CWE-862
CVEs classified under CWE-862, newest first.
3405 CVEsRSS
CVE-2026-119556Medium· 4.3Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade it…
CVE-2026-119653Medium· 4.3Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-man…
CVE-2026-119665Medium· 6.3WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another projec…
CVE-2026-61708High· 8.5SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers…
CVE-2026-116407Medium· 5.4WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.
CVE-2026-61739High· 7.5PoCSOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role …
CVE-2026-119710High· 7.1PoCPipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connect…
CVE-2026-119702Medium· 6.5WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to d…
CVE-2026-116860Medium· 5.3WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.
CVE-2026-119682High· 7.9Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus
An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify…
CVE-2026-119648Medium· 4.3PoCBlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search co…
CVE-2026-112347High· 7.6Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in Pag…
CVE-2026-118072Medium· 5.4Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users…
CVE-2026-118101Medium· 5.3BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the titl…
CVE-2026-119576Medium· 4.3PoCArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definitio…
CVE-2026-119551Medium· 6.5Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. …
CVE-2026-119550Low· 3.5Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled…
CVE-2026-107266NoneViews Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205
Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.
CVE-2026-114533NoneÁgora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231
Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.
CVE-2026-114535NoneSwiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233
Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.
CVE-2026-114547NoneTinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246
Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.
CVE-2026-118573NoneOAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290
Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.
CVE-2026-118759High· 7.5Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs
CVE-2026-54852Medium· 5.3WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from …
CVE-2026-116387Medium· 5.3WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.
CVE-2026-27063Medium· 5.3WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.
CVE-2026-118091Medium· 5.3WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
CVE-2026-115601Medium· 5.3WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a th…
CVE-2026-109891Medium· 6.4WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.
CVE-2026-110196High· 8.8Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-executio…