cve.bz

OWASP A01:2025 Broken Access Control vulnerabilities, newest first, page 88

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A01:2025 at MITRE.

Its weaknesses: 40

CWE-22, CWE-23, CWE-36, CWE-59, CWE-61, CWE-65, CWE-200, CWE-201, CWE-219, CWE-276, CWE-281, CWE-282, CWE-283, CWE-284, CWE-285, CWE-352, CWE-359, CWE-377, CWE-379, CWE-402, CWE-424, CWE-425, CWE-441, CWE-497, CWE-538, CWE-540, CWE-548, CWE-552, CWE-566, CWE-601, CWE-615, CWE-639, CWE-668, CWE-732, CWE-749, CWE-862, CWE-863, CWE-918, CWE-922, CWE-1275

  1. 5.3CVE-2026-108631EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row id…

  2. 5.3CVE-2026-108630EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can o…

  3. 5.3CVE-2026-108629EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send depar…

  4. 8.6CVE-2026-108628EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attacke…

  5. 5.3CVE-2026-108627EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{pe…

  6. 5.3CVE-2026-108626EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids …

  7. 5.3CVE-2026-108625EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming an…

  8. 5.3CVE-2026-108624EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the ungua…

  9. 7.1CVE-2026-108623EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request wi…

  10. 5.3CVE-2026-108622EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /s…

  11. 5.3CVE-2026-108621EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from t…

  12. 5.3CVE-2026-108620EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separate…

  13. 5.3CVE-2026-108619EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply com…

  14. 5.3CVE-2026-108618EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the ungu…

  15. 5.3CVE-2026-108617EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can…

  16. 5.3CVE-2026-108616EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated i…

  17. 5.3CVE-2026-108615EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag…

  18. 5.3CVE-2026-108614EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/expo…

  19. 5.3CVE-2026-108613EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POS…

  20. 5.3CVE-2026-108612EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /a…

  21. 5.3CVE-2026-108611EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /aira…

  22. 5.3CVE-2026-108610EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /a…

  23. 5.3CVE-2026-108609EPSS 0.2%

    JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know…

  24. 5.3CVE-2026-108608EPSS 0.2%

    JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers…

  25. 5.3CVE-2026-108607EPSS 0.2%

    JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRe…

  26. 5.3CVE-2026-108606EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GE…

  27. 5.3CVE-2026-108605EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/oc…

  28. 7.7CVE-2026-78530EPSS 0.4%

    Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

  29. 6.8CVE-2026-66481EPSS 0.3%

    Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.

  30. 5.3CVE-2026-66480EPSS 0.2%

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a throu…

  31. 7.5CVE-2026-65459EPSS 0.3%

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

  32. 7.3CVE-2026-62118EPSS 0.2%

    Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  33. 7.5CVE-2026-62043EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

  34. 6.3CVE-2026-62035EPSS 0.2%

    Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

  35. 7.6CVE-2026-62033EPSS 0.3%

    Subscriber Settings Change in uListing <= 2.2.0 versions.

  36. 7.2CVE-2026-62030EPSS 0.2%

    Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

  37. 7.5CVE-2026-42706EPSS 0.2%

    Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

  38. 7.5CVE-2026-42705EPSS 0.2%

    Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

  39. 7.5CVE-2026-42630EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

  40. 5.9CVE-2026-42419EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

  41. 6.5CVE-2026-40808EPSS 0.3%

    Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

  42. 7.7CVE-2026-40805EPSS 0.4%

    Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

  43. 7.6CVE-2026-40802EPSS 0.3%

    Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

  44. 8.1CVE-2026-40801EPSS 0.3%

    Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

  45. 8.1CVE-2026-40777EPSS 0.4%

    Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

  46. 7.2CVE-2026-27350EPSS 0.2%

    Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

  47. 5.8CVE-2026-108604EPSS 0.2%

    Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements…

  48. 4.8CVE-2026-108603EPSS 0.1%

    slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source mat…

  49. 5.3CVE-2026-108602EPSS 0.2%

    Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attac…

  50. 4.3CVE-2026-103685EPSS 0.2%

    Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshippi…