cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 80

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 7.1CVE-2026-109672EPSS 0.3%

    Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial da…

  2. 5.3CVE-2026-109669EPSS 0.2%

    Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can c…

  3. 5.3CVE-2026-109668EPSS 0.2%

    Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with l…

  4. 7.1CVE-2026-109666EPSS 0.2%

    Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these e…

  5. 5.3CVE-2026-109665EPSS 0.2%

    Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deacti…

  6. 5.3CVE-2026-109664EPSS 0.2%

    Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to modify records beyond their permissions due to missing validation in certain endpoints. Attacke…

  7. 7.1CVE-2026-109661EPSS 0.3%

    Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileg…

  8. 7.1CVE-2026-109660EPSS 0.2%

    Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endp…

  9. 7.1CVE-2026-109659EPSS 0.3%

    Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data …

  10. 7.1CVE-2026-109658EPSS 0.3%

    Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, includ…

  11. 7.1CVE-2026-109656EPSS 0.3%

    Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged a…

  12. 7.1CVE-2026-109655EPSS 0.2%

    Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to…

  13. 5.3CVE-2026-109654EPSS 0.2%

    Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated …

  14. 5.3CVE-2026-109651EPSS 0.2%

    Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination witho…

  15. 7.1CVE-2026-109650EPSS 0.3%

    Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endp…

  16. 7.1CVE-2026-109645EPSS 0.2%

    Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to creat…

  17. 7.1CVE-2026-109644EPSS 0.3%

    Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query the…

  18. 7.1CVE-2026-109643EPSS 0.3%

    Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints …

  19. 5.3CVE-2026-109642EPSS 0.2%

    Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond…

  20. 6.9CVE-2026-109641EPSS 0.3%

    Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create recor…

  21. 7.2CVE-2026-109640EPSS 0.2%

    Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operati…

  22. 7.1CVE-2026-109637EPSS 0.2%

    Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization c…

  23. 7.1CVE-2026-109636EPSS 0.3%

    Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these e…

  24. 5.3CVE-2026-109635EPSS 0.2%

    Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated por…

  25. 7.1CVE-2026-109632EPSS 0.3%

    Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read dat…

  26. 5.3CVE-2026-109630EPSS 0.2%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond…

  27. 5.3CVE-2026-109629EPSS 0.2%

    Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization.…

  28. 7.1CVE-2026-109628EPSS 0.2%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can inv…

  29. 7.1CVE-2026-109627EPSS 0.3%

    Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints direc…

  30. 7.1CVE-2026-109625EPSS 0.3%

    Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financ…

  31. 7.1CVE-2026-109624EPSS 0.3%

    Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to rea…

  32. 5.3CVE-2026-109623EPSS 0.2%

    Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to mo…

  33. 5.3CVE-2026-109622EPSS 0.2%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints t…

  34. 7.1CVE-2026-109621EPSS 0.3%

    Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the…

  35. 7.1CVE-2026-109617EPSS 0.2%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can se…

  36. 7.1CVE-2026-109616EPSS 0.2%

    Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modif…

  37. 7.1CVE-2026-109615EPSS 0.2%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call …

  38. 7.1CVE-2026-109614EPSS 0.3%

    Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access se…

  39. 7.1CVE-2026-109613EPSS 0.3%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged user…

  40. 5.3CVE-2026-109611EPSS 0.2%

    Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond…

  41. 7.1CVE-2026-109610EPSS 0.2%

    Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify…

  42. 4.8CVE-2026-109603EPSS 0.2%

    Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply craf…

  43. 6.9CVE-2026-109600EPSS 0.2%

    Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email upd…

  44. 5.3CVE-2026-109599EPSS 0.2%

    Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify record…

  45. 5.3CVE-2026-109598EPSS 0.2%

    Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the re…

  46. 6.7CVE-2026-109596EPSS 0.1%

    Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside their root via nested-mount ancestor directories. Attackers controlling a theme can place a sy…

  47. 6.7CVE-2026-109595EPSS 0.1%

    Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can sh…

  48. 6.7CVE-2026-109574EPSS 0.1%

    Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relati…

  49. 7.2CVE-2026-109572EPSS 0.3%

    Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests thro…

  50. 5.5CVE-2026-108938EPSS 0.3%

    A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exp…