CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14805 vulnerabilities reference this CWE, most recent first.
GHSA-PRCP-93MM-93FM
Vulnerability from github – Published: 2022-05-24 17:11 – Updated: 2024-04-04 02:49A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
{
"affected": [],
"aliases": [
"CVE-2020-1720"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-17T16:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in PostgreSQL\u0026#39;s \u0026quot;ALTER ... DEPENDS ON EXTENSION\u0026quot;, where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.",
"id": "GHSA-prcp-93mm-93fm",
"modified": "2024-04-04T02:49:31Z",
"published": "2022-05-24T17:11:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1720"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720"
},
{
"type": "WEB",
"url": "https://www.postgresql.org/about/news/2011"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRCQ-GGCW-29JG
Vulnerability from github – Published: 2024-04-24 18:30 – Updated: 2026-04-28 21:34Missing Authorization vulnerability in Xfinity Soft Order Limit for WooCommerce.This issue affects Order Limit for WooCommerce: from n/a through 2.0.0.
{
"affected": [],
"aliases": [
"CVE-2024-32675"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T16:15:09Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Xfinity Soft Order Limit for WooCommerce.This issue affects Order Limit for WooCommerce: from n/a through 2.0.0.",
"id": "GHSA-prcq-ggcw-29jg",
"modified": "2026-04-28T21:34:56Z",
"published": "2024-04-24T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32675"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/wc-order-limit-lite/wordpress-order-limit-for-woocommerce-plugin-2-0-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PRFG-GJQW-HRFV
Vulnerability from github – Published: 2024-12-09 15:31 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12.
{
"affected": [],
"aliases": [
"CVE-2023-28417"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-09T13:15:25Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12.",
"id": "GHSA-prfg-gjqw-hrfv",
"modified": "2026-04-28T21:35:17Z",
"published": "2024-12-09T15:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28417"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/integration-dynamics/vulnerability/wordpress-dynamics-365-integration-plugin-1-3-12-broken-access-control?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRGQ-3HFX-HFPX
Vulnerability from github – Published: 2026-02-11 09:30 – Updated: 2026-02-11 09:30The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators.
{
"affected": [],
"aliases": [
"CVE-2026-1833"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-11T09:15:52Z",
"severity": "MODERATE"
},
"details": "The WaMate Confirm \u2013 Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to block and unblock phone numbers, which should be restricted to administrators.",
"id": "GHSA-prgq-3hfx-hfpx",
"modified": "2026-02-11T09:30:18Z",
"published": "2026-02-11T09:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1833"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1579"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/tags/2.0.1/customnotification.php#L1596"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1579"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wamate-confirm/trunk/customnotification.php#L1596"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9566fdd-c4ad-4971-b23b-bcf76c8b5cef?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRP4-2F49-FCGP
Vulnerability from github – Published: 2026-04-23 21:23 – Updated: 2026-04-27 16:35Summary
Any authenticated user (including BASIC role) can escalate to ADMIN on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: POST /account/change-password has no authorization check, allowing any session to overwrite the password hash; the inactive password auth row is never removed on migration; and the login endpoint accepts a client-supplied loginMethod that bypasses the server's active auth configuration. Together these allow an attacker to set a known password and authenticate as the anonymous admin account created during the multiuser migration.
Details
packages/sync-server/src/app-account.js:120-132 — the /account/change-password route validates only that a session exists. No admin role check is performed
app.post('/change-password', (req, res) => {
const session = validateSession(req, res); // only checks token validity
if (!session) return;
const { error } = changePassword(req.body.password); // no isAdmin() check
packages/sync-server/src/accounts/password.js:113-125 — changePassword() updates the hash with no current-password confirmation:
export function changePassword(newPassword) {
accountDb.mutate("UPDATE auth SET extra_data = ? WHERE method = 'password'", [hashed]);
}
packages/sync-server/src/accounts/password.js:56-62 — loginWithPassword() always authenticates as the user with user_name = '', which is created by the multiuser migration with role = 'ADMIN':
const sessionRow = accountDb.first(
'SELECT * FROM sessions WHERE auth_method = ?', ['password']
);
packages/sync-server/src/account-db.js:56-63 — a client can force the password login method regardless of server configuration by sending loginMethod in the request body:
if (req.body.loginMethod && config.get('allowedLoginMethods').includes(req.body.loginMethod)) {
return req.body.loginMethod;
}
When a server is migrated from password → OpenID via enableOpenID(), the password row is set to active = 0 but never deleted, leaving it available for exploitation.
PoC
Prerequisites: Server originally bootstrapped with password auth, then switched to OpenID. Default allowedLoginMethods configuration (includes password). Attacker has any valid OpenID session token (any role).
