OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 22
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.
Its weaknesses: 40
CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275
- 5.3CVE-2026-117605EPSS 0.3%
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. A…
- 6.9CVE-2026-115624EPSS 0.2%
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status…
- 2.3CVE-2026-109848EPSS 0.2%
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the con…
- 4.2CVE-2026-107745EPSS 0.3%
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload_file function in all versions up to, and including, 3.8.…
- 2.3CVE-2026-105272EPSS 0.2%
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and com…
- 8.6CVE-2015-20129EPSS 0.2%
CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malici…
- 2.1CVE-2026-118272EPSS 0.2%
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a man…
- 7.2CVE-2026-58257EPSS 0.5%
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the…
- 8.8CVE-2026-58255EPSS 0.4%
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields …
- 8.8CVE-2026-118353EPSS 0.2%
Missing authorization in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
- 8.8CVE-2026-118327EPSS 0.2%
Incorrect authorization in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
- 7.5CVE-2026-57200EPSS 0.9%
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST In…
- 6.5CVE-2026-116691EPSS 0.2%
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credenti…
- 7.5CVE-2026-116690ExploitEPSS 1.8%
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path valida…
- 5.9CVE-2026-116689EPSS 0.3%
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaS…
- 6.5CVE-2026-116686EPSS 0.3%
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSc…
- 5.9CVE-2026-116685EPSS 0.4%
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and c…
- 6.8CVE-2026-116684EPSS 0.4%
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier acce…
- 8.7CVE-2026-112355EPSS 0.3%
The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protec…
- 8.7CVE-2026-112350EPSS 0.9%
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insu…
- 7.5CVE-2026-118180EPSS 0.2%
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all fu…
- 9.1CVE-2026-118177EPSS 0.2%
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a n…
- 8.1CVE-2026-118176EPSS 0.2%
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB serv…
- 7.5CVE-2026-118175EPSS 0.2%
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user…
- 6.1CVE-2026-118173EPSS 0.3%
MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP…
- 6.1CVE-2026-118172EPSS 0.2%
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918…
- 6.5CVE-2026-118171EPSS 0.1%
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privileged admins to generate preview URLs without knowing document identifiers or holding read permissi…
- 9.1CVE-2026-118170EPSS 0.1%
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights for the underlying document.
- 6.5CVE-2026-16491EPSS 0.3%
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an a…
- 9.8CVE-2026-118131EPSS 0.2%
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories und…
- 8.6CVE-2026-116682EPSS 0.5%
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the r…
- 6.4CVE-2026-116680EPSS 0.2%
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through…
- 5.4CVE-2026-116679EPSS 0.3%
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input beca…
- 5.8CVE-2026-116678EPSS 0.3%
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_page…
- 5.3CVE-2026-116677EPSS 0.2%
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organizat…
- 4.3CVE-2026-116660EPSS 0.2%
Tanium addressed an improper access controls vulnerability in Enforce.
- 6.3CVE-2026-108332EPSS 0.1%
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
- 7.8CVE-2026-108306EPSS 0.1%
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- 7.8CVE-2026-108305EPSS 0.1%
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- 7.8CVE-2026-108304EPSS 0.1%
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- 4.3CVE-2026-108302EPSS 0.2%
Tanium addressed an improper access controls vulnerability in Comply.
- 6.0CVE-2026-108301EPSS 0.1%
Tanium addressed an improper access controls vulnerability in Comply.
- 4.6CVE-2026-87897EPSS 0.2%
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT au…
- 4.6CVE-2026-82986EPSS 0.2%
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
- 4.3CVE-2026-82984EPSS 0.3%
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated …
- 3.3CVE-2026-82983EPSS 0.1%
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams)…
- 4.3CVE-2026-77173EPSS 0.2%
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.
- 3.5CVE-2026-77171EPSS 0.2%
A public shared collective always allowed recipients of the link to create pages.
- 3.5CVE-2026-67400EPSS 0.2%
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.
- 5.5CVE-2026-117512EPSS 0.4%
A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is pos…