cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 161

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 6.5CVE-2026-87891EPSS 0.3%

    The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unav…

  2. 7.5CVE-2026-87842EPSS 0.5%

    The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner'…

  3. 4.3CVE-2026-87797EPSS 0.3%

    The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to…

  4. 2.2CVE-2026-84025EPSS 0.2%

    The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product inf…

  5. 4.3CVE-2026-84024EPSS 0.1%

    The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce before saving its meta field configuration, allowing an attacker to overwrite that configuration by tricking a logged-in administrator into visiting a crafted page.

  6. 6.5CVE-2026-84023EPSS 0.2%

    The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted …

  7. 2.7CVE-2026-82851EPSS 0.3%

    The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrar…

  8. 7.2CVE-2026-81090EPSS 0.4%

    The Gpx2Graphics WordPress plugin through 0.3 does not perform a CSRF check when handling file uploads, nor validate the type of the uploaded file, allowing attackers to make a logged-in administrator upload arbitrary files such as PHP via…

  9. 8.6CVE-2026-80494EPSS 0.4%

    The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download …

  10. 5.3CVE-2026-78152EPSS 0.3%

    The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of an…

  11. 5.5CVE-2026-77753EPSS 0.3%

    The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of…

  12. 7.2CVE-2026-77705EPSS 0.5%

    The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitled to modify the WordPress account linked to it, allowing users holding Amelia's …

  13. 5.3CVE-2026-77689EPSS 0.3%

    The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking r…

  14. 10.0CVE-2026-85706KEVExploitEPSS 97%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user cou…

  15. 5.3CVE-2026-89267EPSS 0.3%

    starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter querie…

  16. 7.6CVE-2026-90460EPSS 0.6%

    An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or del…

  17. 5.3CVE-2026-90454EPSS 0.2%

    A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, an…

  18. 5.1CVE-2026-90453EPSS 0.2%

    A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without validating it against the application's own origin. This allows an authenticated attacker to craft …

  19. 5.3CVE-2026-90450EPSS 0.2%

    The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role requirements, rather than defaulting to deny. Any request handler that is not explicitly registered i…

  20. 7.1CVE-2026-90448EPSS 0.2%

    A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrit…

  21. 5.3CVE-2026-90446EPSS 0.2%

    An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an…

  22. 7.1CVE-2026-90445EPSS 0.3%

    An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker…

  23. 6.5CVE-2026-54258EPSS 0.3%

    ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse `Events=View` and/or `Snapshots=View` permissions to di…

  24. 6.3CVE-2026-49992EPSS 0.2%

    Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are expos…

  25. 7.5CVE-2026-49846EPSS 0.5%

    libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The …

  26. 8.7CVE-2026-44715EPSS 0.4%

    OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, whi…

  27. 6.1CVE-2026-81907EPSS 0.1%

    Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce …

  28. 5.1CVE-2026-68535EPSS 0.2%

    Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which, for file-referencing blocks such as hero_image and gallery, is where the refere…

  29. 7.1CVE-2026-54166EPSS 0.4%

    Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import featur…

  30. 6.9CVE-2026-50025EPSS 0.3%

    Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provena…

  31. 5.3CVE-2026-49865EPSS 0.4%

    Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview and generation workflow. If an attacker can control Markdown content that is later…

  32. 8.1CVE-2026-49464EPSS 0.4%

    NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to ve…

  33. 4.3CVE-2026-49439EPSS 0.3%

    OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets` privileges to write predicted datapoints. Version 1.24.1 fixes the issue.

  34. 6.7CVE-2026-89332EPSS 0.2%

    Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafte…

  35. 5.1CVE-2026-81916EPSS 0.3%

    Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identified by the dashboard route. As a result, a user permitted to add entries to one…

  36. 5.1CVE-2026-81915EPSS 0.3%

    Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and saved the Page Type identified by a user-supplied ptID without calling canEditP…

  37. 5.3CVE-2026-81913EPSS 0.3%

    Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authenticatio…

  38. 5.7CVE-2026-81912EPSS 0.2%

    Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved the selected group tree nodes without validating an action token, so …

  39. 5.3CVE-2026-68526EPSS 0.1%

    Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAcc…

  40. 9.8CVE-2026-53952EPSS 0.6%

    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to cr…

  41. 6.5CVE-2026-49463EPSS 0.3%

    NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:documenten-api` package through version 3.0.0 and the `nl.…

  42. 5.3CVE-2026-49462EPSS 0.4%

    NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. In versions up to and including 3.0.0, deployments using the shipped default…

  43. 5.3CVE-2026-62140EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.

  44. 4.3CVE-2026-62139EPSS 0.1%

    Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

  45. 5.3CVE-2026-62137EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.

  46. 5.3CVE-2026-62136EPSS 0.3%

    Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.

  47. 5.3CVE-2026-62135EPSS 0.3%

    Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.

  48. 4.3CVE-2026-62134EPSS 0.3%

    Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.

  49. 5.4CVE-2026-62133EPSS 0.1%

    Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.

  50. 5.3CVE-2026-62132EPSS 0.3%

    Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.