Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

14839 vulnerabilities reference this CWE, most recent first.

GHSA-2R48-3552-HH7M

Vulnerability from github – Published: 2025-02-01 09:30 – Updated: 2025-02-01 09:30
VLAI
Details

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending due to a missing capability check on the sendEmailToJobSeeker() function in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to send arbitrary emails with arbitrary content from the sites mail server.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-13371"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-01T08:15:08Z",
    "severity": "MODERATE"
  },
  "details": "The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized arbitrary emails sending due to a missing capability check on the sendEmailToJobSeeker() function in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to send arbitrary emails with arbitrary content from the sites mail server.",
  "id": "GHSA-2r48-3552-hh7m",
  "modified": "2025-02-01T09:30:28Z",
  "published": "2025-02-01T09:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13371"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/g1-nhantv/31b04bc057046ecc54c3552387eb7bca"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3229608/wp-job-portal/tags/2.2.7/modules/jobapply/model.php?old=3216415\u0026old_path=wp-job-portal%2Ftags%2F2.2.6%2Fmodules%2Fjobapply%2Fmodel.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a84a4c56-a44e-450d-91fc-024f8ddeedee?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2R5W-JH6G-8HFF

Vulnerability from github – Published: 2026-06-24 15:31 – Updated: 2026-06-24 15:31
VLAI
Details

A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-57304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-24T14:17:36Z",
    "severity": "MODERATE"
  },
  "details": "A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.",
  "id": "GHSA-2r5w-jh6g-8hff",
  "modified": "2026-06-24T15:31:48Z",
  "published": "2026-06-24T15:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57304"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3692%20(2)"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2R68-8X78-FFGH

Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-28 00:00
VLAI
Details

The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-23975"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-26T02:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox \u003c 86.",
  "id": "GHSA-2r68-8x78-ffgh",
  "modified": "2022-05-28T00:00:22Z",
  "published": "2022-05-24T17:43:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23975"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1685145"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202104-10"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2021-07"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2R68-G678-7QR3

Vulnerability from github – Published: 2026-06-26 21:04 – Updated: 2026-06-26 21:04
VLAI
Summary
mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call
Details

Summary

The HTTP MCP JSON-RPC endpoint at /mcp requires only OAuth read scope for all requests, then dispatches tools/call directly to handlers that include mutating tools. A read-only OAuth client can call store_memory and delete_memory through MCP even though the corresponding REST endpoints require write scope.

Technical Details

src/mcp_memory_service/web/api/mcp.py declares mcp_endpoint with user: AuthenticationResult = Depends(require_read_access). For tools/call, it extracts the requested tool name and arguments, then calls handle_tool_call(storage, tool_name, arguments) without passing the authenticated user or checking a per-tool required scope.

The MCP tool registry includes both read tools and write tools. In the same handler file, store_memory creates a Memory object and calls storage.store(...), while delete_memory calls storage.delete(content_hash). These operations are reachable with only the read scope.

The REST endpoint demonstrates the intended boundary: POST /api/memories uses Depends(require_write_access) and rejects a read-only token with 403 insufficient_scope.

Reproduction

  1. Enable OAuth and disable anonymous access.
  2. Generate a valid OAuth JWT with only scope: read.
  3. Confirm the REST write endpoint rejects it:
POST /api/memories
Authorization: Bearer <read-only-token>
Content-Type: application/json

{"content":"rest denied control"}

Expected and observed: HTTP 403 with Required scope 'write' not granted.

  1. Send the same read-only token to the MCP endpoint:
POST /mcp
Authorization: Bearer <read-only-token>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "store_memory",
    "arguments": {
      "content": "mcp read scope stored this",
      "tags": ["poc"]
    }
  }
}

Observed: HTTP 200 JSON-RPC success and the storage store sink is reached.

  1. A read-only token can also call delete_memory through MCP if it knows a content hash:
POST /mcp
Authorization: Bearer <read-only-token>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "delete_memory",
    "arguments": {"content_hash": "<known_hash>"}
  }
}

Observed: HTTP 200 JSON-RPC success and the storage delete sink is reached.

Impact

A client intended to be read-only can inject or delete memories through the MCP API. This can corrupt the memory database, influence future agent context, and destroy stored user memories without the OAuth write scope required by the REST API.

Affected Versions

Confirmed present on current main commit c99a922477df41f75a44db11182ae48a57311910 and latest release tag v10.65.0 (4eb4a62665589f9dd9f8c393afa32de434b4098a).

Suggested Fix

Enforce authorization per MCP tool at tools/call time. Require write for store_memory and delete_memory, keep read only for read-only tools, and add regression tests proving direct tools/call to mutating tools is rejected before the handler reaches storage when the caller has only read scope.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 10.65.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-memory-service"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.65.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49291"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T21:04:38Z",
    "nvd_published_at": "2026-06-19T19:16:36Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `write` scope.\n\n## Technical Details\n\n`src/mcp_memory_service/web/api/mcp.py` declares `mcp_endpoint` with `user: AuthenticationResult = Depends(require_read_access)`. For `tools/call`, it extracts the requested tool name and arguments, then calls `handle_tool_call(storage, tool_name, arguments)` without passing the authenticated user or checking a per-tool required scope.\n\nThe MCP tool registry includes both read tools and write tools. In the same handler file, `store_memory` creates a `Memory` object and calls `storage.store(...)`, while `delete_memory` calls `storage.delete(content_hash)`. These operations are reachable with only the `read` scope.\n\nThe REST endpoint demonstrates the intended boundary: `POST /api/memories` uses `Depends(require_write_access)` and rejects a read-only token with 403 `insufficient_scope`.\n\n## Reproduction\n\n1. Enable OAuth and disable anonymous access.\n2. Generate a valid OAuth JWT with only `scope: read`.\n3. Confirm the REST write endpoint rejects it:\n\n```http\nPOST /api/memories\nAuthorization: Bearer \u003cread-only-token\u003e\nContent-Type: application/json\n\n{\"content\":\"rest denied control\"}\n```\n\nExpected and observed: HTTP 403 with `Required scope \u0027write\u0027 not granted`.\n\n4. Send the same read-only token to the MCP endpoint:\n\n```http\nPOST /mcp\nAuthorization: Bearer \u003cread-only-token\u003e\nContent-Type: application/json\n\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"store_memory\",\n    \"arguments\": {\n      \"content\": \"mcp read scope stored this\",\n      \"tags\": [\"poc\"]\n    }\n  }\n}\n```\n\nObserved: HTTP 200 JSON-RPC success and the storage `store` sink is reached.\n\n5. A read-only token can also call `delete_memory` through MCP if it knows a content hash:\n\n```http\nPOST /mcp\nAuthorization: Bearer \u003cread-only-token\u003e\nContent-Type: application/json\n\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 2,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"delete_memory\",\n    \"arguments\": {\"content_hash\": \"\u003cknown_hash\u003e\"}\n  }\n}\n```\n\nObserved: HTTP 200 JSON-RPC success and the storage `delete` sink is reached.\n\n## Impact\n\nA client intended to be read-only can inject or delete memories through the MCP API. This can corrupt the memory database, influence future agent context, and destroy stored user memories without the OAuth `write` scope required by the REST API.\n\n## Affected Versions\n\nConfirmed present on current main commit `c99a922477df41f75a44db11182ae48a57311910` and latest release tag `v10.65.0` (`4eb4a62665589f9dd9f8c393afa32de434b4098a`).\n\n## Suggested Fix\n\nEnforce authorization per MCP tool at `tools/call` time. Require `write` for `store_memory` and `delete_memory`, keep `read` only for read-only tools, and add regression tests proving direct `tools/call` to mutating tools is rejected before the handler reaches storage when the caller has only `read` scope.",
  "id": "GHSA-2r68-g678-7qr3",
  "modified": "2026-06-26T21:04:38Z",
  "published": "2026-06-26T21:04:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/doobidoo/mcp-memory-service/security/advisories/GHSA-2r68-g678-7qr3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49291"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/doobidoo/mcp-memory-service"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/mcp-memory-service/10.65.3"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20260508112116/https://github.com/doobidoo/mcp-memory-service"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call"
}

GHSA-2R6X-62FV-H4Q4

Vulnerability from github – Published: 2024-07-16 09:30 – Updated: 2026-04-08 21:32
VLAI
Details

The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1937"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-16T09:15:02Z",
    "severity": "HIGH"
  },
  "details": "The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027update_item\u0027 function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript.",
  "id": "GHSA-2r6x-62fv-h4q4",
  "modified": "2026-04-08T21:32:51Z",
  "published": "2024-07-16T09:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1937"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3112878/brizy/trunk/editor/api.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5f73c3-f40b-45d5-9947-c1a514d230f7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2R7P-CCFC-8PXW

Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31
VLAI
Details

Missing Authorization vulnerability in MadrasThemes MAS Videos masvideos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAS Videos: from n/a through <= 1.3.2.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-32348"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-13T19:54:46Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in MadrasThemes MAS Videos masvideos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MAS Videos: from n/a through \u003c= 1.3.2.",
  "id": "GHSA-2r7p-ccfc-8pxw",
  "modified": "2026-03-13T21:31:48Z",
  "published": "2026-03-13T21:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32348"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/masvideos/vulnerability/wordpress-mas-videos-plugin-1-3-2-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2R9V-8Q3M-99HF

Vulnerability from github – Published: 2024-07-18 21:30 – Updated: 2024-07-18 21:30
VLAI
Details

The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, pending and private items.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-6455"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-18T21:15:02Z",
    "severity": "MODERATE"
  },
  "details": "The ElementsKit Elementor addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.2.0 due to a missing capability checks on ekit_widgetarea_content function. This makes it possible for unauthenticated attackers to view any item created in Elementor, such as posts, pages and templates including drafts, pending and private items.",
  "id": "GHSA-2r9v-8q3m-99hf",
  "modified": "2024-07-18T21:30:38Z",
  "published": "2024-07-18T21:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6455"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/elementskit-lite/tags/3.2.0/modules/controls/widget-area-utils.php#L15"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c336530-09b2-4ead-923f-f1a6266e3e8e?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2RGJ-5HR4-V9VP

Vulnerability from github – Published: 2025-05-23 15:31 – Updated: 2026-04-28 21:35
VLAI
Details

Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Path Traversal. This issue affects 6Storage Rentals: from n/a through 2.19.4.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-47619"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-23T13:15:41Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in 6Storage 6Storage Rentals allows Path Traversal. This issue affects 6Storage Rentals: from n/a through 2.19.4.",
  "id": "GHSA-2rgj-5hr4-v9vp",
  "modified": "2026-04-28T21:35:39Z",
  "published": "2025-05-23T15:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47619"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/6storage-rentals/vulnerability/wordpress-6storage-rentals-2-19-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2RJ3-RG6R-7HHR

Vulnerability from github – Published: 2025-12-18 09:30 – Updated: 2025-12-18 09:30
VLAI
Details

The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the wpdm_media_access AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-13498"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-18T08:15:49Z",
    "severity": "MODERATE"
  },
  "details": "The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is due to missing authorization and capability checks on the `wpdm_media_access` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve passwords and access control settings for protected media attachments, which can then be used to bypass the intended media protection and download restricted files.",
  "id": "GHSA-2rj3-rg6r-7hhr",
  "modified": "2025-12-18T09:30:24Z",
  "published": "2025-12-18T09:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13498"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L26"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L275"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.32/src/MediaLibrary/MediaAccessControl.php#L299"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3413804"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f2cdd50d-6290-4cef-a72c-2e9d680d4f1f?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2RM7-J397-3FQG

Vulnerability from github – Published: 2026-03-29 15:41 – Updated: 2026-03-29 15:41
VLAI
Summary
AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking
Details

Summary

The plugin/PlayLists/View/Playlists_schedules/add.json.php endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When the schedule executes, the rebroadcast runs under the victim playlist owner's identity, allowing content hijacking and stream disruption.

Details

The endpoint at plugin/PlayLists/View/Playlists_schedules/add.json.php performs only a capability check, not an ownership check:

// add.json.php:14 — only checks if user CAN stream, not if they OWN the playlist
if (!User::canStream()) {
    forbiddenPage(__("You cannot livestream"));
}

// Line 18-19: attacker-controlled playlists_id is used directly
$o = new Playlists_schedules(@$_POST['id']);
$o->setPlaylists_id($_POST['playlists_id']);

The Playlists_schedules::save() method (line 182) only validates that playlists_id is non-empty — no ownership check:

public function save()
{
    if(empty($this->playlists_id)){
        _error_log("Playlists_schedules::save playlists_id is empty");
        return false;
    }
    // ...
    return parent::save();
}

When the schedule triggers via plugin/PlayLists/run.php, the rebroadcast executes under the playlist owner's user ID, not the schedule creator's:

// run.php:55 — uses playlist owner's ID
$pl = new PlayList($ps->playlists_id);
$response = Rebroadcaster::rebroadcastVideo(
    $ps->current_videos_id,
    $pl->getUsers_id(),  // <-- victim's user ID
    Playlists_schedules::getPlayListScheduledIndex($value['id']),
    $title
);

By contrast, all other playlist modification endpoints properly verify ownership via PlayLists::canManagePlaylist():

// PlayLists.php:55-68
static function canManagePlaylist($playlists_id)
{
    if (!User::isLogged()) return false;
    if (self::canManageAllPlaylists()) return true;
    $pl = new PlayList($playlists_id);
    if ($pl->getUsers_id() == User::getId()) return true;
    return false;
}

This check is used in saveShowOnTV.json.php:43, playListToSerie.php:24, and getPlaylistButtons.php:34, but is entirely absent from add.json.php.

Additionally, the delete.json.php endpoint requires User::isAdmin() (line 11), making the disparity with add.json.php even clearer.

When providing an existing schedule id via POST (line 18), no ownership check is performed on the existing schedule record either, allowing modification of any schedule on the platform.

PoC

# Step 1: Authenticate as a normal user with streaming permission
# Obtain PHPSESSID via login

# Step 2: Create a broadcast schedule targeting another user's playlist
# Replace VICTIM_PLAYLIST_ID with the target playlist ID (enumerable via API)
curl -X POST 'https://target.com/plugin/PlayLists/View/Playlists_schedules/add.json.php' \
  -H 'Cookie: PHPSESSID=<attacker_session>' \
  -d 'playlists_id=<VICTIM_PLAYLIST_ID>&name=hijacked&start_datetime=2026-03-26+12:00:00&finish_datetime=2026-03-27+12:00:00&loop=1&repeat=d&parameters={}'

# Expected: {"error":false} — schedule created for victim's playlist
# The schedule will execute via run.php under the victim's user identity

# Step 3: Modify an existing schedule by providing its id
curl -X POST 'https://target.com/plugin/PlayLists/View/Playlists_schedules/add.json.php' \
  -H 'Cookie: PHPSESSID=<attacker_session>' \
  -d 'id=<EXISTING_SCHEDULE_ID>&playlists_id=<VICTIM_PLAYLIST_ID>&name=modified&start_datetime=2026-03-26+00:00:00&finish_datetime=2026-03-28+00:00:00&loop=1&repeat=d&parameters={}'

Impact

  • Content hijacking: Attacker can force-broadcast content from any user's playlist, including private or paid content
  • Stream disruption: Scheduled rebroadcast can interfere with a victim's ongoing live streams
  • Identity abuse: Rebroadcast executes under the victim's user identity, making it appear the victim initiated the broadcast
  • Resource consumption: Scheduled broadcasts consume the victim's server bandwidth allocation
  • Schedule tampering: Existing schedules can be modified or redirected by any streaming user

Recommended Fix

Add ownership validation in add.json.php before saving:

// After line 16 (canStream check), add:
$playlists_id = intval($_POST['playlists_id']);
if (!PlayLists::canManagePlaylist($playlists_id)) {
    forbiddenPage(__("You cannot manage this playlist"));
}

// When editing existing schedules, also verify ownership of the existing record:
if (!empty($_POST['id'])) {
    $existing = new Playlists_schedules(intval($_POST['id']));
    if (!PlayLists::canManagePlaylist($existing->getPlaylists_id())) {
        forbiddenPage(__("You cannot modify this schedule"));
    }
}
Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34245"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:41:33Z",
    "nvd_published_at": "2026-03-27T17:16:30Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `plugin/PlayLists/View/Playlists_schedules/add.json.php` endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When the schedule executes, the rebroadcast runs under the victim playlist owner\u0027s identity, allowing content hijacking and stream disruption.\n\n## Details\n\nThe endpoint at `plugin/PlayLists/View/Playlists_schedules/add.json.php` performs only a capability check, not an ownership check:\n\n```php\n// add.json.php:14 \u2014 only checks if user CAN stream, not if they OWN the playlist\nif (!User::canStream()) {\n    forbiddenPage(__(\"You cannot livestream\"));\n}\n\n// Line 18-19: attacker-controlled playlists_id is used directly\n$o = new Playlists_schedules(@$_POST[\u0027id\u0027]);\n$o-\u003esetPlaylists_id($_POST[\u0027playlists_id\u0027]);\n```\n\nThe `Playlists_schedules::save()` method (line 182) only validates that `playlists_id` is non-empty \u2014 no ownership check:\n\n```php\npublic function save()\n{\n    if(empty($this-\u003eplaylists_id)){\n        _error_log(\"Playlists_schedules::save playlists_id is empty\");\n        return false;\n    }\n    // ...\n    return parent::save();\n}\n```\n\nWhen the schedule triggers via `plugin/PlayLists/run.php`, the rebroadcast executes under the **playlist owner\u0027s** user ID, not the schedule creator\u0027s:\n\n```php\n// run.php:55 \u2014 uses playlist owner\u0027s ID\n$pl = new PlayList($ps-\u003eplaylists_id);\n$response = Rebroadcaster::rebroadcastVideo(\n    $ps-\u003ecurrent_videos_id,\n    $pl-\u003egetUsers_id(),  // \u003c-- victim\u0027s user ID\n    Playlists_schedules::getPlayListScheduledIndex($value[\u0027id\u0027]),\n    $title\n);\n```\n\nBy contrast, all other playlist modification endpoints properly verify ownership via `PlayLists::canManagePlaylist()`:\n\n```php\n// PlayLists.php:55-68\nstatic function canManagePlaylist($playlists_id)\n{\n    if (!User::isLogged()) return false;\n    if (self::canManageAllPlaylists()) return true;\n    $pl = new PlayList($playlists_id);\n    if ($pl-\u003egetUsers_id() == User::getId()) return true;\n    return false;\n}\n```\n\nThis check is used in `saveShowOnTV.json.php:43`, `playListToSerie.php:24`, and `getPlaylistButtons.php:34`, but is entirely absent from `add.json.php`.\n\nAdditionally, the `delete.json.php` endpoint requires `User::isAdmin()` (line 11), making the disparity with `add.json.php` even clearer.\n\nWhen providing an existing schedule `id` via POST (line 18), no ownership check is performed on the existing schedule record either, allowing modification of any schedule on the platform.\n\n## PoC\n\n```bash\n# Step 1: Authenticate as a normal user with streaming permission\n# Obtain PHPSESSID via login\n\n# Step 2: Create a broadcast schedule targeting another user\u0027s playlist\n# Replace VICTIM_PLAYLIST_ID with the target playlist ID (enumerable via API)\ncurl -X POST \u0027https://target.com/plugin/PlayLists/View/Playlists_schedules/add.json.php\u0027 \\\n  -H \u0027Cookie: PHPSESSID=\u003cattacker_session\u003e\u0027 \\\n  -d \u0027playlists_id=\u003cVICTIM_PLAYLIST_ID\u003e\u0026name=hijacked\u0026start_datetime=2026-03-26+12:00:00\u0026finish_datetime=2026-03-27+12:00:00\u0026loop=1\u0026repeat=d\u0026parameters={}\u0027\n\n# Expected: {\"error\":false} \u2014 schedule created for victim\u0027s playlist\n# The schedule will execute via run.php under the victim\u0027s user identity\n\n# Step 3: Modify an existing schedule by providing its id\ncurl -X POST \u0027https://target.com/plugin/PlayLists/View/Playlists_schedules/add.json.php\u0027 \\\n  -H \u0027Cookie: PHPSESSID=\u003cattacker_session\u003e\u0027 \\\n  -d \u0027id=\u003cEXISTING_SCHEDULE_ID\u003e\u0026playlists_id=\u003cVICTIM_PLAYLIST_ID\u003e\u0026name=modified\u0026start_datetime=2026-03-26+00:00:00\u0026finish_datetime=2026-03-28+00:00:00\u0026loop=1\u0026repeat=d\u0026parameters={}\u0027\n```\n\n## Impact\n\n- **Content hijacking:** Attacker can force-broadcast content from any user\u0027s playlist, including private or paid content\n- **Stream disruption:** Scheduled rebroadcast can interfere with a victim\u0027s ongoing live streams\n- **Identity abuse:** Rebroadcast executes under the victim\u0027s user identity, making it appear the victim initiated the broadcast\n- **Resource consumption:** Scheduled broadcasts consume the victim\u0027s server bandwidth allocation\n- **Schedule tampering:** Existing schedules can be modified or redirected by any streaming user\n\n## Recommended Fix\n\nAdd ownership validation in `add.json.php` before saving:\n\n```php\n// After line 16 (canStream check), add:\n$playlists_id = intval($_POST[\u0027playlists_id\u0027]);\nif (!PlayLists::canManagePlaylist($playlists_id)) {\n    forbiddenPage(__(\"You cannot manage this playlist\"));\n}\n\n// When editing existing schedules, also verify ownership of the existing record:\nif (!empty($_POST[\u0027id\u0027])) {\n    $existing = new Playlists_schedules(intval($_POST[\u0027id\u0027]));\n    if (!PlayLists::canManagePlaylist($existing-\u003egetPlaylists_id())) {\n        forbiddenPage(__(\"You cannot modify this schedule\"));\n    }\n}\n```",
  "id": "GHSA-2rm7-j397-3fqg",
  "modified": "2026-03-29T15:41:33Z",
  "published": "2026-03-29T15:41:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-2rm7-j397-3fqg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34245"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/1e6dc20172de986f60641eb4fdb4090f079ffdce"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo: Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list