Common Weakness Enumeration
CWE-269
DiscouragedImproper Privilege Management
Abstraction: Class · Status: Draft
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
5960 vulnerabilities reference this CWE, most recent first.
CVE-2026-16743 (GCVE-0-2026-16743)
Vulnerability from cvelistv5 – Published: 2026-07-24 12:56 – Updated: 2026-08-27 07:31
VLAI
EPSS
VEX
Title
Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users
Summary
A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-24 13:37 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-16743 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2506381 | issue-trackingx_refsource_REDHAT |
| https://gitlab.freedesktop.org/accountsservice/ac… |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
Date Public
2026-07-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16743",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-24T13:37:16.749973Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T13:37:31.717Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gitlab.freedesktop.org/accountsservice/accountsservice/-/work_items/138"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "accountsservice",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unknown",
"packageName": "accountsservice",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "accountsservice",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "accountsservice",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Thurein Oo for reporting this issue."
}
],
"datePublic": "2026-07-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can read arbitrary files accessible to the accounts-daemon process."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T07:31:52.138Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-16743"
},
{
"name": "RHBZ#2506381",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506381"
},
{
"url": "https://gitlab.freedesktop.org/accountsservice/accountsservice/-/work_items/138"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-23T09:56:20.842Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-07-23T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users",
"workarounds": [
{
"lang": "en",
"value": "Avoid using systemd-homed-managed accounts on systems running a vulnerable accountsservice build."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-269: Improper Privilege Management"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-16743",
"datePublished": "2026-07-24T12:56:34.520Z",
"dateReserved": "2026-07-23T10:03:08.205Z",
"dateUpdated": "2026-08-27T07:31:52.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16722 (GCVE-0-2026-16722)
Vulnerability from cvelistv5 – Published: 2026-08-13 19:40 – Updated: 2026-08-15 03:55
VLAI
EPSS
VEX
Title
IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []
Summary
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 00:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7283299 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | i |
Affected:
7.6
Affected: 7.5 Affected: 7.4 Affected: 7.3 cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:* cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:* cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-15T03:55:34.118Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*"
],
"product": "i",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.6"
},
{
"status": "affected",
"version": "7.5"
},
{
"status": "affected",
"version": "7.4"
},
{
"status": "affected",
"version": "7.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.\u003c/p\u003e"
}
],
"value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T19:40:28.878Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7283299"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003cthead\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eIBM i Release\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e5770-SS1\u00a0\u003cbr/\u003ePTF Number(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003ePTF Download Link(s)\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e7.6\u003c/td\u003e\u003ctd\u003eSJ10823\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10823\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ10823\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.5\u003c/td\u003e\u003ctd\u003eSJ10822\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10822\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ10822\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.4\u003c/td\u003e\u003ctd\u003eSJ10821\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10821\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ10821\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3\u003c/td\u003e\u003ctd\u003eSJ10820\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10820\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ10820\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003eIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now.\n\nIBM i Release5770-SS1\u00a0\nPTF Number(s)PTF Download Link(s)7.6SJ10823 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10823 7.5SJ10822 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10822 7.4SJ10821 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10821 7.3SJ10820 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10820 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products."
}
],
"title": "IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL []"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-16722",
"datePublished": "2026-08-13T19:40:28.878Z",
"dateReserved": "2026-07-23T02:39:08.731Z",
"dateUpdated": "2026-08-15T03:55:34.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16703 (GCVE-0-2026-16703)
Vulnerability from cvelistv5 – Published: 2026-08-19 14:59 – Updated: 2026-08-20 18:28
VLAI
EPSS
VEX
Title
Vulnerabilities in IBM AIX and PowerVM VIOS
Summary
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 03:56 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7283858 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | AIX |
Affected:
7.2
Affected: 7.3 cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:* |
|
| IBM | PowerVM VIOS |
Affected:
4.1
cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16703",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T03:56:59.544170Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T18:28:29.841Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:aix:7.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:aix:7.3.0:*:*:*:*:*:*:*"
],
"product": "AIX",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"status": "affected",
"version": "7.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:powervm_vios:4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:powervm_vios:4.1.0:*:*:*:*:*:*:*"
],
"product": "PowerVM VIOS",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "4.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "CVE-2026-14970, CVE-2026-15061, CVE-2026-15078, CVE-2026-15065, CVE-2026-15068 were reported to IBM by Oneconsult AG (https://oneconsult.com/)."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.\u003c/p\u003e"
}
],
"value": "IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:59:40.256Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7283858"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eA.\u00a0 APARS\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIBM has assigned the following APARs to this problem:\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAIX Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAvailability\u00a0\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eSP\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eKEY\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.2.5\u003c/td\u003e\u003ctd\u003eIJ59566\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP13\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.2\u003c/td\u003e\u003ctd\u003eIJ59565\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP05\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.3\u003c/td\u003e\u003ctd\u003eIJ59564\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP03\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3.4\u003c/td\u003e\u003ctd\u003eIJ59563\u00a0\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003eSP02\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eVIOS Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAPAR\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAvailability\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eSP\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eKEY\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.0\u003c/td\u003e\u003ctd\u003eIJ59565\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.0.50\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.1\u003c/td\u003e\u003ctd\u003eIJ59564\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.1.30\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e4.1.2\u003c/td\u003e\u003ctd\u003eIJ59563\u003c/td\u003e\u003ctd\u003e08/14/2026\u003c/td\u003e\u003ctd\u003e4.1.2.20\u003c/td\u003e\u003ctd\u003ekey_w_apar\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eB.\u00a0 FIXES\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eIBM strongly recommends addressing the vulnerability now.\u003c/p\u003e\u003cp\u003e\u00a0AIX and VIOS fixes are available and can be downloaded from Fix Central: \u003ca href=\"https://www.ibm.com/support/fixcentral\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u00a0An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.\u003c/p\u003e\u003cp\u003e\u00a0IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAIX Level\u00a0\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eService Pack\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL04\u003c/td\u003e\u003ctd\u003eSP2\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL03\u003c/td\u003e\u003ctd\u003eSP3\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.3 TL02\u003c/td\u003e\u003ctd\u003eSP5\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAIX 7.2 TL05\u00a0\u003c/td\u003e\u003ctd\u003eSP13\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003ePowerVM VIOS Level\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix Pack\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.2\u00a0\u003c/td\u003e\u003ctd\u003e4.1.2.20\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.1\u00a0\u003c/td\u003e\u003ctd\u003e4.1.1.30\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eVIOS 4.1.0\u00a0\u00a0\u003c/td\u003e\u003ctd\u003e4.1.0.50\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/node/7283157\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283157\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\u003c/p\u003e\u003cp\u003e\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.0.50 post-update instructions: \u003ca href=\"https://www.ibm.com/support/pages/node/7283819\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283819\u003c/a\u003e\u003cbr/\u003e\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.1.30 post-update instructions: \u003ca href=\"https://www.ibm.com/support/pages/node/7283823\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7283823\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "A.\u00a0 APARS\n\n\n\nIBM has assigned the following APARs to this problem:\n\nAIX LevelAPARAvailability\u00a0\u00a0SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563\u00a008/14/2026SP02key_w_apar\n\n\n\n\n\nVIOS LevelAPARAvailability\u00a0SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar\n\n\n\n\n\n\n\nB.\u00a0 FIXES\n\n\n\nIBM strongly recommends addressing the vulnerability now.\n\n\n\n\u00a0AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral \n\n\n\n\u00a0An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.\n\n\n\n\u00a0IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities.\n\nAIX Level\u00a0Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05\u00a0SP13\n\n\n\n\n\nPowerVM VIOS LevelFix PackVIOS 4.1.2\u00a04.1.2.20VIOS 4.1.1\u00a04.1.1.30VIOS 4.1.0\u00a0\u00a04.1.0.50\n\n\n\n\n\n\n\nNote: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL .\n\n\n\nNote: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article:\n https://www.ibm.com/support/pages/node/7283157 \n\n\n\nNote: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0\n\n\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819 \n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823"
}
],
"title": "Vulnerabilities in IBM AIX and PowerVM VIOS"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-16703",
"datePublished": "2026-08-19T14:59:40.256Z",
"dateReserved": "2026-07-23T01:40:07.744Z",
"dateUpdated": "2026-08-20T18:28:29.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16635 (GCVE-0-2026-16635)
Vulnerability from cvelistv5 – Published: 2026-08-01 08:32 – Updated: 2026-08-03 15:38
VLAI
EPSS
VEX
Title
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
Summary
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed->user_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 13:44 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pronamic | Pronamic Pay |
Affected:
0 , ≤ 10.1.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16635",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:44:14.473068Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:38:33.517Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pronamic Pay",
"vendor": "pronamic",
"versions": [
{
"lessThanOrEqual": "10.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Afan"
},
{
"lang": "en",
"type": "finder",
"value": "moonge"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-controlled Gravity Forms field value (`$lead[$feed-\u003euser_role_field_id]`) directly into `WP_User::set_role()` without any allowlist validation, capability comparison, or permission check to constrain which roles can be assigned. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their own WordPress account to Administrator by tampering with the role field value in a form submission. Exploitation requires that an administrator has already configured a Pronamic Pay payment feed in Gravity Forms with the **Update User Role** option enabled and mapped to a form field; once that configuration is in place, no further preconditions exist to prevent an authenticated attacker from exploiting this vulnerability."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T08:32:29.692Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d42b8856-e5d0-4122-98a4-8c959832b271?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L379"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L376"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L988"
},
{
"url": "https://plugins.trac.wordpress.org/browser/pronamic-ideal/tags/10.1.0/packages/wp-pay-extensions/gravityforms/src/Extension.php#L144"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fpronamic-ideal/tags/10.1.0\u0026new_path=%2Fpronamic-ideal/tags/10.2.0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3630401/pronamic-ideal/trunk/packages/wp-pay-extensions/gravityforms/src/Extension.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-22T16:57:11.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-31T20:28:17.000Z",
"value": "Disclosed"
}
],
"title": "Pronamic Pay \u003c= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms \u0027Update user role\u0027 Field"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16635",
"datePublished": "2026-08-01T08:32:29.692Z",
"dateReserved": "2026-07-22T16:41:01.494Z",
"dateUpdated": "2026-08-03T15:38:33.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16607 (GCVE-0-2026-16607)
Vulnerability from cvelistv5 – Published: 2026-07-22 15:07 – Updated: 2026-07-22 18:51
VLAI
EPSS
VEX
Title
Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris
Summary
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-22 18:50 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://security.eu.fsastech.com/IndexDownload.as… | vendor-advisory |
| https://security.ts.fujitsu.com/ProductSecurity/c… | vendor-advisory |
| https://global.fujitsu/de-de/capabilities/mainfra… | mitigation |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fujitsu | Linux openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C96 (custom) cpe:2.3:a:fujitsu:linux_openft:*:*:linux:*:*:*:*:* |
|
| Fujitsu | Oracle Solaris openFT |
Unaffected:
12.1D00
(custom)
Affected: 0 , ≤ 12.1C95 (custom) cpe:2.3:a:fujitsu:oracle_solaris_openft:*:*:oracle_solaris:*:*:*:*:* |
Date Public
2026-07-22 18:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16607",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-22T18:50:41.101711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T18:51:08.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"Linux"
],
"product": "Linux openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C96",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"platforms": [
"Oracle Solaris"
],
"product": "Oracle\u00a0Solaris openFT",
"vendor": "Fujitsu",
"versions": [
{
"status": "unaffected",
"version": "12.1D00",
"versionType": "custom"
},
{
"lessThanOrEqual": "12.1C95",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:12.1d00:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:linux_openft:*:*:linux:*:*:*:*:*",
"versionEndIncluding": "12.1c96",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:12.1d00:*:oracle_solaris:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:fujitsu:oracle_solaris_openft:*:*:oracle_solaris:*:*:*:*:*",
"versionEndIncluding": "12.1c95",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2026-07-22T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in Fujitsu Software Linux openFT and\u0026nbsp;Fujitsu Software Oracle Solaris openFT before version\u0026nbsp;12.1D00 allows for\u0026nbsp;local privilege escalation\u0026nbsp;to root of an already authenticated user on GNU/Linux or Oracle Solaris.\u0026nbsp;\u003cspan\u003eThe Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.\u003c/span\u003e"
}
],
"value": "A vulnerability in Fujitsu Software Linux openFT and\u00a0Fujitsu Software Oracle Solaris openFT before version\u00a012.1D00 allows for\u00a0local privilege escalation\u00a0to root of an already authenticated user on GNU/Linux or Oracle Solaris.\u00a0The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany."
}
],
"impacts": [
{
"capecId": "CAPEC-8",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-8"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-22T17:50:50.760Z",
"orgId": "763b0cbd-1a52-41de-b280-f255286be201",
"shortName": "FTI"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.eu.fsastech.com/IndexDownload.asp?SoftwareGuid=20873292-0006-4a1c-a188-3940762a0075"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://security.ts.fujitsu.com/ProductSecurity/content/FsasTech-PSIRT-FTI-FG-2026-042411-Security-Notice.pdf"
},
{
"tags": [
"mitigation"
],
"url": "https://global.fujitsu/de-de/capabilities/mainframe-solutions/bs2000-integration"
}
],
"source": {
"advisory": "FTI-FG-2026-042411",
"discovery": "INTERNAL"
},
"title": "Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "763b0cbd-1a52-41de-b280-f255286be201",
"assignerShortName": "FTI",
"cveId": "CVE-2026-16607",
"datePublished": "2026-07-22T15:07:35.516Z",
"dateReserved": "2026-07-22T14:31:14.251Z",
"dateUpdated": "2026-07-22T18:51:08.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16337 (GCVE-0-2026-16337)
Vulnerability from cvelistv5 – Published: 2026-07-20 19:15 – Updated: 2026-07-21 12:45
VLAI
EPSS
VEX
Summary
Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-21 12:44 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-21T12:44:52.387677Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-21T12:45:11.144Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "dotCMS",
"vendor": "dotCMS",
"versions": [
{
"lessThanOrEqual": "26.06.22-03",
"status": "affected",
"version": "21.02",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands."
}
],
"value": "Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Successful exploitation allows a low-privileged authenticated backend user to escalate to the CMS Administrator role and subsequently achieve remote code execution by uploading a malicious OSGi bundle, resulting in complete compromise of confidentiality, integrity, and availability of the affected instance and any connected infrastructure."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T19:19:58.131Z",
"orgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8",
"shortName": "dotCMS"
},
"references": [
{
"url": "https://github.com/dotCMS/core/pull/36344"
}
],
"source": {
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8",
"assignerShortName": "dotCMS",
"cveId": "CVE-2026-16337",
"datePublished": "2026-07-20T19:15:11.190Z",
"dateReserved": "2026-07-20T18:20:45.781Z",
"dateUpdated": "2026-07-21T12:45:11.144Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16149 (GCVE-0-2026-16149)
Vulnerability from cvelistv5 – Published: 2026-08-22 23:27 – Updated: 2026-08-24 18:19
VLAI
EPSS
VEX
Title
Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite
Summary
The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest_endpoints filter via secure_user_endpoints() and overwrites every registered handler's permission_callback on both the /wp/v2/users and /wp/v2/users/(?P<id>[\d]+) routes — including POST, PUT, PATCH, and DELETE handlers — with a bare closure that returns only is_user_logged_in(), completely stripping WordPress Core's original capability checks such as create_users, promote_user, edit_users, and delete_users that WP_REST_Users_Controller normally enforces. This makes it possible for authenticated attackers with Subscriber-level access and above to create new Administrator accounts by sending POST request to /wp/v2/users with administrator role, or to reset an existing Administrator's password by issuing a PUT/POST request to /wp/v2/users/<id>. Because the block_user_enum option defaults to enabled, no special plugin configuration is required — the overwrite is active on every request as soon as the plugin is installed.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 18:19 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| marc4 | Security Hardener |
Affected:
0 , ≤ 2.4.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T18:19:02.745662Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T18:19:21.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Security Hardener",
"vendor": "marc4",
"versions": [
{
"lessThanOrEqual": "2.4.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin\u0027s user-enumeration protection, which is enabled by default, hooks the rest_endpoints filter via secure_user_endpoints() and overwrites every registered handler\u0027s permission_callback on both the /wp/v2/users and /wp/v2/users/(?P\u003cid\u003e[\\d]+) routes \u2014 including POST, PUT, PATCH, and DELETE handlers \u2014 with a bare closure that returns only is_user_logged_in(), completely stripping WordPress Core\u0027s original capability checks such as create_users, promote_user, edit_users, and delete_users that WP_REST_Users_Controller normally enforces. This makes it possible for authenticated attackers with Subscriber-level access and above to create new Administrator accounts by sending POST request to /wp/v2/users with administrator role, or to reset an existing Administrator\u0027s password by issuing a PUT/POST request to /wp/v2/users/\u003cid\u003e. Because the block_user_enum option defaults to enabled, no special plugin configuration is required \u2014 the overwrite is active on every request as soon as the plugin is installed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T23:27:18.750Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/64f1a71f-e210-4191-bfb4-56f8568180ed?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/security-hardener/tags/2.4.4/security-hardener.php#L107"
},
{
"url": "https://plugins.trac.wordpress.org/browser/security-hardener/tags/2.4.4/security-hardener.php#L180"
},
{
"url": "https://plugins.trac.wordpress.org/browser/security-hardener/tags/2.4.4/security-hardener.php#L204"
},
{
"url": "https://plugins.trac.wordpress.org/browser/security-hardener/tags/2.4.4/security-hardener.php#L428"
},
{
"url": "https://plugins.trac.wordpress.org/browser/security-hardener/tags/2.4.4/security-hardener.php#L433"
},
{
"url": "https://plugins.trac.wordpress.org/browser/security-hardener/tags/2.4.4/security-hardener.php#L439"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3630896/security-hardener"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-22T11:09:38.000Z",
"value": "Disclosed"
}
],
"title": "Security Hardener \u003c= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API \u0027/wp/v2/users\u0027 permission_callback Overwrite"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-16149",
"datePublished": "2026-08-22T23:27:18.750Z",
"dateReserved": "2026-07-17T18:41:15.726Z",
"dateUpdated": "2026-08-24T18:19:21.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15992 (GCVE-0-2026-15992)
Vulnerability from cvelistv5 – Published: 2026-07-28 18:35 – Updated: 2026-07-29 14:01
VLAI
EPSS
VEX
Title
WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation
Summary
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST['user_login']`, without confirming the requesting user holds the capability to assign roles. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their own privileges to Administrator by submitting a crafted POST request — with `action` set to `createuser` and `role` set to `administrator` — to the password-reset form endpoint. The vulnerable code path is reachable via the `password_hint` filter hooked during the WordPress password-reset form render, meaning an attacker need only possess a valid password-reset cookie to reach the sink.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 14:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| teydeastudio | WP Password Policy |
Affected:
0 , ≤ 3.7.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15992",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T14:00:38.116230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T14:01:03.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WP Password Policy",
"vendor": "teydeastudio",
"versions": [
{
"lessThanOrEqual": "3.7.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST[\u0027user_login\u0027]`, without confirming the requesting user holds the capability to assign roles. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their own privileges to Administrator by submitting a crafted POST request \u2014 with `action` set to `createuser` and `role` set to `administrator` \u2014 to the password-reset form endpoint. The vulnerable code path is reachable via the `password_hint` filter hooked during the WordPress password-reset form render, meaning an attacker need only possess a valid password-reset cookie to reach the sink."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T18:35:51.190Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ad5ca1c-b8c3-42c0-8170-821ada826cbb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/password-requirements/tags/3.7.1/src/modules/password-hint/class-module-password-hint.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/browser/password-requirements/tags/3.7.1/src/modules/password-hint/class-module-password-hint.php#L54"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-17T07:03:43.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-27T19:12:43.000Z",
"value": "Disclosed"
}
],
"title": "WP Password Policy \u003c= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15992",
"datePublished": "2026-07-28T18:35:51.190Z",
"dateReserved": "2026-07-16T20:12:58.744Z",
"dateUpdated": "2026-07-29T14:01:03.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15982 (GCVE-0-2026-15982)
Vulnerability from cvelistv5 – Published: 2026-07-17 05:35 – Updated: 2026-07-17 10:11
VLAI
EPSS
VEX
Title
Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function'
Summary
The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'aiomatic_call_google_ai_function' function. This makes it possible for unauthenticated attackers to leverage the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-17 10:10 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| CodeRevolution | Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit |
Affected:
0 , ≤ 2.8.4
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T10:10:53.792761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T10:11:03.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot \u0026 Automation Toolkit",
"vendor": "CodeRevolution",
"versions": [
{
"lessThanOrEqual": "2.8.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bao Le"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot \u0026 Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the \u0027aiomatic_call_google_ai_function\u0027 function. This makes it possible for unauthenticated attackers to leverage the \u0027aimogen_wp_god_mode\u0027 tool to clear function blacklists and execute arbitrary PHP functions, such as creating administrator accounts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T05:35:58.570Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53cc91fa-51fd-4d16-b740-a48f8d446b5d?source=cve"
},
{
"url": "https://coderevolution.ro/knowledge-base/faq/full-changelog-aiomatic-automatic-ai-content-writer-editor-gpt-3-gpt-4-chatgpt-chatbot-ai-toolkit/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-06T04:26:02.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-07-13T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot \u0026 Automation Toolkit \u003c= 2.8.4 - Unauthenticated Privilege Escalation via \u0027aiomatic_call_google_ai_function\u0027"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15982",
"datePublished": "2026-07-17T05:35:58.570Z",
"dateReserved": "2026-07-16T17:05:25.189Z",
"dateUpdated": "2026-07-17T10:11:03.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15426 (GCVE-0-2026-15426)
Vulnerability from cvelistv5 – Published: 2026-08-11 18:26 – Updated: 2026-08-12 16:58
VLAI
EPSS
VEX
Title
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
Summary
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 16:05 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| acyba | AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress |
Affected:
0 , ≤ 10.11.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T16:05:40.310260Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T16:58:26.640Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress",
"vendor": "acyba",
"versions": [
{
"lessThanOrEqual": "10.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "d.v4n_s3c"
}
],
"descriptions": [
{
"lang": "en",
"value": "The AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails \u2014 including those targeting administrator accounts \u2014 to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the \"Send website emails with AcyMailing\" option, which routes WordPress core notification emails through AcyMailing\u0027s templating system."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T18:26:32.125Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c187d78-9f1d-4e55-a611-755ee30f855b?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Controllers/Mails/Edition.php#L344"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Controllers/Dashboard/Walkthrough.php#L222"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Core/AcymController.php#L99"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/WpInit/Router.php#L122"
},
{
"url": "https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Classes/MailClass.php#L1496"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3632690/acymailing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-10T16:47:29.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-08-11T06:12:22.000Z",
"value": "Disclosed"
}
],
"title": "AcyMailing \u003c= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15426",
"datePublished": "2026-08-11T18:26:32.125Z",
"dateReserved": "2026-07-10T16:32:12.807Z",
"dateUpdated": "2026-08-12T16:58:26.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-1
Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Mitigation MIT-48
Architecture and Design
Strategy: Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Mitigation MIT-49
Architecture and Design
Strategy: Separation of Privilege
Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
CAPEC-122: Privilege Abuse
An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources.
CAPEC-233: Privilege Escalation
An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CAPEC-58: Restful Privilege Elevation
An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.