CWE-284: Improper Access Control vulnerabilities

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its API routes. However, in agent/auth.py, the signature verification function returns successfully if Config.AGENT_SECRET is empty. This causes protected Agent APIs to become accessible without authentication. This issue has been patched in version 1.30.4.

Tugtainer versions prior to 1.30.3 have an improper access control vulnerability where the OIDC authentication flow can be initiated even when OIDC is disabled via configuration. Although the /auth/oidc/enabled endpoint correctly reports OIDC as disabled, a direct request to /auth/oidc/login bypasses this setting, starting the OIDC login flow and redirecting users to the OIDC authorization endpoint. This issue has been fixed in version 1.30.3.

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.

A vulnerability in the User Frontend WordPress plugin before version 4.3.12 allows unauthenticated users to create accounts even when site registration is disabled. The created accounts receive the site's default user role. This improper access control issue is identified as CWE-284.

CVE-2026-92226 is a high-severity vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It involves improper access control checks in various webservice edit tasks, allowing unauthorized users with certain privileges to perform edit actions on items that should not be editable.

CVE-2026-92223 is a medium severity vulnerability in Joomla! CMS versions 5.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It involves improper access control that allows unauthorized users with certain privileges to update the workflow stage of content they should not have access to.

CVE-2026-90917 is an improper access control vulnerability in Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It allows unauthorized users to view content items from categories they should not have access to due to improper ACL checks in outputs for tagged items.

CVE-2026-90913 is a high severity vulnerability in Joomla! CMS versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It involves improper access control checks on webservice endpoints related to access levels, allowing unauthorized users with certain privileges to perform mutation actions. This flaw affects the core Joomla! CMS and could lead to unauthorized modifications via these endpoints.

CVE-2026-90916 is an improper access control vulnerability in Joomla! CMS affecting versions 4.0.0 through 5.4.8 and 6.0.0 through 6.1.3. It allows unauthorized users with high privileges to view content that should be inaccessible via the content history comparison view. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

CVE-2026-92370 is an improper access control vulnerability in TeamViewer Full Client and related modules on Windows, Linux, and macOS. It allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. This enables the attacker to perform actions explicitly denied by the victim's configuration, potentially leading to unauthorized actions and remote code execution. The vulnerability affects versions from 15.0 up to but not including 15.82. Multiple fixed versions are available across platforms.

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-97163 is a critical vulnerability in the lomart.fr UP plugin for Joomla affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. It involves improper limitation of a pathname to a restricted directory (CWE-22), allowing unauthenticated remote code installation. The vulnerability has a CVSS 4.0 base score of 10.0, indicating it is exploitable over the network without authentication and can lead to severe impact. No patch or remediation information is currently available from the vendor.

A critical path traversal vulnerability (CWE-22) exists in the lomart.fr UP plugin for Joomla, affecting versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. This vulnerability allows unauthorized access to restricted directories and files by improperly limiting pathname inputs. It has a high CVSS 4.0 score of 9.2, indicating it is network exploitable without requiring privileges or user interaction, with a high impact on confidentiality and security controls. No official patch or remediation guidance is currently available.

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server's `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.

CVE-2026-77321 is a vulnerability in mauriceboe TREK, a collaborative travel planner, affecting versions prior to 3.3.0. The get_trip_summary tool improperly returns trip summary data without verifying the required trips:read scope, allowing tokens with unrelated scopes (e.g., weather:read) to access sensitive trip metadata, member email addresses, itinerary days, and accommodations. Although cross-user authorization is enforced, the missing scope check exposes trip content and third-party contact information beyond the intended least-privilege boundary. This issue is fixed in version 3.3.0.

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1.