cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 182

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 4.3CVE-2026-84662EPSS 0.3%

    Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL.

  2. 5.4CVE-2026-84661EPSS 0.4%

    A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's…

  3. 5.4CVE-2026-84660EPSS 0.4%

    A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on t…

  4. 4.3CVE-2026-84659EPSS 0.3%

    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stap…

  5. 4.3CVE-2026-84658EPSS 0.3%

    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads script approval configuration, allowing attackers able to submit certain forms to read that configuratio…

  6. 4.2CVE-2026-84657EPSS 0.4%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission…

  7. 4.3CVE-2026-84656EPSS 0.5%

    A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.

  8. 3.5CVE-2026-84653EPSS 0.3%

    Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appea…

  9. 6.3CVE-2026-84651EPSS 0.5%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submi…

  10. 8.8CVE-2026-84650EPSS 0.5%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify the values of transient fields that will be deserialized, t…

  11. 8.8CVE-2026-84649EPSS 0.2%

    In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint servin…

  12. 7.0CVE-2026-78409EPSS 0.2%

    The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution insi…

  13. 8.7CVE-2026-66842EPSS 0.5%

    BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an …

  14. 7.3CVE-2026-18058EPSS 0.1%

    The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system.

  15. 8.1CVE-2026-14199EPSS 0.3%

    Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delim…

  16. 5.4CVE-2026-8151EPSS 0.1%

    The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced…

  17. 4.3CVE-2026-82293EPSS 0.4%

    Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user could invoke mac…

  18. 8.7CVE-2026-79990EPSS 0.4%

    Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect ag…

  19. 8.7CVE-2026-79989EPSS 0.4%

    The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s accoun…

  20. 5.4CVE-2026-78609EPSS 0.1%

    Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690). An actor holding limited Kubernetes permissions confined to a single namespace could ca…

  21. 7.8CVE-2026-78604EPSS 0.1%

    Incorrect Permission Assignment for Critical Resource (CWE-732) in Elastic Agent can lead to local privilege escalation via Replace Binaries (CAPEC-642). On Windows systems where Elastic Agent is installed in unprivileged mode, resources u…

  22. 5.3CVE-2026-78602EPSS 0.6%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over th…

  23. 5.5CVE-2026-78601EPSS 0.3%

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with el…

  24. 6.5CVE-2026-78599EPSS 0.5%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding F…

  25. 5.4CVE-2026-78598EPSS 0.2%

    Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding machine learning jo…

  26. 6.3CVE-2026-78591EPSS 0.4%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subs…

  27. 7.3CVE-2026-78590EPSS 0.4%

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding…

  28. 3.1CVE-2026-78587EPSS 0.3%

    Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations…

  29. 5.3CVE-2026-78153EPSS 0.4%

    The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted …

  30. 6.5CVE-2026-2688EPSS 0.4%

    The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unau…

  31. 5.3CVE-2026-17563EPSS 0.3%

    The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the…

  32. 3.8CVE-2026-14326EPSS 0.3%

    The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other …

  33. 5.3CVE-2025-8945EPSS 0.3%

    The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API.

  34. 5.3CVE-2025-15490EPSS 0.4%

    The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs

  35. 5.3CVE-2025-15489EPSS 0.3%

    The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the value of password protected content

  36. 8.2CVE-2025-15485EPSS 0.3%

    The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc

  37. 5.3CVE-2026-81269EPSS 0.3%

    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

  38. 5.3CVE-2026-81166EPSS 0.3%

    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

  39. 5.3CVE-2026-81165EPSS 0.3%

    Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18.

  40. 5.4CVE-2026-81164EPSS 0.2%

    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

  41. 5.3CVE-2026-81162EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal vers…

  42. 5.3CVE-2026-81158EPSS 0.3%

    Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0.

  43. 5.3CVE-2026-73478EPSS 0.3%

    Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.

  44. 5.3CVE-2026-73477EPSS 0.3%

    Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.

  45. 9.1CVE-2026-73475EPSS 0.4%

    Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

  46. 5.3CVE-2026-73474EPSS 0.3%

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.

  47. 5.3CVE-2026-84835EPSS 0.3%

    Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5.

  48. 5.3CVE-2026-84808EPSS 0.3%

    Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view_other_timesheet permission can list timesheets us…

  49. 5.3CVE-2026-84806EPSS 0.2%

    Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attac…

  50. 5.3CVE-2026-84805EPSS 0.3%

    Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behi…