CWE-284

{
  "affected": [],
  "aliases": [
    "CVE-2026-20789"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T17:17:53Z",
    "severity": "HIGH"
  },
  "details": "Improper access control for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (low) and availability (low) impacts.",
  "id": "GHSA-vxqh-p2vp-g97f",
  "modified": "2026-08-11T18:30:53Z",
  "published": "2026-08-11T18:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20789"
    },
    {
      "type": "WEB",
      "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01422.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-50342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T17:17:00Z",
    "severity": "HIGH"
  },
  "details": "Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-vxv7-4qqv-8vf6",
  "modified": "2026-07-14T18:32:04Z",
  "published": "2026-07-14T18:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50342"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50342"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-61307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T21:16:59Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise CC Common Application Objects. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-vxwc-f926-28q5",
  "modified": "2026-08-18T21:32:19Z",
  "published": "2026-08-18T21:32:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61307"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-60632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-21T22:18:03Z",
    "severity": "CRITICAL"
  },
  "details": "Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).",
  "id": "GHSA-vxxc-4qhp-w85f",
  "modified": "2026-07-22T00:31:52Z",
  "published": "2026-07-22T00:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60632"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openfga/openfga"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.6"
            },
            {
              "fixed": "1.8.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-46331"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-30T16:43:33Z",
    "nvd_published_at": "2025-04-30T19:15:55Z",
    "severity": "MODERATE"
  },
  "details": "Overview\nOpenFGA v1.8.10 or previous (Helm chart \u003c= openfga-0.2.28, docker \u003c= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed.\n\nAm I Affected?\nIf you are using OpenFGA v1.8.10 or previous, specifically under the following conditions, you are affected by this authorization bypass vulnerability:\n- Calling Check API or ListObjects with an [authorization model](https://openfga.dev/docs/concepts#what-is-an-authorization-model) that has tuple cycle.\n- [Check query cache](https://github.com/openfga/openfga/blob/9b5974458b777707ed2a30ba6303699499e655ee/.config-schema.json#L528) is enabled, and\n- There are multiple check / list objects requests involving the tuple cycle within the check query TTL\n\nFix\nUpgrade to v1.8.11. This upgrade is backwards compatible.",
  "id": "GHSA-w222-m46c-mgh6",
  "modified": "2025-05-01T13:30:18Z",
  "published": "2025-04-30T16:43:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-w222-m46c-mgh6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46331"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/commit/244302e7a8b979d66cc1874a3899cdff7d47862f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openfga/openfga"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenFGA Authorization Bypass"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-46927"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T10:54:10Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Receivables.  Successful attacks of this vulnerability can result in takeover of Oracle Receivables. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
  "id": "GHSA-w22v-g2pc-9946",
  "modified": "2026-06-17T18:35:37Z",
  "published": "2026-06-17T18:35:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46927"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspujun2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-4273"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-266",
      "CWE-284",
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-03T09:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the file /hrm/controller/employee.php of the component Content-Type Handler. The manipulation of the argument pfimg leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214769 was assigned to this vulnerability.",
  "id": "GHSA-w23f-rm4q-vh36",
  "modified": "2022-12-06T03:30:22Z",
  "published": "2022-12-03T09:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4273"
    },
    {
      "type": "WEB",
      "url": "https://github.com/leecybersec/bug-report/tree/main/sourcecodester/oretnom23/hrm/bypass-fileupload-rce"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.214769"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-71056"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T21:18:05Z",
    "severity": "HIGH"
  },
  "details": "Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).",
  "id": "GHSA-w243-xc32-fm4x",
  "modified": "2026-08-18T21:33:50Z",
  "published": "2026-08-18T21:33:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71056"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "magicmirror"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.37.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63641"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T17:26:41Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\nMagicMirror applies `ipWhitelist` only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface but expects `ipWhitelist` to restrict access, an untrusted network client can connect directly to module Socket.IO namespaces and send arbitrary module-helper notifications. This allows unauthenticated server-side requests through default modules and can reach command execution in the default `updatenotification` helper when a third-party module update is pending and the attacker supplies the update command through the trusted socket configuration path.\n\n### Details\nThe affected product is the npm package/application `magicmirror` at version `2.36.0`, tested at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` from `https://github.com/MagicMirrorOrg/MagicMirror.git`.\n\nDefault committed settings bind to loopback and allow loopback only (`js/defaults.js:8-13`), so the remote network impact requires a documented common configuration where the server is reachable beyond loopback. The shipped sample explicitly documents non-loopback binding and IP allowlist behavior: `config/config.js.sample:11-20` says `address` may be another interface or `0.0.0.0`/`::`, and `ipWhitelist` controls allowed clients.\n\nThe trust-boundary issue is that Socket.IO is configured before and outside the Express middleware chain:\n\n- `js/server.js:42-50` creates Socket.IO directly on the HTTP(S) server with `cors.origin: /.*$/`.\n- `js/server.js:89-90` applies `ipAccessControl(config.ipWhitelist)` only with `app.use(...)`, which protects Express routes and static files but not Socket.IO handshakes or namespaces.\n- A search of runtime files found no `allowRequest`, `io.use(...)`, handshake IP check, or namespace authentication for Socket.IO; the only relevant matches were `js/server.js:44` and `js/server.js:90`.\n- `js/node_helper.js:88-103` registers every module namespace and dispatches every socket event and payload directly to `socketNotificationReceived(...)`.\n\nOnce a client can reach the Socket.IO server, the following default-module server-side actions are reachable without an equivalent IP whitelist or module-authentication check:\n\n- `defaultmodules/newsfeed/node_helper.js:12-17` accepts `CHECK_ARTICLE_URL` and calls `checkArticleUrl(payload.url)`.\n- `defaultmodules/newsfeed/node_helper.js:25-38` performs `fetch(url, { method: \"HEAD\" })` on the supplied URL and sends the result back.\n- `defaultmodules/calendar/node_helper.js:13-24` accepts `ADD_CALENDAR`/`FETCH_CALENDAR` socket messages.\n- `defaultmodules/calendar/node_helper.js:40-58` accepts an arbitrary syntactically valid calendar URL and creates a fetcher.\n- `defaultmodules/calendar/calendarfetcher.js:35-44` passes the URL into `HTTPFetcher`, whose fetch sink is `js/http_fetcher.js:286-294`.\n- `defaultmodules/updatenotification/node_helper.js:46-68` accepts `CONFIG`, `MODULES`, and `SCAN_UPDATES` notifications and trusts the socket-provided config/module list.\n- `defaultmodules/updatenotification/update_helper.js:43-47` stores update commands from config.\n- `defaultmodules/updatenotification/update_helper.js:96-116` executes the selected update command with `child_process.exec` in the module directory.\n- `defaultmodules/updatenotification/update_helper.js:221-227` looks up the command from `config.updates` by module name.\n\nFalse-positive screening performed:\n\n- Express HTTP routes are protected by `ipAccessControl(config.ipWhitelist)` at `js/server.js:89-90`; this does not protect Socket.IO because Socket.IO is attached to the raw HTTP server and no Socket.IO middleware was found.\n- The explicit `/cors` HTTP endpoint has separate SSRF mitigations (`js/server_functions.js:47-117`) and is disabled by default (`js/defaults.js:14`); the confirmed request primitive here uses module-helper socket paths, not `/cors`.\n- The command-execution variant is not an unconditional default RCE: `updatenotification` only executes an update command for a non-core git-managed module that is considered behind. However, the trusted command source is attacker-controlled through the unauthenticated socket `CONFIG` message once this boundary is crossed.\n- Default loopback-only binding lowers default remote exposure, but the sample configuration documents exactly the deployment model where users rely on `ipWhitelist` for network restrictions.\n\nAffected-version evidence: only `magicmirror@2.36.0` at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8` was tested. The affected range is unknown from this audit; earlier versions were not tested. No patched version or fix commit was identified locally.\n\n### PoC\nThe following safe local PoCs were run from a clean checkout of MagicMirror at commit `fb41d24ef522e91e802e2a623ff6afbddeb3c9d8`. Because `node_modules` were not installed in this audit environment and `package.json:52` has a destructive `postinstall` (`git clean -df fonts vendor modules/default`), the commands use small Node harnesses with stubs for missing dependencies while exercising the vulnerable repository code paths directly. They do not contact external hosts and write only disposable `/tmp` marker files.\n\n1. Confirm that the runtime lacks Socket.IO IP allowlist controls:\n\n```bash\ngrep -RIn --exclude-dir=node_modules --exclude-dir=.git --exclude-dir=.claude --exclude-dir=reports -E \"allowRequest|io\\.use\\(|handshake|ipAccessControl\\(|cors: \\{|origin: /\\.\\*\\$/\" js defaultmodules serveronly config tests\n```\n\nObserved output:\n\n```text\njs/server.js:44:\t\t\t\tcors: {\njs/server.js:90:\t\t\tapp.use(ipAccessControl(config.ipWhitelist));\n```\n\nThis confirms the IP allowlist appears only as Express middleware and no Socket.IO handshake/namespace allowlist was present in the reviewed runtime files.\n\n2. Confirm a default module helper will perform a server-side request to an attacker-supplied loopback URL when driven through its socket notification handler:\n\n```bash\nnode -e \u0027const Module=require(\"module\"); const orig=Module._load; Module._load=(r,p,m)=\u003e{ if(r===\"logger\") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r===\"node_helper\") return {create:(o)=\u003efunction(){Object.assign(this,o);this.sendSocketNotification=(n,p)=\u003econsole.log(\"SOCKET\",n,JSON.stringify(p));}}; if(r===\"./newsfeedfetcher\") return function(){}; return orig(r,p,m); }; const calls=[]; global.fetch=async(url,opts)=\u003e{calls.push({url,opts}); return {headers:{get:(h)=\u003eh===\"x-frame-options\"?\"deny\":null}};}; const Helper=require(\"./defaultmodules/newsfeed/node_helper\"); const h=new Helper(); h.start(); h.socketNotificationReceived(\"CHECK_ARTICLE_URL\",{url:\"http://127.0.0.1:65535/internal\"}); setTimeout(()=\u003econsole.log(\"fetchCalls=\",JSON.stringify(calls)),10);\u0027\n```\n\nObserved output:\n\n```text\nSOCKET ARTICLE_URL_STATUS {\"url\":\"http://127.0.0.1:65535/internal\",\"canFrame\":false}\nfetchCalls= [{\"url\":\"http://127.0.0.1:65535/internal\",\"opts\":{\"method\":\"HEAD\"}}]\n```\n\nExpected vulnerable output: the harness records a server-side `HEAD` request to `http://127.0.0.1:65535/internal` even though `/cors` SSRF protections are not involved.\n\n3. Confirm the conditional command-execution sink is reachable from the trusted socket-driven update path using a harmless `/tmp` marker command:\n\n```bash\nrm -f /tmp/mm-rce-marker\nmkdir -p /tmp/mm-audit/modules/evil /tmp/mm-audit/defaultmodules\nnode -e \u0027const fs=require(\"node:fs\"); const Module=require(\"module\"); const orig=Module._load; Module._load=(r,p,m)=\u003e{ if(r===\"logger\") return {log(){},error(){},warn(){},info(){},debug(){}}; if(r===\"node_helper\") return {create:(o)=\u003efunction(){Object.assign(this,o);this.sendSocketNotification=()=\u003e{};}}; return orig(r,p,m); }; global.root_path=\"/tmp/mm-audit\"; global.defaultModulesDir=\"defaultmodules\"; fs.writeFileSync(\"/tmp/mm-audit/defaultmodules/defaultmodules.js\",\"module.exports=[]\"); const Helper=require(\"./defaultmodules/updatenotification/node_helper\"); const h=new Helper(); h.gitHelper={add:async()=\u003e{},getRepos:async()=\u003e[{module:\"evil\",behind:1}],checkUpdates:()=\u003e[{module:\"evil\",behind:1}]}; h.sendSocketNotification=(n,p)=\u003econsole.log(\"SOCKET\",n,JSON.stringify(p)); (async()=\u003e{ await h.socketNotificationReceived(\"CONFIG\",{updates:[{evil:\"printf ok \u003e /tmp/mm-rce-marker\"}],updateTimeout:5000,updateAutorestart:false,ignoreModules:[],sendUpdatesNotifications:false,updateInterval:60000,useModulesFromConfig:true}); await h.socketNotificationReceived(\"MODULES\",[\"evil\"]); console.log(\"marker=\",fs.readFileSync(\"/tmp/mm-rce-marker\",\"utf8\")); process.exit(0); })();\u0027\nrm -f /tmp/mm-rce-marker\nrm -rf /tmp/mm-audit\n```\n\nObserved output from the executed harness:\n\n```text\nSOCKET REPO_STATUS {\"module\":\"evil\",\"behind\":1}\nSOCKET UPDATE_STATUS {\"name\":\"evil\",\"updateCommand\":\"printf ok \u003e /tmp/mm-rce-marker\",\"inProgress\":true,\"error\":false,\"updated\":true,\"needRestart\":true}\nmarker= ok\n```\n\nExpected vulnerable output: `marker= ok` demonstrates the update command supplied through the trusted socket configuration path reached `child_process.exec` and wrote the harmless marker.\n\nNegative/control cases:\n\n- With the shipped committed defaults (`js/defaults.js:8-13`), the server binds `localhost` and `ipWhitelist` includes only loopback, so a remote network attacker cannot reach either HTTP or Socket.IO unless the deployment is changed to a documented non-loopback address.\n- The `updatenotification` command execution path requires at least one non-core module update result; if `checkUpdates()` returns no third-party module with `behind \u003e 0`, `update_helper.parse(...)` does not execute an update command.\n- The explicit `/cors` route was not used for the confirmed request primitive and has separate protocol/hostname/DNS checks.\n\nFinal repro re-check: the sink search, newsfeed socket request harness, and update marker harness were re-run after drafting; the observed outputs above are from this environment. Cleanup removed `/tmp/mm-rce-marker` and `/tmp/mm-audit`.\n\n### Impact\nIn a documented common non-loopback deployment that relies on `ipWhitelist` for access control, an unauthenticated network client can bypass the intended IP allowlist for Socket.IO module namespaces. The attacker can send arbitrary module-helper notifications and payloads as if they were a trusted browser client.\n\nConfirmed impacts include:\n\n- Confidentiality/SSRF: server-side requests to attacker-chosen URLs through default module helpers, including loopback/internal URLs. The newsfeed PoC shows a `HEAD` request to `127.0.0.1`.\n- Integrity/availability: arbitrary manipulation of module-helper state and periodic fetch/update behavior through trusted socket messages.\n- Conditional code execution: when a third-party git-managed module is considered behind by the update checker, an attacker can supply a command in the socket `CONFIG` payload and trigger `child_process.exec`; the PoC safely wrote a `/tmp` marker.\n\nCVSS 3.1 rationale for the primary trust-boundary bypass with confirmed SSRF and conditional RCE variant: AV:A because MagicMirror\u0027s security policy says it is intended for trusted local/private networks and the documented non-loopback exposure is LAN-style; AC:H because default loopback settings must be changed and the RCE variant requires a pending third-party module update, though SSRF requires fewer conditions after reachability; PR:N because no application authentication is required; UI:N because the attacker connects directly to Socket.IO; S:C because the vulnerable application can cause requests/actions against other local/internal services and can execute commands in a child process in the conditional variant; C:L/I:L/A:L for confirmed internal request and helper-state/command side effects, with conservative scoring because unconditional default RCE was not shown.\n\n### Suggested remediation\nApply the same access-control decision to Socket.IO handshakes and namespaces as to Express routes. Concretely, add a Socket.IO `allowRequest` or `io.use(...)` middleware that normalizes `socket.handshake.address`/request IPs with the same `ipAccessControl` logic, and reject clients not allowed by `config.ipWhitelist`. Avoid relying on CORS for authorization; keep origin checks as a browser hardening layer only.\n\nAlso add module-helper authorization so arbitrary clients cannot send privileged server-side module notifications. For example, issue an unguessable per-session/module token to the served client and require it on helper messages, or separate read-only client events from privileged server-maintenance actions.\n\nFor defense in depth:\n\n- Add SSRF protections or allowlists to calendar/newsfeed/weather helper fetch paths, not only `/cors`.\n- Do not accept `updatenotification` update commands from socket payloads; use the server-loaded config only, validate module names against configured modules, and avoid shell execution where possible.\n- Add regression tests proving a disallowed IP receives a rejected Socket.IO handshake even when Express routes are protected, and proving `/newsfeed`/`/calendar` helper messages from unauthenticated sockets cannot trigger server-side requests or update commands.",
  "id": "GHSA-w26r-fwg8-rcp3",
  "modified": "2026-08-18T17:26:41Z",
  "published": "2026-08-18T17:26:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w26r-fwg8-rcp3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/pull/4169"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/commit/58c2a5e675a7d367b64d72e1d35680d202ff5c9f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MagicMirrorOrg/MagicMirror/releases/tag/v2.37.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-43119"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-16T20:15:15Z",
    "severity": "CRITICAL"
  },
  "details": "An Access Control issue discovered in Extreme Networks Switch Engine (EXOS) before 32.5.1.5, also fixed in 22.7, 31.7.2 allows attackers to gain escalated privileges using crafted telnet commands via Redis server.",
  "id": "GHSA-w279-72w5-rrq7",
  "modified": "2024-04-04T08:41:25Z",
  "published": "2023-10-16T21:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43119"
    },
    {
      "type": "WEB",
      "url": "https://extreme-networks.my.site.com/ExtrArticleDetail?an=000114378"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}