CVE-2026-116794 is a missing authorization vulnerability in the russh Rust SSH client and server library versions prior to 0.65.0. The issue occurs because the agent server's Connection::try_sign path returns a hard-coded successful result for SSH_AGENT_CONSTRAIN_CONFIRM without invoking the Agent::confirm method. This allows processes with access to the agent socket, including remote forwarded agents, to use keys added with confirmation (-c) without the intended user approval or policy checks. The vulnerability is fixed in version 0.65.0.
CVE-2026-112375 is a vulnerability in Apache Kafka where an authenticated user without authorization grants can read files or environment variables from the broker host. This occurs because configuration validation happens before authorization checks, allowing resolution of configuration variables that expose sensitive data. The issue affects Kafka versions from 3.2.0 up to 4.1.2, 4.2.0 up to 4.2.1, and 4.3.0 up to 4.3.1. The vulnerability is mitigated by upgrading to versions 4.2.2, 4.3.2, or 4.4.0, which enforce authorization before configuration validation and restrict config-provider usage. Running brokers with least-privileged OS accounts is recommended as additional defense.
FOGProject versions prior to 1.5.10.2253 contain an OS command injection vulnerability in the API endpoint for editing storage nodes. An authenticated user with specific API tokens can modify storage node fields that are later used unsafely in a root-level command, allowing command execution as root. This vulnerability is fixed in version 1.5.10.2253.
CVE-2026-56828 is an improper authorization vulnerability in shopperlabs shopper versions 2.8.0 up to but not including 2.8.1. It allows a staff member with limited permissions (view_users and access_dashboard) to escalate privileges by mutating permissions, creating administrators, or deleting roles. The flaw stems from incorrect permission checks in several Livewire admin components, enabling unauthorized actions such as granting arbitrary permissions, creating pre-verified administrators, and deleting roles, which can cause denial of service. This vulnerability is fixed in version 2.8.1.
CVE-2026-59979 is an authorization bypass vulnerability in YosemiteCrew's Yosemite-Crew platform. Several API routes related to service and PMS task-library/template management lack proper organization and permission checks, allowing any registered user to read, modify, or delete data belonging to other organizations. Some service records can be read without any authentication. This flaw affects the integrity and availability of service catalogues and task templates, impacting bookings and billing processes. No fixed release or patch is currently established.
Xibo CMS versions prior to 4.4.3 have a missing authorization vulnerability in the GET /layout/status/{id} endpoint. This flaw allows any authenticated user, regardless of their privileges, to access the status and metadata of any layout, including those they should not have permission to view. The issue is resolved in version 4.4.3.
Xibo CMS versions prior to 4.4.3 contain a missing authorization vulnerability in the POST /displaygroup/criteria/{displayGroupId} endpoint. This flaw allows an authenticated user with limited privileges to update schedule criteria for any display via XMR, potentially causing unintended playback changes such as triggering content scheduled for specific weather conditions incorrectly. The vulnerability requires the use of Schedule Criteria on the CMS and is fixed in version 4.4.3.
Xibo CMS versions prior to 4.4.3 have a missing object-level authorization vulnerability in the /notification/export/{id} endpoint. This flaw allows authenticated users with access to the Notification Centre, a privilege granted to non-administrators, to download attachments from any notification by iterating over notification IDs, including those created by administrators. The issue is fixed in version 4.4.3.
Xibo CMS versions prior to 4.4.3 have a missing authorization vulnerability in the dataset export functionality. Authenticated users with edit privileges on datasets can export data from any dataset by iterating over dataset IDs, including those created by administrators. This flaw allows unauthorized data export but requires specific privileges not granted to standard non-administrators. The issue is resolved in version 4.4.3.
Xibo CMS versions prior to 4.4.3 have a missing authorization vulnerability in the handling of PUT and DELETE requests on layout actions. Authenticated users with edit privileges, which are commonly granted to non-administrators, can modify or delete actions on any layout without proper access control. This issue is fixed in version 4.4.3.
A vulnerability in identrail prior to version 1.0.2 allows an authenticated tenant to bypass authorization checks on the GitHub installation ID parameter. This flaw permits reading private repository data and metadata of other organizations if identrail's GitHub App is installed there. The issue arises because the installation ID is accepted without verifying ownership by the caller's workspace. The vulnerability is fixed in version 1.0.2.
NORA, a self-hosted artifact registry and pull-through cache, prior to version 0.9.5, contains an authorization flaw where token-management UI endpoints do not require administrator privileges for state-changing actions. This allows users with write permissions to revoke arbitrary admin and service tokens and read bearer tokens to enumerate token metadata across all users. The issue is resolved in version 0.9.5.
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including specific LTS releases, contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged remote attacker to perform unauthorized operations. The vulnerability has a high severity with a CVSS score of 7.1. Fixed versions are available starting from 8.9.0.0 and respective LTS patch versions.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a critical severity with a CVSS score of 9.6. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.
CVE-2026-86390 is a Missing Authorization vulnerability in Dell PowerProtect Data Domain affecting multiple versions including Feature Release 7.7.1.0 through 8.8 and various LTS releases. A low privileged attacker with remote access could exploit this flaw to gain unauthorized access. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions are available starting from 8.9.0.0 and certain later LTS patch releases.
CVE-2026-86397 is a critical Improper Authentication vulnerability in Dell PowerProtect Data Domain affecting multiple feature and LTS release versions. An unauthenticated remote attacker could exploit this flaw to create privileged accounts, potentially gaining complete control over the system. Dell has released fixed versions to address this issue and recommends upgrading as soon as possible.
The Enable Media Replace WordPress plugin (versions up to 4.2.2) contains an authorization bypass vulnerability. Authenticated users with author-level access or higher can modify the post_content of any published post referencing replaced media, including posts owned by administrators. This occurs because the plugin's doReplaceQuery() method performs a database-wide search-and-replace without verifying per-post editing permissions, allowing unauthorized mass content modification visible to all visitors.
The Advanced Custom Fields: Extended plugin for WordPress versions up to 0.9.2.7 contains a missing authorization vulnerability. Multiple AJAX handlers intended for unauthenticated users do not properly check user permissions, allowing attackers to use publicly exposed nonces to bypass visibility restrictions. This can lead to unauthorized disclosure of post titles and internal content layout structures. A partial patch was introduced in version 0.9.2.4.
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 2.3.6. This flaw allows authenticated users with contributor-level access or higher to duplicate arbitrary posts, including private, draft, and pending posts authored by administrators and editors. The vulnerability arises because the plugin does not properly verify user authorization and uses a static nonce action that is not bound to specific posts, enabling nonce reuse against any post ID.