CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14839 vulnerabilities reference this CWE, most recent first.
GHSA-F8MV-JPHX-3R7G
Vulnerability from github – Published: 2024-06-06 21:30 – Updated: 2024-06-06 21:30An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
{
"affected": [],
"aliases": [
"CVE-2024-5130"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T19:16:04Z",
"severity": "HIGH"
},
"details": "An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.",
"id": "GHSA-f8mv-jphx-3r7g",
"modified": "2024-06-06T21:30:37Z",
"published": "2024-06-06T21:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5130"
},
{
"type": "WEB",
"url": "https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8Q5-RRG5-H693
Vulnerability from github – Published: 2022-11-19 00:30 – Updated: 2022-11-21 21:30Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
{
"affected": [],
"aliases": [
"CVE-2022-44584"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-18T23:15:00Z",
"severity": "CRITICAL"
},
"details": "Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin \u003c= 3.6.15 on WordPress.",
"id": "GHSA-f8q5-rrg5-h693",
"modified": "2022-11-21T21:30:17Z",
"published": "2022-11-19T00:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44584"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/watchtowerhq/wordpress-watchtowerhq-plugin-3-6-15-unauth-arbitrary-file-deletion-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/watchtowerhq/#developers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F8Q6-3G5W-JJR6
Vulnerability from github – Published: 2026-06-04 19:33 – Updated: 2026-06-04 19:33Summary
This is a vertical authorization bypass in the Admin API affecting order state transition features (/api/_action/order/{orderId}/state/{transition} and similar transaction/delivery transition routes). The root cause is that the transition action routes do not declare required server-side ACL privileges, allowing low-privileged users to pass the authorization boundary. As a result, authenticated users without order:update can still change order states, causing real security impact such as operational integrity loss, automation workflow misuse, and fulfillment/settlement/support process disruption.
Description
Shopware’s permission model requires server-side enforcement independent of UI guards. However, the dedicated order-state transition action endpoints are missing ACL metadata, so accounts without regular order update privileges can still submit transition requests that are processed by the backend. In real reproduction, the same low-privileged account receives 403 on the normal order update API, while the transition action API succeeds with 200 and updates order state in the database. The key point is that reproduction is possible through direct API calls regardless of UI access restrictions or hidden buttons. This is not a functional edge case; it is an implementation gap in authorization boundaries that enables privilege escalation behavior where a “read/limited-edit” user can control order lifecycle states.
Expected Behavior
- Order, order-transaction, and order-delivery transition endpoints must perform explicit server-side ACL checks.
- Requests should be rejected unless the caller has the proper entity update privileges, such as
order:update,order_transaction:update, ororder_delivery:update. - If an account gets 403 on the normal order update API, transition actions on the same protected resource should also be blocked by equivalent policy.
- Even if transition internals use SYSTEM_SCOPE, caller authorization must be validated before entering the transition execution path.
Root Cause
File: src/Core/Checkout/Order/Api/OrderActionController.php
#[Route(
path: '/api/_action/order/{orderId}/state/{transition}',
name: 'api.action.order.state_machine.order.transition_state',
methods: [Request::METHOD_POST]
)]
public function orderStateTransition(
string $orderId,
string $transition,
Request $request,
Context $context
): JsonResponse {
$toPlace = $this->orderService->orderStateTransition(
$orderId,
$transition,
$request->request,
$context
);
return new JsonResponse($toPlace->jsonSerialize());
}
This route exposes state transitions but forwards user-controlled inputs (orderId, transition) into the service layer without PlatformRequest::ATTRIBUTE_ACL and without an explicit context->isAllowed(...) privilege check. An untrusted caller can directly control the transition target.
File: src/Core/Framework/Api/Acl/AclAnnotationValidator.php
$privileges = $request->attributes->get(PlatformRequest::ATTRIBUTE_ACL);
if (!$privileges) {
return;
}
If route ACL metadata is absent, ACL validation exits immediately. Therefore these action routes skip authorization validation entirely.
File: src/Core/System/StateMachine/StateMachineRegistry.php
public function transition(Transition $transition, Context $context): StateMachineStateCollection
{
return $context->scope(Context::SYSTEM_SCOPE, function (Context $context) use ($transition): StateMachineStateCollection {
// ...
$this->stateMachineHistoryRepository->create([$stateMachineHistoryEntity], $context);
$repository->upsert($data, $context);
// ...
});
}
Transitions run in SYSTEM_SCOPE and persist state/history with system context. This requires strict pre-authorization at the route/controller boundary, but that pre-check is missing, so low-privileged calls still lead to real state changes.
Impact
The precondition is a remotely reachable authenticated low-privileged Admin API user (for example, operator/support account, or a compromised restricted account). The attacker only needs a valid order identifier, then calls transition action endpoints to cancel/reopen/advance order states without intended update privileges. This attack remains feasible even when UI access is restricted, because direct API calls still work. As a result, business workflows can be manipulated: order lifecycle integrity is broken, payment/shipping/document/notification/automation flows can be triggered incorrectly, and operational disruption can follow. In realistic scenarios, an attacker with a restricted account can mass-cancel or selectively alter orders, causing customer-support spikes, settlement inconsistencies, fulfillment mistakes, and practical availability degradation of day-to-day operations.
Patch Recommendation
- Add explicit ACL requirements to order/order-transaction/order-delivery transition routes in
OrderActionController, aligned with entity update privileges. - Centralize server-side privilege checks at transition entry points so transition paths and normal update paths follow consistent authorization policy.
- Keep SYSTEM_SCOPE writes strictly behind authorization gates; ensure caller privilege decisions are completed in pre-check logic before transition execution.
- Review transition-related APIs to guarantee privilege model mapping (
order:*,order_transaction:*,order_delivery:*) is consistently enforced and no unprotected route remains.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "6.7.0.0"
},
{
"fixed": "6.7.10.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.10.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "6.7.0.0"
},
{
"fixed": "6.7.10.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.10.18"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48014"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-04T19:33:02Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\nThis is a vertical authorization bypass in the Admin API affecting order state transition features (`/api/_action/order/{orderId}/state/{transition}` and similar transaction/delivery transition routes). The root cause is that the transition action routes do not declare required server-side ACL privileges, allowing low-privileged users to pass the authorization boundary. As a result, authenticated users without `order:update` can still change order states, causing real security impact such as operational integrity loss, automation workflow misuse, and fulfillment/settlement/support process disruption.\n\n## Description\nShopware\u2019s permission model requires server-side enforcement independent of UI guards. However, the dedicated order-state transition action endpoints are missing ACL metadata, so accounts without regular order update privileges can still submit transition requests that are processed by the backend. In real reproduction, the same low-privileged account receives 403 on the normal order update API, while the transition action API succeeds with 200 and updates order state in the database. The key point is that reproduction is possible through direct API calls regardless of UI access restrictions or hidden buttons. This is not a functional edge case; it is an implementation gap in authorization boundaries that enables privilege escalation behavior where a \u201cread/limited-edit\u201d user can control order lifecycle states.\n\n### Expected Behavior\n- Order, order-transaction, and order-delivery transition endpoints must perform explicit server-side ACL checks.\n- Requests should be rejected unless the caller has the proper entity update privileges, such as `order:update`, `order_transaction:update`, or `order_delivery:update`.\n- If an account gets 403 on the normal order update API, transition actions on the same protected resource should also be blocked by equivalent policy.\n- Even if transition internals use SYSTEM_SCOPE, caller authorization must be validated before entering the transition execution path.\n\n### Root Cause\nFile: `src/Core/Checkout/Order/Api/OrderActionController.php`\n\n```php\n#[Route(\n path: \u0027/api/_action/order/{orderId}/state/{transition}\u0027,\n name: \u0027api.action.order.state_machine.order.transition_state\u0027,\n methods: [Request::METHOD_POST]\n)]\npublic function orderStateTransition(\n string $orderId,\n string $transition,\n Request $request,\n Context $context\n): JsonResponse {\n $toPlace = $this-\u003eorderService-\u003eorderStateTransition(\n $orderId,\n $transition,\n $request-\u003erequest,\n $context\n );\n\n return new JsonResponse($toPlace-\u003ejsonSerialize());\n}\n```\n\nThis route exposes state transitions but forwards user-controlled inputs (`orderId`, `transition`) into the service layer without `PlatformRequest::ATTRIBUTE_ACL` and without an explicit `context-\u003eisAllowed(...)` privilege check. An untrusted caller can directly control the transition target.\n\nFile: `src/Core/Framework/Api/Acl/AclAnnotationValidator.php`\n\n```php\n$privileges = $request-\u003eattributes-\u003eget(PlatformRequest::ATTRIBUTE_ACL);\n\nif (!$privileges) {\n return;\n}\n```\n\nIf route ACL metadata is absent, ACL validation exits immediately. Therefore these action routes skip authorization validation entirely.\n\nFile: `src/Core/System/StateMachine/StateMachineRegistry.php`\n\n```php\npublic function transition(Transition $transition, Context $context): StateMachineStateCollection\n{\n return $context-\u003escope(Context::SYSTEM_SCOPE, function (Context $context) use ($transition): StateMachineStateCollection {\n // ...\n $this-\u003estateMachineHistoryRepository-\u003ecreate([$stateMachineHistoryEntity], $context);\n $repository-\u003eupsert($data, $context);\n // ...\n });\n}\n```\n\nTransitions run in SYSTEM_SCOPE and persist state/history with system context. This requires strict pre-authorization at the route/controller boundary, but that pre-check is missing, so low-privileged calls still lead to real state changes.\n\n## Impact\nThe precondition is a remotely reachable authenticated low-privileged Admin API user (for example, operator/support account, or a compromised restricted account). The attacker only needs a valid order identifier, then calls transition action endpoints to cancel/reopen/advance order states without intended update privileges. This attack remains feasible even when UI access is restricted, because direct API calls still work. As a result, business workflows can be manipulated: order lifecycle integrity is broken, payment/shipping/document/notification/automation flows can be triggered incorrectly, and operational disruption can follow. In realistic scenarios, an attacker with a restricted account can mass-cancel or selectively alter orders, causing customer-support spikes, settlement inconsistencies, fulfillment mistakes, and practical availability degradation of day-to-day operations.\n\n## Patch Recommendation\n- Add explicit ACL requirements to order/order-transaction/order-delivery transition routes in `OrderActionController`, aligned with entity update privileges.\n- Centralize server-side privilege checks at transition entry points so transition paths and normal update paths follow consistent authorization policy.\n- Keep SYSTEM_SCOPE writes strictly behind authorization gates; ensure caller privilege decisions are completed in pre-check logic before transition execution.\n- Review transition-related APIs to guarantee privilege model mapping (`order:*`, `order_transaction:*`, `order_delivery:*`) is consistently enforced and no unprotected route remains.",
"id": "GHSA-f8q6-3g5w-jjr6",
"modified": "2026-06-04T19:33:02Z",
"published": "2026-06-04T19:33:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/security/advisories/GHSA-f8q6-3g5w-jjr6"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopware/shopware"
},
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/releases/tag/v6.6.10.18"
},
{
"type": "WEB",
"url": "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Shopware: Admin API ACL Bypass in Order State Transition Endpoints"
}
GHSA-F8Q6-HMXG-H9WF
Vulnerability from github – Published: 2025-10-27 03:30 – Updated: 2026-01-20 15:31Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
{
"affected": [],
"aliases": [
"CVE-2025-62882"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T02:15:46Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through \u003c= 3.13.0.",
"id": "GHSA-f8q6-hmxg-h9wf",
"modified": "2026-01-20T15:31:34Z",
"published": "2025-10-27T03:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62882"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-broken-access-control-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/seriously-simple-podcasting/vulnerability/wordpress-seriously-simple-podcasting-plugin-3-13-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8R8-H93M-MJ77
Vulnerability from github – Published: 2023-04-05 21:30 – Updated: 2023-04-06 16:59HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.5.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/nomad"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "1.5.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-1782"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-06T16:59:26Z",
"nvd_published_at": "2023-04-05T20:15:00Z",
"severity": "HIGH"
},
"details": "HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.",
"id": "GHSA-f8r8-h93m-mj77",
"modified": "2023-04-06T16:59:26Z",
"published": "2023-04-05T21:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1782"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-12-nomad-unauthenticated-client-agent-http-request-privilege-escalation/52375"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/nomad"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation"
}
GHSA-F8RQ-8R29-248P
Vulnerability from github – Published: 2026-07-10 15:31 – Updated: 2026-07-10 15:31Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.
{
"affected": [],
"aliases": [
"CVE-2026-56279"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-10T15:16:42Z",
"severity": "HIGH"
},
"details": "Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users\u0027 organization membership, roles, management emails, and billing metadata.",
"id": "GHSA-f8rq-8r29-248p",
"modified": "2026-07-10T15:31:39Z",
"published": "2026-07-10T15:31:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-fch8-pp28-mw2x"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56279"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/capgo-information-disclosure-via-get-orgs-v7-rpc-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F8W7-GF8J-VVV3
Vulnerability from github – Published: 2025-03-27 12:30 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.29.
{
"affected": [],
"aliases": [
"CVE-2025-30828"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-27T11:15:44Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.29.",
"id": "GHSA-f8w7-gf8j-vvv3",
"modified": "2026-04-01T18:34:07Z",
"published": "2025-03-27T12:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30828"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/timetics/vulnerability/wordpress-timetics-plugin-1-0-29-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8WV-8GW9-XVC6
Vulnerability from github – Published: 2025-07-29 12:31 – Updated: 2025-07-29 12:31The Bonanza – WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success.
{
"affected": [],
"aliases": [
"CVE-2025-6730"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-29T10:15:29Z",
"severity": "MODERATE"
},
"details": "The Bonanza \u2013 WooCommerce Free Gifts Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the xlo_optin_call() function in all versions up to, and including, 1.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set the opt in status to success.",
"id": "GHSA-f8wv-8gw9-xvc6",
"modified": "2025-07-29T12:31:21Z",
"published": "2025-07-29T12:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6730"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bonanza-woocommerce-free-gifts-lite/trunk/xl/includes/class-xl-opt-in-manager.php#L244"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c7a192b-25cc-4041-a72b-34fbd697045b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F8XW-G352-95P4
Vulnerability from github – Published: 2025-01-27 15:30 – Updated: 2026-04-01 18:33Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.3.0.
{
"affected": [],
"aliases": [
"CVE-2025-24584"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-27T14:15:28Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.3.0.",
"id": "GHSA-f8xw-g352-95p4",
"modified": "2026-04-01T18:33:29Z",
"published": "2025-01-27T15:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24584"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-2-3-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F927-C8M5-JH63
Vulnerability from github – Published: 2024-11-01 15:31 – Updated: 2024-11-01 15:31Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0
{
"affected": [],
"aliases": [
"CVE-2024-37439"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-01T15:15:24Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through\u00a04.1.4.0",
"id": "GHSA-f927-c8m5-jh63",
"modified": "2024-11-01T15:31:57Z",
"published": "2024-11-01T15:31:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37439"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/uncanny-toolkit-pro/wordpress-uncanny-toolkit-pro-for-learndash-plugin-4-1-4-1-subscriber-arbitrary-post-page-duplication-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.