Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
3965 vulnerabilities reference this CWE, most recent first.
CVE-2026-78203 (GCVE-0-2026-78203)
Vulnerability from cvelistv5 – Published: 2026-08-24 00:30 – Updated: 2026-08-26 16:15
VLAI
EPSS
VEX
Title
Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap
Summary
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:55 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/GhostManager/Ghostwriter/commi… | patch |
| https://github.com/GhostManager/Ghostwriter | product |
| https://github.com/GhostManager/Ghostwriter/blob/… | technical-description |
| https://github.com/geo-chen/oss/blob/main/Ghostwr… | third-party-advisory |
| https://www.vulncheck.com/advisories/ghostwriter-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GhostManager | Ghostwriter |
Affected:
0 , < 7.1.2
(semver)
Unaffected: 7.1.2 (semver) |
Date Public
2026-06-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78203",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T15:55:35.346279Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T16:15:50.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Ghostwriter",
"vendor": "GhostManager",
"versions": [
{
"lessThan": "7.1.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T00:30:44.452Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/GhostManager/Ghostwriter/commit/5b2a4a297e44c823c16f65b1ba101c742791cd0b"
},
{
"tags": [
"product"
],
"url": "https://github.com/GhostManager/Ghostwriter"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/GhostManager/Ghostwriter/blob/v7.1.1/ghostwriter/reporting/views.py#L275-L315"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/geo-chen/oss/blob/main/Ghostwriter.md"
},
{
"name": "VulnCheck Advisory: Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ghostwriter-before-cross-client-report-template-disclosure-via-unauthorized-template-swap"
}
],
"title": "Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78203",
"datePublished": "2026-08-24T00:30:44.452Z",
"dateReserved": "2026-08-23T23:45:12.185Z",
"dateUpdated": "2026-08-26T16:15:50.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78160 (GCVE-0-2026-78160)
Vulnerability from cvelistv5 – Published: 2026-08-24 00:30 – Updated: 2026-08-24 14:59 X_Open Source
VLAI
EPSS
VEX
Title
Dolibarr ERP User Notes note.php authorization
Summary
A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 14:59 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394542 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394542/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78160 | third-party-advisory |
| https://vuldb.com/submit/883067 | third-party-advisory |
| https://github.com/Dolibarr/dolibarr/issues/39063 | issue-tracking |
| https://github.com/Dolibarr/dolibarr/pull/39123 | issue-trackingpatch |
| https://github.com/Dolibarr/dolibarr/commit/9b522… | patch |
| https://github.com/Dolibarr/dolibarr/releases/tag… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dolibarr | ERP |
Affected:
18.0.0
Affected: 18.0.1 Affected: 18.0.2 Affected: 18.0.3 Affected: 18.0.4 Affected: 18.0.5 Affected: 18.0.6 Affected: 18.0.7 Affected: 18.0.8 Affected: 18.0.9 Affected: 18.0.10 Affected: 22.0.0 Affected: 22.0.1 Affected: 22.0.2 Affected: 22.0.3 Affected: 22.0.4 Affected: 22.0.5 Affected: 23.0.0 Affected: 23.0.1 Affected: 23.0.2 Affected: 23.0.3 Unaffected: 23.0.4 Unaffected: 24.0.0 cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T14:59:16.334698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T14:59:25.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dolibarr:erp:*:*:*:*:*:*:*:*"
],
"modules": [
"User Notes Handler"
],
"product": "ERP",
"vendor": "Dolibarr",
"versions": [
{
"status": "affected",
"version": "18.0.0"
},
{
"status": "affected",
"version": "18.0.1"
},
{
"status": "affected",
"version": "18.0.2"
},
{
"status": "affected",
"version": "18.0.3"
},
{
"status": "affected",
"version": "18.0.4"
},
{
"status": "affected",
"version": "18.0.5"
},
{
"status": "affected",
"version": "18.0.6"
},
{
"status": "affected",
"version": "18.0.7"
},
{
"status": "affected",
"version": "18.0.8"
},
{
"status": "affected",
"version": "18.0.9"
},
{
"status": "affected",
"version": "18.0.10"
},
{
"status": "affected",
"version": "22.0.0"
},
{
"status": "affected",
"version": "22.0.1"
},
{
"status": "affected",
"version": "22.0.2"
},
{
"status": "affected",
"version": "22.0.3"
},
{
"status": "affected",
"version": "22.0.4"
},
{
"status": "affected",
"version": "22.0.5"
},
{
"status": "affected",
"version": "23.0.0"
},
{
"status": "affected",
"version": "23.0.1"
},
{
"status": "affected",
"version": "23.0.2"
},
{
"status": "affected",
"version": "23.0.3"
},
{
"status": "unaffected",
"version": "23.0.4"
},
{
"status": "unaffected",
"version": "24.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Abderrahmane Aksoum (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 23.0.4 and 24.0.0 is capable of addressing this issue. The identifier of the patch is 9b5229ef3a9b58d00252d327936b022fb739f149. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T00:30:10.986Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394542 | Dolibarr ERP User Notes note.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394542"
},
{
"name": "VDB-394542 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394542/cti"
},
{
"name": "CVE-2026-78160 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78160"
},
{
"name": "Submit #883067 | dolibarr erp 18.0 User with Self-Edit Rights Can Write to Any Profile(Root + All )",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/883067"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Dolibarr/dolibarr/issues/39063"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/pull/39123"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/commit/9b5229ef3a9b58d00252d327936b022fb739f149"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/23.0.4"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T13:48:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Dolibarr ERP User Notes note.php authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78160",
"datePublished": "2026-08-24T00:30:10.986Z",
"dateReserved": "2026-08-23T11:43:54.013Z",
"dateUpdated": "2026-08-24T14:59:25.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78144 (GCVE-0-2026-78144)
Vulnerability from cvelistv5 – Published: 2026-08-23 22:30 – Updated: 2026-08-26 18:07 X_Freeware
VLAI
EPSS
VEX
Title
code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization
Summary
A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 18:07 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394527 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394527/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78144 | third-party-advisory |
| https://vuldb.com/submit/882425 | third-party-advisory |
| https://gist.github.com/c4ttr4ck/3601aa0ba9e56770… | exploit |
| https://code-projects.org/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| code-projects | Barangay Resident Profiling Management System |
Affected:
1.0
cpe:2.3:a:code-projects:barangay_resident_profiling_management_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78144",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T18:07:47.289777Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T18:07:57.713Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:code-projects:barangay_resident_profiling_management_system:*:*:*:*:*:*:*:*"
],
"modules": [
"Boarder Management Module"
],
"product": "Barangay Resident Profiling Management System",
"vendor": "code-projects",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "c4ttr4ck (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T22:30:09.529Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394527 | code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394527"
},
{
"name": "VDB-394527 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394527/cti"
},
{
"name": "CVE-2026-78144 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78144"
},
{
"name": "Submit #882425 | code-projects Barangay Resident Profiling Management System (BRPMS) / Barangay San Fabian 1.0 Insecure Direct Object Reference (IDOR)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/882425"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/c4ttr4ck/3601aa0ba9e567705823b6d425e84237"
},
{
"tags": [
"product"
],
"url": "https://code-projects.org/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T08:13:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78144",
"datePublished": "2026-08-23T22:30:09.529Z",
"dateReserved": "2026-08-23T06:08:36.855Z",
"dateUpdated": "2026-08-26T18:07:57.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78142 (GCVE-0-2026-78142)
Vulnerability from cvelistv5 – Published: 2026-08-23 22:00 – Updated: 2026-08-24 15:01 X_Freeware
VLAI
EPSS
VEX
Title
code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization
Summary
A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component Restore/Delete. The manipulation of the argument resident_id results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 15:01 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/394525 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/394525/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-78142 | third-party-advisory |
| https://vuldb.com/submit/882422 | third-party-advisory |
| https://gist.github.com/c4ttr4ck/190b532b4b239fdc… | exploit |
| https://code-projects.org/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| code-projects | Barangay Resident Profiling Management System |
Affected:
1.0
cpe:2.3:a:code-projects:barangay_resident_profiling_management_system:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78142",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T15:01:33.366815Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T15:01:41.992Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/882422"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:code-projects:barangay_resident_profiling_management_system:*:*:*:*:*:*:*:*"
],
"modules": [
"Restore/Delete"
],
"product": "Barangay Resident Profiling Management System",
"vendor": "code-projects",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "c4ttr4ck (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component Restore/Delete. The manipulation of the argument resident_id results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T22:00:12.126Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-394525 | code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/394525"
},
{
"name": "VDB-394525 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/394525/cti"
},
{
"name": "CVE-2026-78142 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-78142"
},
{
"name": "Submit #882422 | code-projects Barangay Resident Profiling Management System (BRPMS) / Barangay San Fabian 1.0 Insecure Direct Object Reference (IDOR)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/882422"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/c4ttr4ck/190b532b4b239fdc8f6fb72d89bde2c8"
},
{
"tags": [
"product"
],
"url": "https://code-projects.org/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-23T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-23T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-23T08:13:43.000Z",
"value": "VulDB entry last update"
}
],
"title": "code-projects Barangay Resident Profiling Management System Restore/Delete archived_records.php authorization",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-78142",
"datePublished": "2026-08-23T22:00:12.126Z",
"dateReserved": "2026-08-23T06:08:28.546Z",
"dateUpdated": "2026-08-24T15:01:41.992Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78075 (GCVE-0-2026-78075)
Vulnerability from cvelistv5 – Published: 2026-08-31 13:59 – Updated: 2026-09-01 14:06
VLAI
EPSS
VEX
Title
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10
Summary
Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:16 UTC
CWE
- CWE-639 - (Authorization Bypass Through User-Controlled Key)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.joomshaper.com/joomla-templates/helix… | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| joomshaper.com | Helix Ultimate extension for Joomla |
Affected:
1.0-2.2.9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78075",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:16:49.678873Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:16:57.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Helix Ultimate extension for Joomla",
"vendor": "joomshaper.com",
"versions": [
{
"status": "affected",
"version": "1.0-2.2.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor, mysites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate \u003c 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files."
}
],
"value": "Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate \u003c 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Joomla 3 builds where physical file deletion was triggered, an author could supply their own article ID alongside an arbitrary file path under the `/images/` directory to delete arbitrary files."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 (Authorization Bypass Through User-Controlled Key)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T14:06:08.584Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.joomshaper.com/joomla-templates/helixultimate"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate \u003c 2.2.10",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-78075",
"datePublished": "2026-08-31T13:59:08.717Z",
"dateReserved": "2026-08-22T14:23:37.801Z",
"dateUpdated": "2026-09-01T14:06:08.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77998 (GCVE-0-2026-77998)
Vulnerability from cvelistv5 – Published: 2026-08-25 12:50 – Updated: 2026-08-26 22:35
VLAI
EPSS
VEX
Title
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4
Summary
Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 14:38 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.miniorange.com/ | product |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| miniorange.com | SAML SSO Free for Joomla extension for Joomla |
Affected:
1.0.0-11.0.1
|
|
| miniorange.com | SAML SSO Basic for Joomla extension for Joomla |
Affected:
1.0.0-13.1.0
|
|
| miniorange.com | SAML SSO Standard for Joomla extension for Joomla |
Affected:
1.0.0-24.1.0
|
|
| miniorange.com | SAML SSO Premium for Joomla extension for Joomla |
Affected:
1.0.0-34.1.0
|
|
| miniorange.com | SAML SSO Enterprise for Joomla extension for Joomla |
Affected:
1.0.0-44.1.0
|
|
| miniorange.com | SAML SP Single Sign On – Login with ADFS extension for Joomla |
Affected:
1.0.0-6.3.0
|
|
| miniorange.com | SAML SSO login with Google Apps extension for Joomla |
Affected:
1.0.0-6.3.0
|
|
| miniorange.com | OAuth Single Sign-On – OIDC SSO | Login with Azure AD |
Affected:
1.0.0-1.2.1
|
|
| miniorange.com | Login with Keycloak OAuth Single Sign-On (SSO) |
Affected:
1.0.0-1.2.1
|
|
| miniorange.com | Single Sign-On for Educational Institutes - version |
Affected:
1.0.0-1.2.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T14:38:55.305998Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T14:51:54.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SAML SSO Free for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-11.0.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Basic for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-13.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Standard for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-24.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Premium for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-34.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO Enterprise for Joomla extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-44.1.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SP Single Sign On \u2013 Login with ADFS extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SAML SSO login with Google Apps extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-6.3.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "OAuth Single Sign-On \u2013 OIDC SSO | Login with Azure AD",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Login with Keycloak OAuth Single Sign-On (SSO)",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Single Sign-On for Educational Institutes - version",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-1.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
},
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor, mysites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO \u003c 11.0.2, SAML SP Single Sign On \u2013 Login with ADFS \u003c 6.4, SAML SP Single Sign On \u2013 SAML SSO login with Google Apps \u003c 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP\u0027s openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error \u2014 bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account."
}
],
"value": "Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO \u003c 11.0.2, SAML SP Single Sign On \u2013 Login with ADFS \u003c 6.4, SAML SP Single Sign On \u2013 SAML SSO login with Google Apps \u003c 6.4 - This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP\u0027s openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing Joomla user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error \u2014 bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T22:35:35.616Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.miniorange.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO \u003c 11.0.2, SAML SP Single Sign On \u2013 Login with ADFS \u003c 6.4, SAML SP Single Sign On \u2013 SAML SSO login with Google Apps \u003c 6.4",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-77998",
"datePublished": "2026-08-25T12:50:46.506Z",
"dateReserved": "2026-08-21T19:23:55.924Z",
"dateUpdated": "2026-08-26T22:35:35.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77995 (GCVE-0-2026-77995)
Vulnerability from cvelistv5 – Published: 2026-08-24 13:05 – Updated: 2026-08-25 04:47
VLAI
EPSS
VEX
Title
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0
Summary
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 17:25 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.miniorange.com/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| miniorange.com | miniOrange OAuth Client extension for Joomla |
Affected:
1.0.0-3.1.9
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T17:25:41.162522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:26:02.516Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "miniOrange OAuth Client extension for Joomla",
"vendor": "miniorange.com",
"versions": [
{
"status": "affected",
"version": "1.0.0-3.1.9"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c, CERT PL"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client \u003c 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins."
}
],
"value": "Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client \u003c 3.2.0 - The manipulation of a cookie value allows actors to login as arbitrary accounts, including admins."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T04:47:07.572Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.miniorange.com/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client \u003c 3.2.0",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-77995",
"datePublished": "2026-08-24T13:05:26.952Z",
"dateReserved": "2026-08-21T19:23:55.924Z",
"dateUpdated": "2026-08-25T04:47:07.572Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77990 (GCVE-0-2026-77990)
Vulnerability from cvelistv5 – Published: 2026-08-27 05:47 – Updated: 2026-08-28 07:45
VLAI
EPSS
VEX
Title
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1
Summary
Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:03 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.joomlaeventmanager.net/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| joomlaeventmanager.net | JEM - Joomla Event Manager extension for Joomla |
Affected:
1.0.0-5.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77990",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:03:40.941720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:05:32.010Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "JEM - Joomla Event Manager extension for Joomla",
"vendor": "joomlaeventmanager.net",
"versions": [
{
"status": "affected",
"version": "1.0.0-5.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Phil Taylor, mysites.guru"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager \u003c 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events."
}
],
"value": "Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager \u003c 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T07:45:30.323Z",
"orgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"shortName": "Joomla"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.joomlaeventmanager.net/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager \u003c 5.0.1",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "6ff30186-7fb7-4ad9-be33-533e7b05e586",
"assignerShortName": "Joomla",
"cveId": "CVE-2026-77990",
"datePublished": "2026-08-27T05:47:51.963Z",
"dateReserved": "2026-08-21T19:05:09.013Z",
"dateUpdated": "2026-08-28T07:45:30.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77780 (GCVE-0-2026-77780)
Vulnerability from cvelistv5 – Published: 2026-08-21 12:12 – Updated: 2026-08-21 16:12 X_Open Source
VLAI
EPSS
VEX
Title
Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers
Summary
Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus
Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting
creation permissions to disclose another company's bank account name, bank name and card
last four digits via a bank_account_id or bank_card_id belonging to that company in POST
/transaction/save, which is persisted and rendered without any company ownership check.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 15:56 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Roskus/prospero-flow-crm/commi… | patch |
| https://github.com/Roskus/prospero-flow-crm/pull/261 | issue-tracking |
| https://secur0.com/en/cna/cve-list/cve-2026-77780… | technical-descriptionthird-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Roskus | Prospero Flow CRM |
Affected:
4.9.1 , < 5.14.2
(semver)
cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:* |
Date Public
2026-08-21 12:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77780",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T15:56:49.202825Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T16:12:40.967Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Transaction (Accounting) save path",
"Accounting listing"
],
"product": "Prospero Flow CRM",
"programFiles": [
"app/Http/Controllers/Transaction/TransactionSaveController.php",
"app/Http/Requests/TransactionSaveRequest.php"
],
"repo": "https://github.com/Roskus/prospero-flow-crm",
"vendor": "Roskus",
"versions": [
{
"lessThan": "5.14.2",
"status": "affected",
"version": "4.9.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:roskus:prospero_flow_crm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.2",
"versionStartIncluding": "4.9.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adri\u00e1n Garc\u00eda L\u00f3pez"
},
{
"lang": "en",
"type": "analyst",
"value": "Xo\u00e1n M. Otero Jorge"
},
{
"lang": "en",
"type": "analyst",
"value": "Dar\u00edo Rivas Quero"
},
{
"lang": "en",
"type": "coordinator",
"value": "Secur0 CNA"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Gustavo Novaro"
}
],
"datePublic": "2026-08-21T12:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company\u0027s bank account name, bank name and card\nlast four digits via a bank_account_id or bank_card_id belonging to that company in POST\n/transaction/save, which is persisted and rendered without any company ownership check."
}
],
"value": "Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus\nProspero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting\ncreation permissions to disclose another company\u0027s bank account name, bank name and card\nlast four digits via a bank_account_id or bank_card_id belonging to that company in POST\n/transaction/save, which is persisted and rendered without any company ownership check."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:12:59.160Z",
"orgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"shortName": "Secur0"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/Roskus/prospero-flow-crm/commit/5fd1fe862bbdcbacf5d7e05c1c123981d8809674"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Roskus/prospero-flow-crm/pull/261"
},
{
"tags": [
"technical-description",
"third-party-advisory"
],
"url": "https://secur0.com/en/cna/cve-list/cve-2026-77780-idor-unvalidated-bank-foreign-keys-prospero-transaction-save"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to 5.14.2 or later. No tagged release carries the fix; the newest tag \u003ccode\u003ev5.14.0\u003c/code\u003e is\naffected. Rows already written are not corrected by the patch."
}
],
"value": "Upgrade to 5.14.2 or later. No tagged release carries the fix; the newest tag v5.14.0 is\naffected. Rows already written are not corrected by the patch."
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"title": "Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "4daa8cea-433a-44bd-9456-53b127fc289a",
"assignerShortName": "Secur0",
"cveId": "CVE-2026-77780",
"datePublished": "2026-08-21T12:12:59.160Z",
"dateReserved": "2026-08-21T11:30:36.990Z",
"dateUpdated": "2026-08-21T16:12:40.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77776 (GCVE-0-2026-77776)
Vulnerability from cvelistv5 – Published: 2026-08-21 11:22 – Updated: 2026-08-21 21:44
VLAI
EPSS
VEX
Title
Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity
Summary
Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:18 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/headroomlabs-ai/headroom/pull/2207 | issue-tracking |
| https://github.com/headroomlabs-ai/headroom/blob/… | technical-description |
| https://github.com/headroomlabs-ai/headroom/blob/… | technical-description |
| https://github.com/headroomlabs-ai/headroom | product |
| https://www.vulncheck.com/advisories/headroom-pro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Headroom Labs | Headroom |
Affected:
0 , < 0.36.1
(semver)
Unaffected: 0.36.1 (semver) |
Date Public
2026-08-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77776",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:18:54.351966Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:44:30.707Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.org",
"defaultStatus": "unaffected",
"packageName": "headroom-ai",
"packageURL": "pkg:pypi/headroom-ai",
"product": "Headroom",
"programFiles": [
"headroom/proxy/handlers/openai.py",
"headroom/proxy/memory_handler.py",
"headroom/memory/easy.py"
],
"repo": "https://github.com/headroomlabs-ai/headroom",
"vendor": "Headroom Labs",
"versions": [
{
"lessThan": "0.36.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.36.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Gregory Tan (Grg0rry)"
}
],
"datePublic": "2026-08-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Headroom\u0027s LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat completion and websocket paths, and nothing binds the value to the caller. A client can therefore name another user\u0027s identifier and read or write that user\u0027s stored LLM memory. The fix introduces a single resolve_memory_identity seam in headroom/proxy/identity.py that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, which the server itself warns about at startup, so a deployment following the shipped compose exposes the affected data-plane routes to the network without authentication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T11:22:51.779Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Pull Request #2207 addressing the assessment findings",
"tags": [
"issue-tracking"
],
"url": "https://github.com/headroomlabs-ai/headroom/pull/2207"
},
{
"name": "Header handling in the OpenAI proxy handler at v0.29.0",
"tags": [
"technical-description"
],
"url": "https://github.com/headroomlabs-ai/headroom/blob/v0.29.0/headroom/proxy/handlers/openai.py"
},
{
"name": "resolve_memory_identity seam introduced by the fix",
"tags": [
"technical-description"
],
"url": "https://github.com/headroomlabs-ai/headroom/blob/v0.36.1/headroom/proxy/identity.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/headroomlabs-ai/headroom"
},
{
"name": "VulnCheck Advisory: Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/headroom-proxy-treats-the-client-supplied-x-headroom-user-id-header-as-an-authenticated-identity"
}
],
"title": "Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated Identity"
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-77776",
"datePublished": "2026-08-21T11:22:51.779Z",
"dateReserved": "2026-08-21T11:09:25.553Z",
"dateUpdated": "2026-08-21T21:44:30.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.