CWE-863
CVEs classified under CWE-863, newest first.
1504 CVEsRSS
CVE-2026-116679Medium· 5.4Neko: Authorization bypass in legacy WebRTC input handling
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input be…
CVE-2026-108302Medium· 4.3Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-105780Critical· 9.9Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute …
CVE-2026-106077High· 8.3A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
CVE-2026-104189High· 7.53Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share
The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who…
CVE-2026-117472Medium· 4.3URL prefix handling permits API key read-scope bypass in Psono Server
Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the POST request was …
CVE-2026-116623High· 7.3code-projects Simple Content Management System Admin welcome.php authorization
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in …
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-108360Medium· 6.4PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
CVE-2026-116575Medium· 6.3Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join c…
CVE-2026-110720Critical· 9.9Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed i…
CVE-2026-102649Critical· 9.9Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned GitHub and GitLab events when a `TerraformRepository`'s credentials omit `webhookSecret` or set i…
CVE-2026-93846Low· 3.8Team admin can escalate a team member's permissions via the team member roles endpoint
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission sc…
CVE-2026-93847Low· 3.5Improper post type validation on scheduled post endpoints
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events vi…
CVE-2026-116107Medium· 5.4Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulatio…
CVE-2026-111980Medium· 5.5GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including admi…
CVE-2026-116136Medium· 5.9ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking
ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an inter…
CVE-2026-116140Low· 3.3ImageMagick: ImageMagick: Security policy bypass via flawed delegate invocation parsing (CVE-2026-116140)
A flaw was found in ImageMagick. An attacker could bypass administrator-defined security policies by convincing the application to process specially crafted input that triggers a delegate invocation. This issue occurs due to incorrect pars…
CVE-2026-115635Medium· 6.0AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single create runs as an upsert with return_skipped_upsert?: true and …
CVE-2026-114214Medium· 6.0Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records
Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a has_many relationship declared with through: was loaded for a sin…
CVE-2026-115627Medium· 6.0AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows
Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows. When a many_to_many relationship, or a through relationship, …
CVE-2026-115972Medium· 5.3FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization
A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/H…
CVE-2026-116020Medium· 5.4BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages
BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate s…
CVE-2026-75525Medium· 5.3OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's i…
CVE-2026-115883Medium· 6.0LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, …
GHSA-cxf3-9h37-7rr8CriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
GHSA-mhf7-xp6r-6qrcMedium· 6.5Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
CVE-2026-112342High· 7.1Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed on…
GHSA-xp3q-r38w-vgqmMedium· 5.8SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
CVE-2026-73049Medium· 5.8SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier docu…
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers