CWE-306
AllowedMissing Authentication for Critical Function
Abstraction: Base · Status: Draft
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
3467 vulnerabilities reference this CWE, most recent first.
GHSA-5587-2X54-JJ6H
Vulnerability from github – Published: 2026-07-17 21:46 – Updated: 2026-07-17 21:46Description
The routesrv component exposes the full cluster route topology (Ingress/RouteGroup configurations, backend URLs, filter chains, OAuth/OIDC callback paths) and cache-cluster topology (Redis/Valkey shard addresses) over plain HTTP with zero authentication. Any pod in the Kubernetes cluster can reach routesrv via its predictable DNS name and retrieve sensitive cluster-wide routing and cache infrastructure data.
Vulnerable Code
routesrv/routesrv.go:87-99,114-137 — all handler registrations on the main mux:
mux.Handle("/routes", b) // eskipBytes.ServeHTTP — all route data
mux.Handle("/routes/{zone}", b) // zone-scoped route data
mux.Handle("/swarm/redis/shards", rh) // Redis cluster addresses
mux.Handle("/swarm/valkey/shards", vh) // Valkey cluster addresses
routesrv/eskipbytes.go:134-196 — eskipBytes.ServeHTTP:
func (e *eskipBytes) ServeHTTP(rw http.ResponseWriter, r *http.Request) {
// ... only checks GET/HEAD method, NO auth check
if r.Method != "GET" && r.Method != "HEAD" {
w.WriteHeader(http.StatusMethodNotAllowed)
return
}
// ... serves all route data immediately
}
routesrv/redishandler.go:28-41 — RedisHandler.ServeHTTP:
func (rh *RedisHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
if r.Method != "GET" {
w.WriteHeader(http.StatusMethodNotAllowed)
return
}
// ... serves Redis cluster addresses immediately, NO auth check
}
routesrv/valkeyhandler.go:28-41 — ValkeyHandler.ServeHTTP:
func (vh *ValkeyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
if r.Method != "GET" {
w.WriteHeader(http.StatusMethodNotAllowed)
return
}
// ... serves Valkey cluster addresses immediately, NO auth check
}
Attack Path
- Initial Compromise: Attacker compromises any pod in the Kubernetes cluster (via application CVE, supply-chain attack, malicious container image, etc.)
- Discovery: Attacker discovers routesrv via predictable Kubernetes DNS name:
skipper-ingress-routesrv.kube-system.svc.cluster.local:9090(documented atdocs/tutorials/operations.md:108,docs/tutorials/ratelimit.md:137,197) - Data Extraction without Auth:
GET http://<routesrv>:9090/routes→ All Ingress/RouteGroup configurations across ALL namespacesGET http://<routesrv>:9090/swarm/redis/shards→ Redis cache cluster node addressesGET http://<routesrv>:9090/swarm/valkey/shards→ Valkey cache cluster node addresses- Subsequent Attacks: With cache cluster topology, attacker can perform direct cache-level attacks (ratelimit data manipulation, session data exfiltration)
Permission Boundary Analysis
The routesrv uses a ServiceAccount with cluster-wide RBAC to list Ingress (networking.k8s.io), RouteGroup (zalando.org), Endpoints, and Services across all namespaces (see clusterclient.go:648-653 fetchClusterState). The kube-apiserver requires proper ServiceAccount token + RBAC authorization for the Kubernetes API itself, but routesrv exposes the aggregated data over HTTP with zero authentication.
A compromised pod with limited RBAC (restricted to its own namespace) can bypass Kubernetes RBAC entirely by reading routesrv. This crosses the boundary from "namespace-scoped Kubernetes workload with restricted RBAC" to "full cluster route topology across all namespaces".
No NetworkPolicy manifests exist in the deploy/ directory. The default Kubernetes flat network model allows any pod to reach any service, further widening the attack surface.
Exposed Data
| Endpoint | Data Exposed | Impact |
|---|---|---|
GET /routes |
All ingress/routegroup backends: internal service URLs, filter chains (auth, rate limiting, OAuth, JWT, OPA policies), load balancer group membership | Cluster-wide reconnaissance, targeted backend attacks |
GET /routes/{zone} |
Zone-scoped subset of above route data | Same, scoped |
GET /swarm/redis/shards |
Redis cluster internal IP:port pairs | Direct cache-level attacks, ratelimit data manipulation |
GET /swarm/valkey/shards |
Valkey cluster internal IP:port pairs | Same |
Additionally, the data-plane client (eskipfile/remote.go:190-219) also performs plain HTTP GET with no credentials — only an ETag header is sent — confirming that no auth capability exists in the architecture at all.
Mitigation
- Add authentication to all routesrv HTTP endpoints (basic auth, bearer token, mTLS, or shared secret) via flag
-route-server-filters="" - Deploy Kubernetes NetworkPolicies restricting ingress to routesrv to only the data-plane skipper pod selectors
- Consider using mutual TLS authentication between data-plane and control-plane components
NetworkPolicy does not remove the missing-auth condition
Restrictive NetworkPolicies are a valid mitigation, but they are not an application-layer authentication mechanism. The security-relevant defect remains that routesrv serves control-plane-derived data to unauthenticated callers whenever network reachability exists.
Impact framing
This report does not rely on claiming direct integrity or availability impact. The verified issue is a confidentiality-focused control-plane exposure: route definitions, backend topology, filter-chain details, and Redis/Valkey shard addresses become readable to any reachable in-cluster client.
Resources
routesrv/routesrv.go:87-99— handler registration (zero auth)routesrv/eskipbytes.go:134-196— route data handler (no auth)routesrv/redishandler.go:28-41— Redis shard handler (no auth)routesrv/valkeyhandler.go:28-41— Valkey shard handler (no auth)dataclients/kubernetes/clusterclient.go:648-653—fetchClusterState()— shows cluster-wide RBACeskipfile/remote.go:190-219— data-plane client also has no auth capabilitydocs/tutorials/operations.md:108,docs/tutorials/ratelimit.md:137,197— documented routesrv DNS name
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/zalando/skipper"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.27.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54246"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-17T21:46:18Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Description\n\nThe `routesrv` component exposes the full cluster route topology (Ingress/RouteGroup configurations, backend URLs, filter chains, OAuth/OIDC callback paths) and cache-cluster topology (Redis/Valkey shard addresses) over plain HTTP with **zero authentication**. Any pod in the Kubernetes cluster can reach routesrv via its predictable DNS name and retrieve sensitive cluster-wide routing and cache infrastructure data.\n\n## Vulnerable Code\n\n**routesrv/routesrv.go:87-99,114-137** \u2014 all handler registrations on the main mux:\n```go\nmux.Handle(\"/routes\", b) // eskipBytes.ServeHTTP \u2014 all route data\nmux.Handle(\"/routes/{zone}\", b) // zone-scoped route data\nmux.Handle(\"/swarm/redis/shards\", rh) // Redis cluster addresses\nmux.Handle(\"/swarm/valkey/shards\", vh) // Valkey cluster addresses\n```\n\n**routesrv/eskipbytes.go:134-196** \u2014 `eskipBytes.ServeHTTP`:\n```go\nfunc (e *eskipBytes) ServeHTTP(rw http.ResponseWriter, r *http.Request) {\n // ... only checks GET/HEAD method, NO auth check\n if r.Method != \"GET\" \u0026\u0026 r.Method != \"HEAD\" {\n w.WriteHeader(http.StatusMethodNotAllowed)\n return\n }\n // ... serves all route data immediately\n}\n```\n\n**routesrv/redishandler.go:28-41** \u2014 `RedisHandler.ServeHTTP`:\n```go\nfunc (rh *RedisHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n if r.Method != \"GET\" {\n w.WriteHeader(http.StatusMethodNotAllowed)\n return\n }\n // ... serves Redis cluster addresses immediately, NO auth check\n}\n```\n\n**routesrv/valkeyhandler.go:28-41** \u2014 `ValkeyHandler.ServeHTTP`:\n```go\nfunc (vh *ValkeyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {\n if r.Method != \"GET\" {\n w.WriteHeader(http.StatusMethodNotAllowed)\n return\n }\n // ... serves Valkey cluster addresses immediately, NO auth check\n}\n```\n\n## Attack Path\n\n1. **Initial Compromise**: Attacker compromises any pod in the Kubernetes cluster (via application CVE, supply-chain attack, malicious container image, etc.)\n2. **Discovery**: Attacker discovers routesrv via predictable Kubernetes DNS name: `skipper-ingress-routesrv.kube-system.svc.cluster.local:9090` (documented at `docs/tutorials/operations.md:108`, `docs/tutorials/ratelimit.md:137,197`)\n3. **Data Extraction without Auth**: \n - `GET http://\u003croutesrv\u003e:9090/routes` \u2192 All Ingress/RouteGroup configurations across ALL namespaces\n - `GET http://\u003croutesrv\u003e:9090/swarm/redis/shards` \u2192 Redis cache cluster node addresses\n - `GET http://\u003croutesrv\u003e:9090/swarm/valkey/shards` \u2192 Valkey cache cluster node addresses\n4. **Subsequent Attacks**: With cache cluster topology, attacker can perform direct cache-level attacks (ratelimit data manipulation, session data exfiltration)\n\n## Permission Boundary Analysis\n\nThe routesrv uses a ServiceAccount with **cluster-wide RBAC** to list Ingress (networking.k8s.io), RouteGroup (zalando.org), Endpoints, and Services across all namespaces (see `clusterclient.go:648-653` `fetchClusterState`). The kube-apiserver requires proper ServiceAccount token + RBAC authorization for the Kubernetes API itself, but **routesrv exposes the aggregated data over HTTP with zero authentication**.\n\nA compromised pod with limited RBAC (restricted to its own namespace) can bypass Kubernetes RBAC entirely by reading routesrv. This crosses the boundary from *\"namespace-scoped Kubernetes workload with restricted RBAC\"* to *\"full cluster route topology across all namespaces\"*.\n\nNo NetworkPolicy manifests exist in the `deploy/` directory. The default Kubernetes flat network model allows any pod to reach any service, further widening the attack surface.\n\n## Exposed Data\n\n| Endpoint | Data Exposed | Impact |\n|----------|-------------|--------|\n| `GET /routes` | All ingress/routegroup backends: internal service URLs, filter chains (auth, rate limiting, OAuth, JWT, OPA policies), load balancer group membership | Cluster-wide reconnaissance, targeted backend attacks |\n| `GET /routes/{zone}` | Zone-scoped subset of above route data | Same, scoped |\n| `GET /swarm/redis/shards` | Redis cluster internal IP:port pairs | Direct cache-level attacks, ratelimit data manipulation |\n| `GET /swarm/valkey/shards` | Valkey cluster internal IP:port pairs | Same |\n\nAdditionally, the data-plane client (`eskipfile/remote.go:190-219`) also performs plain HTTP GET with no credentials \u2014 only an ETag header is sent \u2014 confirming that no auth capability exists in the architecture at all.\n\n\n## Mitigation\n\n1. Add authentication to all routesrv HTTP endpoints (basic auth, bearer token, mTLS, or shared secret) via flag `-route-server-filters=\"\"`\n2. Deploy Kubernetes NetworkPolicies restricting ingress to routesrv to only the data-plane skipper pod selectors\n3. Consider using mutual TLS authentication between data-plane and control-plane components\n\n\n### NetworkPolicy does not remove the missing-auth condition\nRestrictive NetworkPolicies are a valid mitigation, but they are not an application-layer authentication mechanism. The security-relevant defect remains that routesrv serves control-plane-derived data to unauthenticated callers whenever network reachability exists.\n\n### Impact framing\nThis report does **not** rely on claiming direct integrity or availability impact. The verified issue is a confidentiality-focused control-plane exposure: route definitions, backend topology, filter-chain details, and Redis/Valkey shard addresses become readable to any reachable in-cluster client.\n\n## Resources\n\n- `routesrv/routesrv.go:87-99` \u2014 handler registration (zero auth)\n- `routesrv/eskipbytes.go:134-196` \u2014 route data handler (no auth)\n- `routesrv/redishandler.go:28-41` \u2014 Redis shard handler (no auth)\n- `routesrv/valkeyhandler.go:28-41` \u2014 Valkey shard handler (no auth)\n- `dataclients/kubernetes/clusterclient.go:648-653` \u2014 `fetchClusterState()` \u2014 shows cluster-wide RBAC\n- `eskipfile/remote.go:190-219` \u2014 data-plane client also has no auth capability\n- `docs/tutorials/operations.md:108`, `docs/tutorials/ratelimit.md:137,197` \u2014 documented routesrv DNS name",
"id": "GHSA-5587-2x54-jj6h",
"modified": "2026-07-17T21:46:18Z",
"published": "2026-07-17T21:46:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/zalando/skipper/security/advisories/GHSA-5587-2x54-jj6h"
},
{
"type": "PACKAGE",
"url": "https://github.com/zalando/skipper"
},
{
"type": "WEB",
"url": "https://github.com/zalando/skipper/releases/tag/v0.27.13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Skipper\u0027s routesrv-no-auth component: All routesrv API Endpoints Lack Authentication"
}
GHSA-55FW-854F-62MP
Vulnerability from github – Published: 2023-07-11 03:30 – Updated: 2024-04-04 05:54The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.
{
"affected": [],
"aliases": [
"CVE-2023-35873"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-11T03:15:09Z",
"severity": "MODERATE"
},
"details": "The\u00a0Runtime Workbench (RWB) of SAP NetWeaver Process Integration\u00a0- version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to\u00a0sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.\n\n",
"id": "GHSA-55fw-854f-62mp",
"modified": "2024-04-04T05:54:38Z",
"published": "2023-07-11T03:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35873"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3343547"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-55QW-34GF-Q5QJ
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. IBM X-Force ID: 192209.
{
"affected": [],
"aliases": [
"CVE-2020-4958"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-21T14:15:00Z",
"severity": "CRITICAL"
},
"details": "IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. IBM X-Force ID: 192209.",
"id": "GHSA-55qw-34gf-q5qj",
"modified": "2022-05-24T17:40:02Z",
"published": "2022-05-24T17:40:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4958"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192209"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6403247"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-55RJ-X2VC-4WHQ
Vulnerability from github – Published: 2026-05-29 21:32 – Updated: 2026-05-29 21:32Description
The Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the status callbacks Twilio POSTs to an application's webhook endpoint. Its doParse(Request $request, #[\SensitiveParameter] string $secret) method receives the configured webhook secret but never reads it; it decodes and returns the payload unconditionally, ignoring the X-Twilio-Signature HMAC header Twilio sends with each request.
As a result, an application that wires up the Twilio webhook endpoint accepts any POST to that URL, even when a signing secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged status payloads, fake delivered / failed / undelivered events, leading to delivery-metrics fraud, downstream automation triggers, etc.
Resolution
TwilioRequestParser::doParse() now requires and verifies the X-Twilio-Signature header (HMAC-SHA1 over the full request URL concatenated with the alphabetically-sorted POST parameters, base64-encoded, keyed with the Twilio account auth token) before further processing, using a constant-time comparison.
When no secret is configured the behaviour is unchanged: signature verification remains opt-in, but it is now actually enforced once opted in.
Applications behind a TLS-terminating reverse proxy must configure framework.trusted_proxies and framework.trusted_headers so that Request::getUri() returns the public URL Twilio signed.
The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Himanshu Anand for reporting the issue and Nicolas Grekas for providing the fix.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "6.4.0"
},
{
"fixed": "6.4.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/twilio-notifier"
},
"ranges": [
{
"events": [
{
"introduced": "6.4.0"
},
{
"fixed": "6.4.40"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/twilio-notifier"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/twilio-notifier"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-47212"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-29T21:32:23Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Description\n\nThe Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the status callbacks Twilio POSTs to an application\u0027s webhook endpoint. Its `doParse(Request $request, #[\\SensitiveParameter] string $secret)` method receives the configured webhook secret but never reads it; it decodes and returns the payload unconditionally, ignoring the `X-Twilio-Signature` HMAC header Twilio sends with each request.\n\nAs a result, an application that wires up the Twilio webhook endpoint accepts **any** POST to that URL, even when a signing secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged status payloads, fake delivered / failed / undelivered events, leading to delivery-metrics fraud, downstream automation triggers, etc.\n\n### Resolution\n\n`TwilioRequestParser::doParse()` now requires and verifies the `X-Twilio-Signature` header (HMAC-SHA1 over the full request URL concatenated with the alphabetically-sorted POST parameters, base64-encoded, keyed with the Twilio account auth token) before further processing, using a constant-time comparison.\n\nWhen no secret is configured the behaviour is unchanged: signature verification remains opt-in, but it is now actually enforced once opted in.\n\nApplications behind a TLS-terminating reverse proxy must configure `framework.trusted_proxies` and `framework.trusted_headers` so that `Request::getUri()` returns the public URL Twilio signed.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/8545fb2af6c07dfb5ef0fc8d9bccf86db2c94356) for branch 6.4.\n\n### Credits\n\nSymfony would like to thank Himanshu Anand for reporting the issue and Nicolas Grekas for providing the fix.",
"id": "GHSA-55rj-x2vc-4whq",
"modified": "2026-05-29T21:32:23Z",
"published": "2026-05-29T21:32:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/security/advisories/GHSA-55rj-x2vc-4whq"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/commit/8545fb2af6c07dfb5ef0fc8d9bccf86db2c94356"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-47212.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twilio-notifier/CVE-2026-47212.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/symfony/symfony"
},
{
"type": "WEB",
"url": "https://symfony.com/cve-2026-47212"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification"
}
GHSA-55VH-W3P8-QQ9G
Vulnerability from github – Published: 2026-02-18 18:30 – Updated: 2026-02-18 21:31SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.
{
"affected": [],
"aliases": [
"CVE-2025-70141"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-18T17:21:35Z",
"severity": "CRITICAL"
},
"details": "SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.",
"id": "GHSA-55vh-w3p8-qq9g",
"modified": "2026-02-18T21:31:22Z",
"published": "2026-02-18T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70141"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com/download-code?nid=14587\u0026title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code"
},
{
"type": "WEB",
"url": "https://youngkevinn.github.io/posts/CVE-2025-70141-Customer-Support-BAC"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-55WC-R8PR-QF3F
Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-17 18:35Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
{
"affected": [],
"aliases": [
"CVE-2026-46781"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-17T10:53:55Z",
"severity": "CRITICAL"
},
"details": "Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).",
"id": "GHSA-55wc-r8pr-qf3f",
"modified": "2026-06-17T18:35:27Z",
"published": "2026-06-17T18:35:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46781"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cspujun2026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-568V-WJ37-W729
Vulnerability from github – Published: 2021-12-14 00:00 – Updated: 2021-12-18 00:02A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port.
{
"affected": [],
"aliases": [
"CVE-2021-22279"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-13T16:15:00Z",
"severity": "CRITICAL"
},
"details": "A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port.",
"id": "GHSA-568v-wj37-w729",
"modified": "2021-12-18T00:02:00Z",
"published": "2021-12-14T00:00:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22279"
},
{
"type": "WEB",
"url": "https://search.abb.com/library/Download.aspx?DocumentID=SI20265\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-56FW-8MG6-5HVP
Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2024-03-21 03:33** DISPUTED ** SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it."
{
"affected": [],
"aliases": [
"CVE-2020-27986"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-28T23:15:00Z",
"severity": "HIGH"
},
"details": "** DISPUTED ** SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor\u0027s position for SMTP and SVN is \"it is the administrator\u0027s responsibility to configure it.\"",
"id": "GHSA-56fw-8mg6-5hvp",
"modified": "2024-03-21T03:33:56Z",
"published": "2022-05-24T17:32:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27986"
},
{
"type": "WEB",
"url": "https://csl.com.co/sonarqube-auditando-al-auditor-parte-i"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-56JH-X7V6-JQ26
Vulnerability from github – Published: 2026-07-13 12:35 – Updated: 2026-07-13 12:35The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.
{
"affected": [],
"aliases": [
"CVE-2026-22096"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T10:16:27Z",
"severity": "CRITICAL"
},
"details": "The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.",
"id": "GHSA-56jh-x7v6-jq26",
"modified": "2026-07-13T12:35:00Z",
"published": "2026-07-13T12:35:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22096"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/DIVD-2026-00001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-56MF-38RX-QWP9
Vulnerability from github – Published: 2024-09-26 06:30 – Updated: 2024-09-26 06:30Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logout.
{
"affected": [],
"aliases": [
"CVE-2023-52947"
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-26T04:15:06Z",
"severity": "MODERATE"
},
"details": "Missing authentication for critical function vulnerability in logout functionality in Synology Active Backup for Business Agent before 2.6.3-3101 allows local users to logout the client via unspecified vectors. The backup functionality will continue to operate and will not be affected by the logout.",
"id": "GHSA-56mf-38rx-qwp9",
"modified": "2024-09-26T06:30:47Z",
"published": "2024-09-26T06:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52947"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability.
- Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port.
- In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate credential management need to be used throughout.
Mitigation MIT-15
For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Mitigation
- Where possible, avoid implementing custom, "grow-your-own" authentication routines and consider using authentication capabilities as provided by the surrounding framework, operating system, or environment. These capabilities may avoid common weaknesses that are unique to authentication; support automatic auditing and tracking; and make it easier to provide a clear separation between authentication tasks and authorization tasks.
- In environments such as the World Wide Web, the line between authentication and authorization is sometimes blurred. If custom authentication routines are required instead of those provided by the server, then these routines must be applied to every single page, since these pages could be requested directly.
Mitigation MIT-4.5
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Mitigation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to require strong authentication for users who should be allowed to access the data [REF-1297] [REF-1298] [REF-1302].
CAPEC-12: Choosing Message Identifier
This pattern of attack is defined by the selection of messages distributed via multicast or public information channels that are intended for another client by determining the parameter value assigned to that client. This attack allows the adversary to gain access to potentially privileged information, and to possibly perpetrate other attacks through the distribution means by impersonation. If the channel/message being manipulated is an input rather than output mechanism for the system, (such as a command bus), this style of attack could be used to change the adversary's identifier to more a privileged one.
CAPEC-166: Force the System to Reset Values
An attacker forces the target into a previous state in order to leverage potential weaknesses in the target dependent upon a prior configuration or state-dependent factors. Even in cases where an attacker may not be able to directly control the configuration of the targeted application, they may be able to reset the configuration to a prior state since many applications implement reset functions.
CAPEC-216: Communication Channel Manipulation
An adversary manipulates a setting or parameter on communications channel in order to compromise its security. This can result in information exposure, insertion/removal of information from the communications stream, and/or potentially system compromise.
CAPEC-36: Using Unpublished Interfaces or Functionality
An adversary searches for and invokes interfaces or functionality that the target system designers did not intend to be publicly available. If interfaces fail to authenticate requests, the attacker may be able to invoke functionality they are not authorized for.
CAPEC-62: Cross Site Request Forgery
An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.