FTP server, when used as a forward proxy, to manipulate the PASV reply address and cause the proxy to open a data connection to an arbitrary third-party host. This issue is fixed in Apache HTTP Server version 2.4.69.

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions

CVE-2026-102132 is a high-severity vulnerability in Kiteworks Core where an administrative import function fails to verify if a delegated administrator is authorized to create privileged integration credentials. This flaw allows a delegated administrator with limited permissions to escalate privileges to full system administrator without intervention from an existing system administrator. The vulnerability affects Kiteworks Core versions prior to 9.5.1.