CWE-862: Missing Authorization vulnerabilities

Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.

Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

CVE-2026-118539 is a missing authorization vulnerability in Drupal Commerce Core that allows forceful browsing. It affects Commerce Core versions from 0.0.0 up to but not including 2.41, and from 3.0.0 up to but not including 3.3.13. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions are 2.41 and 3.3.13.

Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

CVE-2026-61707 is a critical code injection vulnerability in SOCFortress CoPilot prior to version 0.1.76. It arises from the ability of low-privilege users to upload Jinja2 templates that are later executed without sandboxing by privileged users, enabling remote code execution. The vulnerability allows attackers to execute arbitrary Python code on the backend with root privileges, exposing sensitive tenant data and credentials. The issue is fixed in version 0.1.76.

Kubeflow Pipelines versions prior to 2.17.0 contain an authorization bypass vulnerability in the frontend artifact routes. Authenticated users could access artifact contents belonging to other tenants by manipulating the namespace parameter or omitting it, bypassing tenant isolation. This affects multi-user deployments relying on Kubeflow Pipelines authorization for namespace isolation. The vulnerability does not allow disclosure of Kubernetes Secrets, modification of storage, or server-side code execution. The issue is fixed in version 2.17.0.

A vulnerability in Kubeflow Pipelines prior to version 2.18.0 allows unauthorized actors to access sensitive logs via the API server's log retrieval endpoint. The API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler did not authorize callers against the specified run, enabling attackers who know a run ID and node or pod identifier to read live or archived logs. This could expose sensitive workload data or credentials. The issue is fixed in version 2.18.0.

CVE-2025-12523 is a vulnerability in Centreon affecting the Users Configuration Endpoint where broken object level authorization allows an authenticated user to disclose information. The flaw impacts Centreon versions 24.04, 24.10, and versions from 25.10.0 up to but not including 25.11.0. The vulnerability has a CVSS score of 6.5, indicating medium severity, with high confidentiality impact but no impact on integrity or availability. Fixed versions are available in centreon-web releases 24.04.25, 24.10.21, and 25.10.6.

CVE-2026-90863 is a critical vulnerability in Progress Software WS_FTP Server on Windows platforms prior to versions 2024.0.7 and 2025.0.4. It involves missing authorization controls in the administrative interface, allowing a delegated Host Administrator to exceed their authorized permissions. This flaw could lead to arbitrary command execution with elevated privileges, resulting in full compromise of the server.

CVE-2026-42690 is a medium severity vulnerability in ThimPress LearnPress versions up to 4.4.10. It involves broken access control where subscribers may gain unauthorized access to certain functionality or data due to missing authorization checks.

CVE-2026-107327 is a critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.4. It involves missing authorization controls that could allow a remote authenticated attacker to execute arbitrary code. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a missing authorization vulnerability (CWE-862) that allows a remote attacker with a low-privileged authenticated account to bypass administrator-only restrictions and execute arbitrary code on the server by manipulating a built-in code-execution component.

The Hide Price Until Login WordPress plugin versions before 1.1.2 contain a missing authorization vulnerability. This flaw allows any user to create a WordPress account and obtain a logged-in session even if the site has disabled user registration. The issue arises because the plugin does not restrict a guest-registration handler and ignores the site's user-registration setting.

A missing authorization vulnerability in the WP Post Author WordPress plugin before version 4.2.0 allows unauthenticated users to overwrite certain profile fields of the first user account, typically the administrator, during front-end registration. This can affect the display name, nickname, and website fields.

The Link Library WordPress plugin versions before 7.10.0 contain an authorization bypass vulnerability. This flaw allows unauthenticated users to submit links to libraries that require login by reusing a form token from a different library that does not require login. The issue is fixed in version 7.10.0.

Contact Form by Supsystic WordPress plugin versions before 1.11.1 contain a missing authorization vulnerability in an AJAX action that deletes stored form statistics. This flaw allows unauthenticated attackers to delete arbitrary statistics entries. The issue is fixed in version 1.11.1.

In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.

CVE-2026-75520 is a path traversal vulnerability in Domoticz prior to version 2026.3. It allows a low-privilege authenticated user to execute existing operator-installed Lua parser scripts via the udevices JSON command handler without proper session rights checks. The vulnerability arises because the script parameter lacks path traversal protections, enabling access to Lua scripts through the GET /json.htm endpoint. Execution is limited to already-installed Lua files, and arbitrary code execution is not possible. The issue is fixed in Domoticz version 2026.3.

AVideo-Encoder versions prior to 8.1.0 have missing authentication on critical endpoints, allowing unauthenticated attackers to control encoding processes, access streamer URLs, retrieve server memory statistics, and enumerate media files in readable directories. This vulnerability is fixed in version 8.1.0.