CWE-862
CVEs classified under CWE-862, newest first.
3507 CVEsRSS
CVE-2026-77146NoneThe extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an a…
The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an a…
CVE-2026-77143NoneThe frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified
The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update r…
CVE-2026-77142NoneThe frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on …
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on …
CVE-2026-77141NoneThe extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a c…
CVE-2026-77140NoneThe extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can se…
CVE-2026-79067Medium· 4.3Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page
Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-79116Medium· 4.3Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page
Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-78967Medium· 6.5Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page
Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-79053Low· 3.1Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page
Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium s…
CVE-2026-79099Medium· 6.5chromium-browser: Google Chrome: System access restriction bypass via crafted HTML page (CVE-2026-79099)
A flaw was found in Google Chrome's Network component. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, leadin…
CVE-2026-78953Low· 3.1Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file
Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)
CVE-2026-79042Medium· 5.4chromium-browser: Google Chrome: Missing authorization in Payments allows system access restriction bypass (CVE-2026-79042)
A flaw was found in Google Chrome on Android. Missing authorization in the Payments functionality allows a remote attacker, leveraging social engineering, to potentially bypass system access restrictions. This can be achieved by enticing a…
CVE-2026-56092High· 7.6The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass exten…
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass exten…
CVE-2026-79652Medium· 5.9A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access token…
CVE-2026-62861NoneTypeBot is a chatbot builder tool
TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handle…
CVE-2026-79669Medium· 4.3Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, G…
CVE-2026-55528High· 8.2praisonaiagents: AgentServer declares auth_token but never enforces it on any route
praisonaiagents: AgentServer declares auth_token but never enforces it on any route
CVE-2026-55530Medium· 6.1praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
CVE-2026-55541HighPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
CVE-2026-78387NoneRansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint
RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator au…
CVE-2026-78380NoneRansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels
RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked priva…
CVE-2026-78372NoneRansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private
RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with priv…
CVE-2026-78370NoneRansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected inter…
RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected inter…
CVE-2026-71933Critical· 9.1Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted…
CVE-2026-19200High· 8.9The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues
The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite exist…
CVE-2026-78204Medium· 5.4Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that …
CVE-2026-78266Medium· 6.5Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.
Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.
CVE-2026-27364Medium· 6.5Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.
Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.
CVE-2026-78365NoneAuthorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own comp…
Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own comp…
CVE-2026-78291Medium· 5.3Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.