CWE-863: Incorrect Authorization vulnerabilities

CVE-2026-113876 is an authorization vulnerability in SmileCDR HAPI FHIR where conditional create actions do not properly verify user permissions. A user with create but without read permissions can submit a conditional create request that matches an existing resource and receive that resource's contents.

CVE-2026-113874 is an incorrect authorization vulnerability in SmileCDR HAPI FHIR that allows an attacker authorized for one tenant to access another tenant's data by exploiting improper partition identity enforcement. The product does not enforce storage partition entitlement by default, enabling unauthorized read and write access across tenant partitions.

CVE-2026-108360 is an incorrect authorization vulnerability in PHPOffice PhpSpreadsheet affecting versions prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0. The issue arises when the Worksheet\Drawing::setPath method validates only the initial external-image URL whitelist, allowing an attacker to exploit HTTP redirects to cause the server to make blind GET requests to internal or cloud metadata endpoints. The downloaded content is validated and removed, so no data is leaked to the attacker, but internal network reachability can be probed. The vulnerability is fixed in the specified versions.

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. AWS remediated the issue on October 7, 2026. No customer action is required.

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.

CVE-2026-88849 is an authorization vulnerability in the MasterStudy LMS WordPress Plugin versions 3.7.13 up to but not including 3.7.55. It allows users with the Instructor role to overwrite the first name, last name, and public display name of any registered user, including administrators, via the student-enrolment feature. This flaw enables impersonation and phishing attacks. The issue is fixed in version 3.7.55.

A vulnerability in the MB Custom Post Types & Custom Taxonomies WordPress plugin before version 2.12.3 allows users with Contributor-level roles to access configuration data and some content of admin-only custom post types and taxonomies. This occurs because the plugin's export feature does not properly check user capabilities, exposing non-public post and page information to unauthorized users.

CVE-2026-114721 is an authorization bypass vulnerability in Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The issue arises because the disabled_actions configuration setting could be bypassed by using deprecated action aliases, allowing a remote authenticated attacker to access actions that should be disabled. This flaw was fixed by moving the check into the action handler and resolving aliases before comparison.

CVE-2026-84917 is an incorrect authorization vulnerability in the Drupal Jsonapi Role Access module that allows forceful browsing. It affects versions from 0.0.0 up to but not including 2.0.2. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 2.0.2.

CVE-2026-84920 is an incorrect authorization vulnerability in the Drupal Unpublished Node Permissions module that allows forceful browsing of unpublished content. Versions from 0.0.0 up to but not including 1.8.0 are affected. The vulnerability has a medium severity with a CVSS score of 5.3. A fix is available in version 1.8.0.

CVE-2026-96370 is an incorrect authorization vulnerability in the Drupal Webform module that allows Server Side Request Forgery (SSRF). It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability has a medium severity with a CVSS score of 5.4. Fixed versions 6.2.12 and 6.3.1 address this issue.

CVE-2026-96373 is an Incorrect Authorization vulnerability in the Drupal Webform module that allows forceful browsing. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and versions from 6.3.0 up to but not including 6.3.1. The vulnerability has a low severity score and was fixed in versions 6.2.12 and 6.3.1.

CVE-2026-96366 is an Incorrect Authorization vulnerability in the Drupal Webform module that allows forceful browsing. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The issue has been fixed in versions 6.2.12 and 6.3.1. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with low complexity and no privileges required for exploitation.

CVE-2026-96398 is an incorrect authorization vulnerability in the Drupal Webform module that allows forceful browsing. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The issue is fixed in versions 6.2.12 and 6.3.1. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) and requires low privileges to exploit without user interaction.

CVE-2026-96356 is an Incorrect Authorization vulnerability in the Drupal Webform module that allows forceful browsing. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The issue has been fixed in versions 6.2.12 and 6.3.1. The vulnerability has a CVSS score of 5.3, indicating medium severity, and does not require user interaction or privileges to exploit.