CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
17432 vulnerabilities reference this CWE, most recent first.
GHSA-XHCP-54VP-9Q62
Vulnerability from github – Published: 2025-05-07 15:31 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in dgamoni LocateAndFilter allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects LocateAndFilter: from n/a through 1.6.16.
{
"affected": [],
"aliases": [
"CVE-2025-47457"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T15:15:59Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in dgamoni LocateAndFilter allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects LocateAndFilter: from n/a through 1.6.16.",
"id": "GHSA-xhcp-54vp-9q62",
"modified": "2026-04-01T18:35:01Z",
"published": "2025-05-07T15:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47457"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/locateandfilter/vulnerability/wordpress-locateandfilter-1-6-16-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XHFH-3X4Q-PR4M
Vulnerability from github – Published: 2024-05-02 18:30 – Updated: 2026-04-08 18:33The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'booster_extension_authorbox_shortcode_display' function. This makes it possible for unauthenticated attackers to extract sensitive data including user emails
{
"affected": [],
"aliases": [
"CVE-2024-2109"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-02T17:15:15Z",
"severity": "MODERATE"
},
"details": "The Booster Extension plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the \u0027booster_extension_authorbox_shortcode_display\u0027 function. This makes it possible for unauthenticated attackers to extract sensitive data including user emails",
"id": "GHSA-xhfh-3x4q-pr4m",
"modified": "2026-04-08T18:33:03Z",
"published": "2024-05-02T18:30:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2109"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/booster-extension/tags/1.2.0/inc/frontend/author-box-shortcode.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3053100%40booster-extension\u0026new=3053100%40booster-extension\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/89458095-2efe-4162-961a-7dc80852d312?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XHFV-7758-R9HX
Vulnerability from github – Published: 2026-09-17 20:45 – Updated: 2026-09-17 20:45Summary
The core Flex group blueprint system/blueprints/user/group.yaml (access field, lines 48-55) omits the security@: admin.super field guard that its sibling account blueprint carries (account.yaml:131/138/150, added by the CVE-2026-42613 fix). A delegated non-super operator holding admin.users.update can therefore save a group whose access map contains admin.super: true, which UserGroupObject::authorize then grants to every member of that group, a full privilege escalation to super-admin (scheduler/cron RCE, Twig eval). This is a distinct file, sink, and fix from all four related advisories.
Root Cause
The CVE-2026-42613 fix protected the account access/groups fields with a blueprint-level security@: admin.super gate, which Blueprint::dynamicSecurity() (system/src/Grav/Common/Data/Blueprint.php:644-662) uses to mark a field validate.ignore=true for non-super users so BlueprintSchema::filterArray() (BlueprintSchema.php:263-311) drops it. The functionally-identical group access field, a permission map granted to every member of the group, is declared in system/blueprints/user/group.yaml:48-55 with check_authorize: false and NO security@ guard. check_authorize has ZERO PHP enforcement (grep -rn check_authorize across the repo returns 0 PHP consumers; only two YAML blueprints reference it), so security@ is the sole real control. Because the group access field lacks security@, dynamicSecurity never flags it, filterArray retains it, and Validation::filterArray (type: array, value_type: bool) passes the nested admin.super:true leaf through. The core save path (FlexObject::update() then Framework/Flex/FlexObject.php:683 $blueprint->filter($data,true,true) then save()) persists it to user://config/groups.yaml.
Impact
A delegated admin.users operator (strictly below admin.super) escalates to super-admin, gaining the admin panel, the scheduler (cron to RCE) and Twig evaluation. Full read/write/DoS (C:H/I:H/A:H). Even absent self-escalation, arbitrary rewrite of ANY group's ACL is itself a full escalation primitive.
Proof of Concept
As a non-super admin.users operator who is a member of group ops:
POST /admin/accounts/groups/ops (or groups.json task:save)
data[access][admin][super]=1
user/config/groups.yaml gains ops: { access: { admin: { super: true } } }, so the operator is super-admin on the next request.
Attack Chain
- Entry: authenticated delegated admin (
admin.users.update, noadmin.super) POSTs the group-edit form for a group they belong to (or a new group), bodyaccess[admin][super]=true. Guard:FlexAuthorizeTrait::isAuthorizedActiontoadmin.users.update. Bypass proof:user-groups.yamlexposes groups atadmin.users:crudl; operator legitimately holds update. - Check (field guard):
Blueprint::dynamicSecuritymarksvalidate.ignoreonly forsecurity@fields. Guard: none on group access (nosecurity@). Bypass proof:group.yaml:48-55has nosecurity@;git log -S 'security@' -- system/blueprints/user/group.yamlis empty. - Filter:
BlueprintSchema::filterArrayretains the non-ignored field;Validation::filterArray(value_type: bool) passesadmin.super:truethrough. Bypass proof: field not flagged ignore/disabled; nested bool leaf preserved. - Sink (persist):
FlexObject::updatethenfilterthensavewrites touser://config/groups.yaml. Guard: none. Bypass proof: value already survived steps 2/3; storage performs no ACL filtering. - Impact: any member request triggers
UserGroupObject::authorize('admin.super')(.../UserGroups/UserGroupObject.php:75) returning true, so the member is super-admin, enabling scheduler/Twig RCE.
Bypass Evidence
system/blueprints/user/group.yaml:48-55: access block withcheck_authorize: false, nosecurity@(confirmed live on tag 2.0.12).git log -S 'security@' -- system/blueprints/user/group.yamlis empty (guard never existed; a permanent gap, not a regression).git log 2.0.12..HEAD -- system/blueprints/user/group.yamlis empty (no post-release fix).grep -rn check_authorize(whole repo) returns 0 PHP hits (guard unenforced in PHP).grep -rn "typePermissions|filterPermissions" system/src/Grav/Common/Datareturns 0 (permissions map falls through to array-bool filtering that keeps nested keys).- Guard asymmetry:
account.yaml:131/138/150carrysecurity@: admin.super;group.yamlcarries none. GHSA-h33v-82r9-v8pm's own text confirms the blueprintsecurity@gate is the sole Flex-backend strip for these keys.
Affected Versions
<= 2.0.12 (latest release; the guard never existed on group.yaml, so all 2.x are affected). The missing guard and the strip logic are both in core getgrav/grav; the group-edit UI is provided by the flex-objects/admin plugin, but the fix belongs in core.
Suggested Fix
Add security@: admin.super to the access field in system/blueprints/user/group.yaml (mirroring account.yaml), and/or enforce a super-only strip on group ACL saves in core so all callers are covered.
Reported by zx (Jace) — GitHub: @manus-use
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "getgrav/grav"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.14"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-75837"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T20:45:15Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\nThe core Flex group blueprint `system/blueprints/user/group.yaml` (access field, lines 48-55) omits the `security@: admin.super` field guard that its sibling account blueprint carries (`account.yaml:131/138/150`, added by the CVE-2026-42613 fix). A delegated non-super operator holding `admin.users.update` can therefore save a group whose `access` map contains `admin.super: true`, which `UserGroupObject::authorize` then grants to every member of that group, a full privilege escalation to super-admin (scheduler/cron RCE, Twig eval). This is a distinct file, sink, and fix from all four related advisories.\n\n## Root Cause\nThe CVE-2026-42613 fix protected the account `access`/`groups` fields with a blueprint-level `security@: admin.super` gate, which `Blueprint::dynamicSecurity()` (`system/src/Grav/Common/Data/Blueprint.php:644-662`) uses to mark a field `validate.ignore=true` for non-super users so `BlueprintSchema::filterArray()` (`BlueprintSchema.php:263-311`) drops it. The functionally-identical group `access` field, a permission map granted to every member of the group, is declared in `system/blueprints/user/group.yaml:48-55` with `check_authorize: false` and NO `security@` guard. `check_authorize` has ZERO PHP enforcement (`grep -rn check_authorize` across the repo returns 0 PHP consumers; only two YAML blueprints reference it), so `security@` is the sole real control. Because the group access field lacks `security@`, `dynamicSecurity` never flags it, `filterArray` retains it, and `Validation::filterArray` (`type: array, value_type: bool`) passes the nested `admin.super:true` leaf through. The core save path (`FlexObject::update()` then `Framework/Flex/FlexObject.php:683` `$blueprint-\u003efilter($data,true,true)` then `save()`) persists it to `user://config/groups.yaml`.\n\n## Impact\nA delegated `admin.users` operator (strictly below `admin.super`) escalates to super-admin, gaining the admin panel, the scheduler (cron to RCE) and Twig evaluation. Full read/write/DoS (C:H/I:H/A:H). Even absent self-escalation, arbitrary rewrite of ANY group\u0027s ACL is itself a full escalation primitive.\n\n## Proof of Concept\nAs a non-super `admin.users` operator who is a member of group `ops`:\n```\nPOST /admin/accounts/groups/ops (or groups.json task:save)\ndata[access][admin][super]=1\n```\n`user/config/groups.yaml` gains `ops: { access: { admin: { super: true } } }`, so the operator is super-admin on the next request.\n\n## Attack Chain\n1. Entry: authenticated delegated admin (`admin.users.update`, no `admin.super`) POSTs the group-edit form for a group they belong to (or a new group), body `access[admin][super]=true`. Guard: `FlexAuthorizeTrait::isAuthorizedAction` to `admin.users.update`. Bypass proof: `user-groups.yaml` exposes groups at `admin.users:crudl`; operator legitimately holds update.\n2. Check (field guard): `Blueprint::dynamicSecurity` marks `validate.ignore` only for `security@` fields. Guard: none on group access (no `security@`). Bypass proof: `group.yaml:48-55` has no `security@`; `git log -S \u0027security@\u0027 -- system/blueprints/user/group.yaml` is empty.\n3. Filter: `BlueprintSchema::filterArray` retains the non-ignored field; `Validation::filterArray` (`value_type: bool`) passes `admin.super:true` through. Bypass proof: field not flagged ignore/disabled; nested bool leaf preserved.\n4. Sink (persist): `FlexObject::update` then `filter` then `save` writes to `user://config/groups.yaml`. Guard: none. Bypass proof: value already survived steps 2/3; storage performs no ACL filtering.\n5. Impact: any member request triggers `UserGroupObject::authorize(\u0027admin.super\u0027)` (`.../UserGroups/UserGroupObject.php:75`) returning true, so the member is super-admin, enabling scheduler/Twig RCE.\n\n## Bypass Evidence\n- `system/blueprints/user/group.yaml:48-55`: access block with `check_authorize: false`, no `security@` (confirmed live on tag 2.0.12).\n- `git log -S \u0027security@\u0027 -- system/blueprints/user/group.yaml` is empty (guard never existed; a permanent gap, not a regression).\n- `git log 2.0.12..HEAD -- system/blueprints/user/group.yaml` is empty (no post-release fix).\n- `grep -rn check_authorize` (whole repo) returns 0 PHP hits (guard unenforced in PHP).\n- `grep -rn \"typePermissions|filterPermissions\" system/src/Grav/Common/Data` returns 0 (permissions map falls through to array-bool filtering that keeps nested keys).\n- Guard asymmetry: `account.yaml:131/138/150` carry `security@: admin.super`; `group.yaml` carries none. GHSA-h33v-82r9-v8pm\u0027s own text confirms the blueprint `security@` gate is the sole Flex-backend strip for these keys.\n\n## Affected Versions\n`\u003c= 2.0.12` (latest release; the guard never existed on `group.yaml`, so all 2.x are affected). The missing guard and the strip logic are both in core `getgrav/grav`; the group-edit UI is provided by the flex-objects/admin plugin, but the fix belongs in core.\n\n## Suggested Fix\nAdd `security@: admin.super` to the `access` field in `system/blueprints/user/group.yaml` (mirroring `account.yaml`), and/or enforce a super-only strip on group ACL saves in core so all callers are covered.\n\n---\nReported by **zx (Jace)** \u2014 GitHub: @manus-use",
"id": "GHSA-xhfv-7758-r9hx",
"modified": "2026-09-17T20:45:15Z",
"published": "2026-09-17T20:45:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-xhfv-7758-r9hx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75837"
},
{
"type": "PACKAGE",
"url": "https://github.com/getgrav/grav"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/grav-before-privilege-escalation-via-group-access-field"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin"
}
GHSA-XHGW-HF2Q-C493
Vulnerability from github – Published: 2024-11-16 06:30 – Updated: 2024-11-16 06:30The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() function in all versions up to, and including, 5.61.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and import or check on the status.
{
"affected": [],
"aliases": [
"CVE-2024-10614"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-16T06:15:07Z",
"severity": "MODERATE"
},
"details": "The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the cancel_import() function in all versions up to, and including, 5.61.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and import or check on the status.",
"id": "GHSA-xhgw-hf2q-c493",
"modified": "2024-11-16T06:30:41Z",
"published": "2024-11-16T06:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10614"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3188169/customer-reviews-woocommerce/trunk/includes/import-export/class-cr-reviews-importer.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e27224aa-56c4-49ab-b9b3-b431b38e126e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XHGX-7R6H-X8HF
Vulnerability from github – Published: 2024-04-07 09:30 – Updated: 2024-11-14 21:31Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
{
"affected": [],
"aliases": [
"CVE-2023-52713"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-07T09:15:08Z",
"severity": "HIGH"
},
"details": "Vulnerability of improper permission control in the window management module.\nImpact: Successful exploitation of this vulnerability will affect availability and confidentiality.",
"id": "GHSA-xhgx-7r6h-x8hf",
"modified": "2024-11-14T21:31:57Z",
"published": "2024-04-07T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52713"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2024/4"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202404-0000001880501689"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XHHM-F6HP-2QWJ
Vulnerability from github – Published: 2026-09-16 21:58 – Updated: 2026-09-16 21:58Impact
The live (WebSocket) transport authorizes a mount via check_view_auth, not Django's View.dispatch() chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method_decorator(login_required, name="dispatch"), and custom dispatch() guards — and the djust admin extension's staff gate (applied only in the HTTP as_view wrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view — including admin list/create/change/delete — and dispatch its handlers.
Patches
Fixed in djust 1.0.7. check_view_auth now honors the Django AccessMixin family on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-dispatch forms); and the admin base mixin declares login_required = True + an active-staff check_permissions gate.
Workarounds
Gate views using djust's login_required / permission_required / check_permissions attributes (honored on all transports) rather than HTTP-only mixins/decorators.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "djust"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61594"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-16T21:58:05Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Impact\nThe live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django\u0027s `View.dispatch()` chain. As a result, standard Django authorization \u2014 `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name=\"dispatch\")`, and custom `dispatch()` guards \u2014 **and** the djust admin extension\u0027s staff gate (applied only in the HTTP `as_view` wrapper) were enforced on the initial HTTP GET but **silently bypassed over WebSocket**, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view \u2014 including admin list/create/change/delete \u2014 and dispatch its handlers.\n\n### Patches\nFixed in **djust 1.0.7**. `check_view_auth` now honors the Django `AccessMixin` family on every transport; a new system check **S004** fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-`dispatch` forms); and the admin base mixin declares `login_required = True` + an active-staff `check_permissions` gate.\n\n### Workarounds\nGate views using djust\u0027s `login_required` / `permission_required` / `check_permissions` attributes (honored on all transports) rather than HTTP-only mixins/decorators.",
"id": "GHSA-xhhm-f6hp-2qwj",
"modified": "2026-09-16T21:58:05Z",
"published": "2026-09-16T21:58:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj"
},
{
"type": "PACKAGE",
"url": "https://github.com/djust-org/djust"
},
{
"type": "WEB",
"url": "https://github.com/djust-org/djust/releases/tag/v1.0.7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "djust has an authorization bypass on the WebSocket/SSE mount path"
}
GHSA-XHJ8-26HF-X47J
Vulnerability from github – Published: 2025-04-17 18:31 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in jidaikobo Dashi allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dashi: from n/a through 3.1.8.
{
"affected": [],
"aliases": [
"CVE-2025-39580"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-17T16:15:58Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in jidaikobo Dashi allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dashi: from n/a through 3.1.8.",
"id": "GHSA-xhj8-26hf-x47j",
"modified": "2026-04-01T18:34:53Z",
"published": "2025-04-17T18:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39580"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/dashi/vulnerability/wordpress-dashi-3-1-8-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XHJQ-XWVJ-GXM6
Vulnerability from github – Published: 2025-12-08 18:30 – Updated: 2025-12-08 21:30In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2025-32319"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-08T17:16:13Z",
"severity": "MODERATE"
},
"details": "In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-xhjq-xwvj-gxm6",
"modified": "2025-12-08T21:30:20Z",
"published": "2025-12-08T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32319"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/70ab82c4546aa893682a4507664dc2c471d6cd95"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-12-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XHJX-58X7-8J9X
Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2022-05-13 01:46In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attacker to run arbitrary commands as root on the targeted VNX Control Station system.
{
"affected": [],
"aliases": [
"CVE-2017-4985"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-19T12:29:00Z",
"severity": "HIGH"
},
"details": "In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user may potentially escalate their privileges to root due to authorization checks not being performed on certain perl scripts. This may potentially be exploited by an attacker to run arbitrary commands as root on the targeted VNX Control Station system.",
"id": "GHSA-xhjx-58x7-8j9x",
"modified": "2022-05-13T01:46:00Z",
"published": "2022-05-13T01:46:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-4985"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/540738/30/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99037"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XHMP-23CF-GX5X
Vulnerability from github – Published: 2025-10-17 21:31 – Updated: 2025-10-18 00:31The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.
{
"affected": [],
"aliases": [
"CVE-2025-62642"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-17T21:15:36Z",
"severity": "MODERATE"
},
"details": "The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an \"Anyone Can Join This Party\" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.",
"id": "GHSA-xhmp-23cf-gx5x",
"modified": "2025-10-18T00:31:00Z",
"published": "2025-10-17T21:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62642"
},
{
"type": "WEB",
"url": "https://archive.today/fMYQp"
},
{
"type": "WEB",
"url": "https://bobdahacker.com/blog/rbi-hacked-drive-thrus"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus"
},
{
"type": "WEB",
"url": "https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers"
},
{
"type": "WEB",
"url": "https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.