CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14880 vulnerabilities reference this CWE, most recent first.
GHSA-39J6-JJVV-95WR
Vulnerability from github – Published: 2025-07-03 15:31 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in Melapress Melapress File Monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a before 2.2.0.
{
"affected": [],
"aliases": [
"CVE-2025-3702"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-03T13:15:28Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Melapress Melapress File Monitor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress File Monitor: from n/a before 2.2.0.",
"id": "GHSA-39j6-jjvv-95wr",
"modified": "2026-04-01T18:35:39Z",
"published": "2025-07-03T15:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3702"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/website-file-changes-monitor/vulnerability/wordpress-melapress-file-monitor-plugin-2-2-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-39M2-GJ89-X393
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2026-06-22 21:30An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.
{
"affected": [],
"aliases": [
"CVE-2020-15412"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-30T14:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form.",
"id": "GHSA-39m2-gj89-x393",
"modified": "2026-06-22T21:30:42Z",
"published": "2022-05-24T17:22:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15412"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/b0be3b07fee2ab9bf1869ef81a7f24f58bd687ef"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-39MM-CQH8-5C5J
Vulnerability from github – Published: 2025-11-10 15:31 – Updated: 2025-11-20 21:30In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
{
"affected": [],
"aliases": [
"CVE-2025-64681"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-10T14:15:43Z",
"severity": "LOW"
},
"details": "In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations",
"id": "GHSA-39mm-cqh8-5c5j",
"modified": "2025-11-20T21:30:31Z",
"published": "2025-11-10T15:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64681"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-39MP-545Q-W789
Vulnerability from github – Published: 2026-03-30 19:06 – Updated: 2026-04-10 19:45Fixed in OpenClaw 2026.3.24, the current shipping release.
Title
Non-owner command-authorized sender can change the owner-only /send session delivery policy
CWE
CWE-285 Improper Authorization
CVSS v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Base score: 5.4 (Medium)
Severity Assessment
Medium. This is a real owner-only authorization bypass, but the demonstrated impact is limited to persistent mutation of the current session’s delivery policy rather than direct code execution, sandbox escape, or cross-host compromise.
Impact
A non-owner sender who is allowed to run commands can invoke /send on|off|inherit and persistently change the current session’s sendPolicy, even though OpenClaw documents /send as owner-only.
That lets a lower-trust participant:
- disable reply delivery for the current session (/send off), suppressing future replies in that chat;
- re-enable reply delivery (/send on) after the owner intentionally disabled it;
- remove the session override (/send inherit).
Affected Component
Verified against the latest published GitHub release tag v2026.3.23 (ccfeecb6887cd97937e33a71877ad512741e82b2), published 2026-03-23T23:15:50Z.
Exact vulnerable path on the shipped tag:
- src/auto-reply/reply/commands-session.ts:212-239
- handleSendPolicyCommand(...) checks only params.command.isAuthorizedSender.
- when true, it mutates params.sessionEntry.sendPolicy and persists the session entry.
Authorization behavior that makes this reachable:
- src/auto-reply/command-auth.ts:401-407
- senderIsOwner is computed separately from general command authorization.
- src/auto-reply/command-auth.ts:420-429
- command authorization can succeed even when senderIsOwner === false.
- src/auto-reply/command-auth.owner-default.test.ts:10-47
- existing coverage confirms a sender can be command-authorized while not treated as owner.
Documented owner-only contract:
- docs/tools/slash-commands.md:112
- /send on|off|inherit is documented as owner-only.
- docs/concepts/session-tool.md:156
- sendPolicy is documented as settable via sessions.patch or owner-only /send on|off|inherit.
Related privilege model:
- src/gateway/method-scopes.ts:131-133
- sessions.patch is admin-scoped, which reinforces that session-delivery-policy mutation is treated as privileged state.
Version history:
- The vulnerable handler exists in release history going back at least to commit ea018a68ccb92dbc735bc1df9880d5c95c63ca35 (refactor(auto-reply): split reply pipeline).
- Earliest released affected tag found: v2026.1.14-1
- Latest released affected tag verified: v2026.3.23
Technical Reproduction
1. Check out the shipped release tag v2026.3.23.
2. Configure a channel where:
- a non-owner sender is allowed to run commands, for example through commands.allowFrom;
- the owner identity is distinct, for example via commands.ownerAllowFrom.
3. Start or reuse a session with a live sessionEntry and sessionStore.
4. Send /send off as the non-owner but command-authorized sender.
5. Confirm the resolved command context has:
- isAuthorizedSender === true
- senderIsOwner === false
6. Observe that the handler still accepts the command, mutates sessionEntry.sendPolicy, and persists the session entry.
Demonstrated Impact
The vulnerable handler performs a real persistent session-state change:
- src/auto-reply/reply/commands-session.ts:232-238
- /send inherit deletes sessionEntry.sendPolicy
- other modes assign sessionEntry.sendPolicy = sendPolicyCommand.mode
- the handler then calls persistSessionEntry(params)
The mutation is not gated by owner status, only by general command authorization.
That changes subsequent delivery behavior for the current session, which matches the documented meaning of sendPolicy.
Environment
- Product: OpenClaw
- Verified shipped tag: v2026.3.23
- Shipped tag commit: ccfeecb6887cd97937e33a71877ad512741e82b2
- Published GitHub release time: 2026-03-23T23:15:50Z
- Verification date: 2026-03-24
Duplicate Check
Upon inspection there is no preexisting GHSA for /send.
This is distinct from:
- GHSA-r7vr-gr74-94p8
- that advisory covered owner-only authorization bypasses for /config and /debug, not /send.
This is the same authorization class, but a different privileged command surface that still lacks the owner check.
In Scope Check
This report is in scope under SECURITY.md because:
- it does not rely on adversarial operators sharing one gateway host or config;
- it does not rely on trusted local state tampering;
- SECURITY.md:151-152 explicitly says non-owner sender status matters for owner-only tools and commands;
- /send is explicitly documented as owner-only, so this is a direct owner-only authorization bypass, not a complaint about normal shared-agent steering.
This is therefore a concrete authorization flaw against a documented product boundary.
Remediation Advice
1. Change /send to require owner status, not just command authorization.
2. Reuse the same owner-only rejection pattern already used by privileged command surfaces such as /config, /debug, and owner-only /plugins writes.
3. Add regression coverage for the exact case where:
- a non-owner sender is command-authorized;
- /send must still be rejected unless senderIsOwner === true.
4. Verify that the owner can still use /send on|off|inherit normally.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.24"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35620"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-30T19:06:22Z",
"nvd_published_at": "2026-04-10T17:17:04Z",
"severity": "MODERATE"
},
"details": "\u003e Fixed in OpenClaw 2026.3.24, the current shipping release.\n\n**Title** \nNon-owner command-authorized sender can change the owner-only `/send` session delivery policy\n\n**CWE** \nCWE-285 Improper Authorization\n\n**CVSS v3.1** \nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L \nBase score: **5.4 (Medium)**\n\n**Severity Assessment** \nMedium. This is a real owner-only authorization bypass, but the demonstrated impact is limited to persistent mutation of the current session\u2019s delivery policy rather than direct code execution, sandbox escape, or cross-host compromise.\n\n**Impact** \nA non-owner sender who is allowed to run commands can invoke `/send on|off|inherit` and persistently change the current session\u2019s `sendPolicy`, even though OpenClaw documents `/send` as owner-only.\n\nThat lets a lower-trust participant:\n- disable reply delivery for the current session (`/send off`), suppressing future replies in that chat;\n- re-enable reply delivery (`/send on`) after the owner intentionally disabled it;\n- remove the session override (`/send inherit`).\n\n**Affected Component** \nVerified against the latest published GitHub release tag `v2026.3.23` (`ccfeecb6887cd97937e33a71877ad512741e82b2`), published `2026-03-23T23:15:50Z`.\n\nExact vulnerable path on the shipped tag:\n- `src/auto-reply/reply/commands-session.ts:212-239`\n - `handleSendPolicyCommand(...)` checks only `params.command.isAuthorizedSender`.\n - when true, it mutates `params.sessionEntry.sendPolicy` and persists the session entry.\n\nAuthorization behavior that makes this reachable:\n- `src/auto-reply/command-auth.ts:401-407`\n - `senderIsOwner` is computed separately from general command authorization.\n- `src/auto-reply/command-auth.ts:420-429`\n - command authorization can succeed even when `senderIsOwner === false`.\n- `src/auto-reply/command-auth.owner-default.test.ts:10-47`\n - existing coverage confirms a sender can be command-authorized while not treated as owner.\n\nDocumented owner-only contract:\n- `docs/tools/slash-commands.md:112`\n - `/send on|off|inherit` is documented as owner-only.\n- `docs/concepts/session-tool.md:156`\n - `sendPolicy` is documented as settable via `sessions.patch` or owner-only `/send on|off|inherit`.\n\nRelated privilege model:\n- `src/gateway/method-scopes.ts:131-133`\n - `sessions.patch` is admin-scoped, which reinforces that session-delivery-policy mutation is treated as privileged state.\n\nVersion history:\n- The vulnerable handler exists in release history going back at least to commit `ea018a68ccb92dbc735bc1df9880d5c95c63ca35` (`refactor(auto-reply): split reply pipeline`).\n- Earliest released affected tag found: `v2026.1.14-1`\n- Latest released affected tag verified: `v2026.3.23`\n\n**Technical Reproduction** \n1. Check out the shipped release tag `v2026.3.23`.\n2. Configure a channel where:\n - a non-owner sender is allowed to run commands, for example through `commands.allowFrom`;\n - the owner identity is distinct, for example via `commands.ownerAllowFrom`.\n3. Start or reuse a session with a live `sessionEntry` and `sessionStore`.\n4. Send `/send off` as the non-owner but command-authorized sender.\n5. Confirm the resolved command context has:\n - `isAuthorizedSender === true`\n - `senderIsOwner === false`\n6. Observe that the handler still accepts the command, mutates `sessionEntry.sendPolicy`, and persists the session entry.\n\n**Demonstrated Impact** \nThe vulnerable handler performs a real persistent session-state change:\n- `src/auto-reply/reply/commands-session.ts:232-238`\n - `/send inherit` deletes `sessionEntry.sendPolicy`\n - other modes assign `sessionEntry.sendPolicy = sendPolicyCommand.mode`\n - the handler then calls `persistSessionEntry(params)`\n\nThe mutation is not gated by owner status, only by general command authorization.\n\nThat changes subsequent delivery behavior for the current session, which matches the documented meaning of `sendPolicy`.\n\n**Environment** \n- Product: OpenClaw\n- Verified shipped tag: `v2026.3.23`\n- Shipped tag commit: `ccfeecb6887cd97937e33a71877ad512741e82b2`\n- Published GitHub release time: `2026-03-23T23:15:50Z`\n- Verification date: `2026-03-24`\n\n**Duplicate Check** \nUpon inspection there is no preexisting GHSA for `/send`.\n\nThis is distinct from:\n- `GHSA-r7vr-gr74-94p8`\n - that advisory covered owner-only authorization bypasses for `/config` and `/debug`, not `/send`.\n\nThis is the same authorization class, but a different privileged command surface that still lacks the owner check.\n\n**In Scope Check** \nThis report is in scope under `SECURITY.md` because:\n- it does **not** rely on adversarial operators sharing one gateway host or config;\n- it does **not** rely on trusted local state tampering;\n- `SECURITY.md:151-152` explicitly says non-owner sender status matters for owner-only tools and commands;\n- `/send` is explicitly documented as owner-only, so this is a direct owner-only authorization bypass, not a complaint about normal shared-agent steering.\n\nThis is therefore a concrete authorization flaw against a documented product boundary.\n\n**Remediation Advice** \n1. Change `/send` to require owner status, not just command authorization.\n2. Reuse the same owner-only rejection pattern already used by privileged command surfaces such as `/config`, `/debug`, and owner-only `/plugins` writes.\n3. Add regression coverage for the exact case where:\n - a non-owner sender is command-authorized;\n - `/send` must still be rejected unless `senderIsOwner === true`.\n4. Verify that the owner can still use `/send on|off|inherit` normally.",
"id": "GHSA-39mp-545q-w789",
"modified": "2026-04-10T19:45:32Z",
"published": "2026-03-30T19:06:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-39mp-545q-w789"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-vqvg-86cc-cg83"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35620"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/555b2578a8cc6e1b93f717496935ead97bfbed8b"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/ea018a68ccb92dbc735bc1df9880d5c95c63ca35"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-missing-authorization-in-send-and-allowlist-chat-commands"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Non-owner command-authorized sender can change the owner-only `/send` session delivery policy"
}
GHSA-39PR-GWJ2-95P4
Vulnerability from github – Published: 2025-04-01 15:31 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in Magnigenie RestroPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RestroPress: from n/a through 3.1.8.4.
{
"affected": [],
"aliases": [
"CVE-2025-31877"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T15:16:30Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Magnigenie RestroPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RestroPress: from n/a through 3.1.8.4.",
"id": "GHSA-39pr-gwj2-95p4",
"modified": "2026-04-01T18:34:24Z",
"published": "2025-04-01T15:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31877"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/restropress/vulnerability/wordpress-restropress-plugin-3-1-8-4-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-39R6-8M72-V2P6
Vulnerability from github – Published: 2023-09-04 03:30 – Updated: 2024-04-04 07:23In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
{
"affected": [],
"aliases": [
"CVE-2023-38447"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-04T02:15:09Z",
"severity": "MODERATE"
},
"details": "In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges",
"id": "GHSA-39r6-8m72-v2p6",
"modified": "2024-04-04T07:23:30Z",
"published": "2023-09-04T03:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38447"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1698296481653522434"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-39VQ-49QM-R2MC
Vulnerability from github – Published: 2026-05-27 17:23 – Updated: 2026-05-27 17:23TL;DR
This vulnerability affects all Kirby sites that restrict the visibility of users for certain roles via the users.access or users.list permissions. A site is affected if users of a particular role are not allowed to see other users in the Panel, for example because the role's blueprint sets users.access: false or users.list: false as permission for the authenticated user role and/or as option for the target user role.
A Kirby site is not affected if all authenticated Panel users are permitted to access and list other users. The vulnerability can only be exploited by authenticated users.
Introduction
Missing authorization allows authenticated users to gain access to information they are not intended to see.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Affected components
Kirby's user permissions control which user role is allowed to perform specific actions or access specific information in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). The users.access and users.list permissions control whether users of a given role are allowed to access and list other users in the Panel. It is also possible to customize the permissions for each target role using the options feature. The permissions and options together control the authorization of user actions.
Kirby's Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user's identity in the Panel UI so other users know who to contact. Internally, the locking user's email address and identifier are included in every Panel view payload and in error responses returned when a user attempts to edit a model that is currently locked by another user.
Impact
In affected releases, this lock information was returned without checking whether the requesting user had permission to access or list the locking user.
This allowed a low-privilege authenticated Panel user, whose role was configured with users.access: false or users.list: false, to learn the email address and identifier of any user who currently had a model open for editing in the Panel, including administrators and other higher-privilege users. Content locks are active for a configurable window (10 minutes by default).
The email address can allow to enumerate admin accounts, target phishing, and feed credential-stuffing attacks against the Kirby installation or other sites.
The internal user ID can be cross-referenced with other endpoints once the requester has obtained a higher privilege through unrelated means.
Patches
The problem has been patched in Kirby 4.9.1 and Kirby 5.4.1. Please update to one of these or a later version to fix the vulnerability.
In the mentioned releases, the lock information is now filtered based on the requesting user's permissions. The identity of the locking user is hidden when the requesting user does not have permission to access or list that user.
Credits
Kirby thanks Matteo Panzeri (@matte1782) for responsibly reporting the identified issue.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.9.0"
},
"package": {
"ecosystem": "Packagist",
"name": "getkirby/cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.4.0"
},
"package": {
"ecosystem": "Packagist",
"name": "getkirby/cms"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45334"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-27T17:23:31Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### TL;DR\n\nThis vulnerability affects all Kirby sites that restrict the visibility of users for certain roles via the `users.access` or `users.list` permissions. A site is affected if users of a particular role are not allowed to see other users in the Panel, for example because the role\u0027s blueprint sets `users.access: false` or `users.list: false` as permission for the authenticated user role and/or as option for the target user role.\n\nA Kirby site is *not* affected if all authenticated Panel users are permitted to access and list other users. The vulnerability can only be exploited by authenticated users.\n\n---\n\n### Introduction\n\nMissing authorization allows authenticated users to gain access to information they are not intended to see.\n\nThe effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.\n\n### Affected components\n\nKirby\u0027s user permissions control which user role is allowed to perform specific actions or access specific information in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). The `users.access` and `users.list` permissions control whether users of a given role are allowed to access and list other users in the Panel. It is also possible to customize the permissions for each target role using the `options` feature. The permissions and options together control the authorization of user actions.\n\nKirby\u0027s Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user\u0027s identity in the Panel UI so other users know who to contact. Internally, the locking user\u0027s email address and identifier are included in every Panel view payload and in error responses returned when a user attempts to edit a model that is currently locked by another user.\n\n### Impact\n\nIn affected releases, this lock information was returned without checking whether the requesting user had permission to access or list the locking user.\n\nThis allowed a low-privilege authenticated Panel user, whose role was configured with `users.access: false` or `users.list: false`, to learn the email address and identifier of any user who currently had a model open for editing in the Panel, including administrators and other higher-privilege users. Content locks are active for a configurable window (10 minutes by default).\n\nThe email address can allow to enumerate admin accounts, target phishing, and feed credential-stuffing attacks against the Kirby installation or other sites.\n\nThe internal user ID can be cross-referenced with other endpoints once the requester has obtained a higher privilege through unrelated means.\n\n### Patches\n\nThe problem has been patched in [Kirby 4.9.1](https://github.com/getkirby/kirby/releases/tag/4.9.1) and [Kirby 5.4.1](https://github.com/getkirby/kirby/releases/tag/5.4.1). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn the mentioned releases, the lock information is now filtered based on the requesting user\u0027s permissions. The identity of the locking user is hidden when the requesting user does not have permission to access or list that user.\n\n### Credits\n\nKirby thanks Matteo Panzeri (@matte1782) for responsibly reporting the identified issue.",
"id": "GHSA-39vq-49qm-r2mc",
"modified": "2026-05-27T17:23:31Z",
"published": "2026-05-27T17:23:31Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-39vq-49qm-r2mc"
},
{
"type": "PACKAGE",
"url": "https://github.com/getkirby/kirby"
},
{
"type": "WEB",
"url": "https://github.com/getkirby/kirby/releases/tag/4.9.1"
},
{
"type": "WEB",
"url": "https://github.com/getkirby/kirby/releases/tag/5.4.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Kirby CMS\u0027s content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions"
}
GHSA-39W7-8JG8-8VMP
Vulnerability from github – Published: 2025-09-22 21:30 – Updated: 2026-04-01 18:36Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Text To Speech TTS Accessibility: from n/a through 1.9.20.
{
"affected": [],
"aliases": [
"CVE-2025-58664"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-22T19:16:17Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Azizul Hasan Text To Speech TTS Accessibility allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Text To Speech TTS Accessibility: from n/a through 1.9.20.",
"id": "GHSA-39w7-8jg8-8vmp",
"modified": "2026-04-01T18:36:17Z",
"published": "2025-09-22T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-58664"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/text-to-audio/vulnerability/wordpress-text-to-speech-tts-accessibility-plugin-1-9-20-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-39WC-CQ75-X375
Vulnerability from github – Published: 2024-12-16 15:31 – Updated: 2026-04-01 18:32Missing Authorization vulnerability in Quietly Quietly Insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through 1.2.2.
{
"affected": [],
"aliases": [
"CVE-2024-54378"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-16T15:15:11Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in Quietly Quietly Insights allows Privilege Escalation.This issue affects Quietly Insights: from n/a through 1.2.2.",
"id": "GHSA-39wc-cq75-x375",
"modified": "2026-04-01T18:32:49Z",
"published": "2024-12-16T15:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54378"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/quietly-insights/vulnerability/wordpress-quietly-insights-plugin-1-2-2-arbitrary-option-update-to-privilege-escalation-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3C2H-WQWF-4HJQ
Vulnerability from github – Published: 2025-06-27 15:31 – Updated: 2026-04-01 18:35Missing Authorization vulnerability in iCount iCount Payment Gateway allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects iCount Payment Gateway: from n/a through 2.0.6.
{
"affected": [],
"aliases": [
"CVE-2025-53295"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-27T14:15:51Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in iCount iCount Payment Gateway allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects iCount Payment Gateway: from n/a through 2.0.6.",
"id": "GHSA-3c2h-wqwf-4hjq",
"modified": "2026-04-01T18:35:37Z",
"published": "2025-06-27T15:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53295"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/icount/vulnerability/wordpress-icount-payment-gateway-plugin-2-0-6-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.