CWE-284: Improper Access Control vulnerabilities

HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries.

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled.

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin before 1.1.5's stored gallery options.

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.

CVE-2026-83944 is a critical vulnerability in Microsoft Azure Logic Apps involving improper access control. This flaw allows an unauthorized attacker to elevate privileges over a network, potentially gaining high confidentiality and integrity impact. The vulnerability affects the cloud service Azure Logic Apps and has a CVSS 3.1 base score of 10. Microsoft has issued an official fix for this vulnerability.

CVE-2026-61700 is an improper access control vulnerability in MariaDB Connector/J affecting versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The flaw allows a rogue or man-in-the-middle server to cause the connector to transmit a local file despite the allowLocalInfile option being disabled, but only the exact file requested by the application can be sent. Exploitation requires an application that loads sensitive data over an untrusted connection. This issue has a CVSS score of 3.7 (medium severity) and is fixed in the specified versions.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications, potentially resulting in local privilege escalation.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.

A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system.

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.

The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.

An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host.

CVE-2026-89328 is an improper access control vulnerability in the FluentBoards WordPress plugin before version 2.0.15. The plugin fails to verify that a user has board-manager privileges before allowing certain board-management actions, instead only checking for board membership. This flaw permits any board member to perform manager-only operations such as adding or removing members and enabling public access to private boards. The vulnerability has a low severity rating and a CVSS score of 3.8.

CVE-2026-87959 is an improper access control vulnerability in the WPBot WordPress plugin versions 8.7.2 through 8.7.5. It allows users with subscriber-level access to overwrite the plugin's Claude AI provider settings, including the API key used for outgoing AI requests. This flaw exists because the plugin does not perform a capability check on the AJAX action that saves these settings.

CVE-2026-82126 is a low-severity vulnerability in the Schema & Structured Data for WP & AMP WordPress plugin versions 1.63 through 1.65. The plugin fails to verify whether a user has permission to edit a specific post before generating schema data, allowing users with contributor role or higher to access content of other users' draft, pending, private, and password-protected posts.

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters.