CWE-862
CVEs classified under CWE-862, newest first.
3503 CVEsRSS
CVE-2026-109844Medium· 4.3Gitea watched repositories API disclosure after access revocation
`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for exa…
CVE-2026-97859Medium· 6.5PoCGitea API disclosure of private user social graph, keys and stars
Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of…
CVE-2026-111988Medium· 4.3dyad-sh dyad OAuth Callback cross-site request forgery
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack m…
CVE-2026-110365Medium· 6.5WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14.
CVE-2026-110880Medium· 6.5WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6.
CVE-2026-112000High· 7.6Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's …
CVE-2026-111875Medium· 4.7PoCDavid-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Su…
CVE-2026-87844Medium· 5.3Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection
The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones,…
CVE-2026-110976Medium· 4.9AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor…
CVE-2026-110026Medium· 4.9Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete…
CVE-2026-111041Medium· 4.9AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, o…
CVE-2026-111889Medium· 4.3PoCphpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard
phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated users without admin rights to view restricted data. Attackers with any act…
CVE-2026-111897High· 7.1PoCphpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium p…
CVE-2026-111910Medium· 6.5PoCphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to download attachments of restricted FAQs by bypassing per-record permission checks. Low-priv…
CVE-2026-111914Medium· 6.5PoCAdmidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the inventory_module_enabled restriction. Attackers with any valid login c…
CVE-2026-111916Medium· 5.3PoCAdmidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omits the category_view role-visibility filter. Attackers can request the…
CVE-2026-110882Medium· 4.3WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: f…
CVE-2026-92431Low· 3.7Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPre…
CVE-2026-81343Medium· 5.3Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenti…
CVE-2026-109369Medium· 6.8WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an ac…
CVE-2026-108123High· 7.5PoCWP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an ac…
CVE-2026-109368Medium· 6.5WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parameter. This makes it possible for authenticated attackers, with …
CVE-2026-107744Medium· 6.5LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user…
CVE-2026-107763Medium· 4.3Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes …
CVE-2026-64862Medium· 6.5Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user request…
CVE-2026-108373Medium· 6.5ERPNext: Unauthorised access to financial data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited au…
CVE-2026-108374High· 7.7ERPNext: Unauthorised status modification due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke sta…
CVE-2026-111606High· 8.1Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft att…
CVE-2026-111625Medium· 5.010up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can use the dt-push nonce with a chosen connecti…
CVE-2026-111631Medium· 5.4Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call dt_verify_external_connection wi…