cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 183

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 5.3CVE-2026-84806EPSS 0.2%

    Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attac…

  2. 5.3CVE-2026-84805EPSS 0.3%

    Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behi…

  3. 5.3CVE-2026-84804EPSS 0.3%

    Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoints. Authenticated users with edit_team permission can revoke team access without the required permis…

  4. 5.3CVE-2026-84802EPSS 0.3%

    Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the as…

  5. 8.7CVE-2026-84801EPSS 0.4%

    Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can gen…

  6. 7.1CVE-2026-84800EPSS 0.4%

    Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by…

  7. 5.3CVE-2026-84799EPSS 0.3%

    Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draftCreator, and revisionCreator fields. Attackers with a scoped GraphQL token can query these relatio…

  8. 7.1CVE-2026-84798EPSS 0.4%

    Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authoriz…

  9. 5.3CVE-2026-84797EPSS 0.3%

    Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit…

  10. 8.7CVE-2026-84796EPSS 0.5%

    Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentManager::prepareArguments(). Attackers with tokens scoped to one site can read, mo…

  11. 7.1CVE-2026-84794EPSS 0.4%

    Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deleti…

  12. 5.3CVE-2026-84792EPSS 0.3%

    Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section pe…

  13. 5.5CVE-2026-84772EPSS 0.3%

    Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.

  14. 5.3CVE-2026-84771EPSS 0.3%

    Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.

  15. 8.8CVE-2026-84770EPSS 0.2%

    Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.

  16. 8.8CVE-2026-84764EPSS 0.2%

    Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.

  17. 5.3CVE-2026-84760EPSS 0.3%

    Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions.

  18. 7.1CVE-2026-84759EPSS 0.1%

    Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

  19. 5.4CVE-2026-84217EPSS 0.3%

    Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.3.

  20. 6.5CVE-2026-82223EPSS 0.3%

    Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.

  21. 7.5CVE-2026-81774EPSS 0.4%

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Product Attac…

  22. 5.4CVE-2026-66652EPSS 0.1%

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

  23. 7.5CVE-2026-18672EPSS 0.5%

    In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file co…

  24. 5.3CVE-2026-84175EPSS 0.4%

    In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows H…

  25. 4.3CVE-2026-53683EPSS 0.3%

    reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on …

  26. 4.3CVE-2026-81432EPSS 0.2%

    The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify …

  27. 6.5CVE-2026-81428EPSS 0.3%

    The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to o…

  28. 4.3CVE-2026-81427EPSS 0.3%

    The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add…

  29. 4.3CVE-2026-81426EPSS 0.2%

    The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via…

  30. 5.3CVE-2026-81199ExploitEPSS 0.5%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certif…

  31. 3.8CVE-2026-81198EPSS 0.3%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sectio…

  32. 5.3CVE-2026-81197EPSS 0.3%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the…

  33. 2.7CVE-2026-81196EPSS 0.3%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct an…

  34. 5.3CVE-2026-81195EPSS 0.3%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled cour…

  35. 4.3CVE-2026-81194EPSS 0.3%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales…

  36. 9.8CVE-2026-78657EPSS 1.0%

    The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes…

  37. 5.3CVE-2026-78151EPSS 0.3%

    The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notificat…

  38. 4.9CVE-2026-77788EPSS 0.3%

    The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and use…

  39. 2.7CVE-2026-77787EPSS 0.3%

    The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and…

  40. 2.7CVE-2026-77785EPSS 0.3%

    The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role a…

  41. 2.7CVE-2026-77784EPSS 0.3%

    The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on …

  42. 3.7CVE-2026-77783EPSS 0.3%

    The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pendi…

  43. 5.3CVE-2026-77782EPSS 0.3%

    The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-prot…

  44. 4.3CVE-2026-77764EPSS 0.3%

    The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitr…

  45. 5.3CVE-2026-74927EPSS 0.3%

    The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and a…

  46. 5.3CVE-2026-19251EPSS 0.3%

    The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read t…

  47. 4.3CVE-2026-16983EPSS 0.3%

    The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber ro…

  48. 5.3CVE-2026-16966EPSS 0.3%

    The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashe…

  49. 5.3CVE-2026-15232EPSS 0.3%

    The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to per…

  50. 8.8CVE-2026-14357EPSS 0.7%

    The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function register…