CWE-862
CVEs classified under CWE-862, newest first.
3508 CVEsRSS
GHSA-hjwc-26pj-v3pmHighAgenticMail: Cross-agent task authorization bypass in AgenticMail API
AgenticMail: Cross-agent task authorization bypass in AgenticMail API
CVE-2026-53844Medium· 6.5OpenClaw: memory-wiki shared search could miss session visibility checks
OpenClaw: memory-wiki shared search could miss session visibility checks
CVE-2026-53850MediumOpenClaw: Focus command could miss controlScope enforcement
OpenClaw: Focus command could miss controlScope enforcement
CVE-2024-37496Medium· 4.3Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.3.7.
Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.3.7.
CVE-2024-37210Medium· 6.5Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: from n/a through 3.3.5.
Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: from n/a through 3.3.5.
CVE-2024-33909Medium· 5.3Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPages Flipbook: from n/a through 1.5.1.
Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPages Flipbook: from n/a through 1.5.1.
CVE-2024-33685Medium· 4.3Missing Authorization vulnerability in Jegstudio Startupzy startupzy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Startupzy: from n/a through 1.1.1.
Missing Authorization vulnerability in Jegstudio Startupzy startupzy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Startupzy: from n/a through 1.1.1.
CVE-2024-32949High· 8.3Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Integrate Google Drive: from n/a through 1.3.8.
Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Integrate Google Drive: from n/a through 1.3.8.
CVE-2024-31435Medium· 4.3: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Media & Share Icons: from n/a through 2.8.6.
: Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Media & Share Icons: from n/a through 2.8.6.
CVE-2025-69189High· 7.3Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3.
Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3.
CVE-2025-69137Medium· 6.5Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
CVE-2025-69103High· 7.5Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.
Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.
CVE-2025-48640High· 8.0In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check
In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. …
CVE-2025-48617High· 7.8PoCIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass
In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
CVE-2026-54415High· 8.1PoCMissing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over…
Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over…
CVE-2026-54010High· 8.3Open WebUI: Forged chat-file link allows cross-user file read and deletion
Open WebUI: Forged chat-file link allows cross-user file read and deletion
CVE-2026-54012High· 7.1Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
Open WebUI: Forged model meta.knowledge allows cross-user file read and deletion
CVE-2026-54016Medium· 4.3Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration
CVE-2026-54019Medium· 6.5Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode
CVE-2026-12515Medium· 4.3katello: missing repository authorization in content_uploads exposes cross-product content existence
katello: missing repository authorization in content_uploads exposes cross-product content existence
CVE-2026-55518Critical· 9.6Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
CVE-2025-14272NoneA security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to execute privileged operations, including user/role management and other adminis…
A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to execute privileged operations, including user/role management and other adminis…
CVE-2025-68045High· 7.5Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.
CVE-2026-0158Medium· 4.0In Camera, there is a possible unauthorized way to access photos due to a missing permission check
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploi…
CVE-2026-0145Medium· 4.0In keymint, there is a possible Permission Bypass due to a logic error in the code
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-54322High· 7.7Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
Daytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles
GHSA-6jm4-83g2-35gvMedium· 6.5Duplicate Advisory: memory-wiki shared search could miss session visibility checks
Duplicate Advisory: memory-wiki shared search could miss session visibility checks
GHSA-gw2c-6hcg-5g52Medium· 5.5Duplicate Advisory: Focus command could miss controlScope enforcement
Duplicate Advisory: Focus command could miss controlScope enforcement
GHSA-c8w7-9w9h-x69qMedium· 5.3Duplicate Advisory: Slack reaction events could ignore reaction notification settings
Duplicate Advisory: Slack reaction events could ignore reaction notification settings
GHSA-v383-2wgg-v483High· 8.1Duplicate Advisory: Shell inline-command parsing could miss an allowlist check
Duplicate Advisory: Shell inline-command parsing could miss an allowlist check