# Step 1 — overwrite the password hash using a BASIC-role session
curl -s -X POST https://<host>/account/change-password \
-H "Content-Type: application/json" \
-H "X-Actual-Token: <any_valid_session_token>" \
-d '{"password": "attacker123"}'
# → {"status":"ok","data":{}}
# Step 2 — log in via password method to obtain an ADMIN session
curl -s -X POST https://<host>/account/login \
-H "Content-Type: application/json" \
-d '{"loginMethod": "password", "password": "attacker123"}'
# → {"status":"ok","data":{"token":"<admin_token>"}}
The returned token belongs to the user_name = '' admin account (created by 1719409568000-multiuser.js).
Verify admin access:
curl -s https://<host>/account/validate \
-H "X-Actual-Token: <admin_token>"
# → {"status":"ok","data":{"permission":"ADMIN", ...}}
Impact
Privilege escalation — any authenticated user can gain full ADMIN access on affected deployments. An ADMIN can manage all users, access all budget files regardless of ownership, modify file access controls, and change server configuration.
Affected deployments: multi-user servers running OpenID Connect that were previously configured with password authentication. Servers bootstrapped exclusively with OpenID from initial setup are not affected (no password row exists in the auth table).
Recommendations
1. Restrict POST /account/change-password to password-authenticated sessions only
(packages/sync-server/src/app-account.js)
The endpoint should reject requests from sessions that were authenticated via OpenID. The active auth method can be checked against the session's auth_method field or by querying the auth table for the currently active method. If the server is running in OpenID mode, this endpoint should return 403 Forbidden.
2. Require current-password confirmation before accepting a new password
(packages/sync-server/src/accounts/password.js)
changePassword() should accept the current password as a parameter and verify it against the stored hash before applying the update. This prevents any session (even a legitimate password session) from silently overwriting the credential without proving possession of the existing one.
3. Enforce active status and remove client control over login method selection
(packages/sync-server/src/account-db.js — getLoginMethod())
Two issues exist in getLoginMethod(): (a) a client can supply loginMethod in the request body to select any method listed in allowedLoginMethods, regardless of whether it is currently active on the server; (b) the function does not check the active column, so an administratively disabled method (e.g. password after migrating to OpenID) remains accessible. The fix is to determine the permitted method server-side from WHERE active = 1 in the auth table and ignore any client-supplied loginMethod override entirely. Servers intentionally running both methods simultaneously can be supported by allowing multiple active = 1 rows rather than relying on client input.
4. Immediate mitigation for existing deployments (OpenID-only servers)
Administrators who have fully migrated to OpenID and do not need password auth can remove the orphaned row:
DELETE FROM auth WHERE method = 'password';
The three weaknesses form a single, sequential exploit chain — none produces privilege escalation on its own:
Missing authorization on POST /change-password — allows overwriting a password hash, but only matters if there is an orphaned row to target. Orphaned password row persisting after migration — provides the target row, but is harmless without the ability to authenticate using it. Client-controlled loginMethod: "password" — allows forcing password-based auth, but is useless without a known hash established by step 1.
All three must be chained in sequence to achieve the impact. No single weakness independently results in privilege escalation, which under CVE CNA rule 4.1.2 means they should not each be treated as standalone vulnerabilities. The single root cause is the missing authorization check on /change-password; the other two are preconditions that make it exploitable. A single CVE reflecting that root cause is the appropriate representation — splitting them would falsely imply each carries independent risk.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@actual-app/sync-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-33318"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-23T21:23:38Z",
"nvd_published_at": "2026-04-24T03:16:11Z",
"severity": "HIGH"
},
"details": "### Summary\n\nAny authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migrated from password authentication to OpenID Connect. Three weaknesses combine: `POST /account/change-password` has no authorization check, allowing any session to overwrite the password hash; the inactive password `auth` row is never removed on migration; and the login endpoint accepts a client-supplied `loginMethod` that bypasses the server\u0027s active auth configuration. Together these allow an attacker to set a known password and authenticate as the anonymous admin account created during the multiuser migration.\n\n---\n\n### Details\n\n**`packages/sync-server/src/app-account.js:120-132`** \u2014 the `/account/change-password` route validates only that a session exists. No admin role check is performed\n\n```js\napp.post(\u0027/change-password\u0027, (req, res) =\u003e {\n const session = validateSession(req, res); // only checks token validity\n if (!session) return;\n const { error } = changePassword(req.body.password); // no isAdmin() check\n```\n\n**`packages/sync-server/src/accounts/password.js:113-125`** \u2014 `changePassword()` updates the hash with no current-password confirmation:\n\n```js\nexport function changePassword(newPassword) {\n accountDb.mutate(\"UPDATE auth SET extra_data = ? WHERE method = \u0027password\u0027\", [hashed]);\n}\n```\n\n**`packages/sync-server/src/accounts/password.js:56-62`** \u2014 `loginWithPassword()` always authenticates as the user with `user_name = \u0027\u0027`, which is created by the multiuser migration with `role = \u0027ADMIN\u0027`:\n\n```js\nconst sessionRow = accountDb.first(\n \u0027SELECT * FROM sessions WHERE auth_method = ?\u0027, [\u0027password\u0027]\n);\n```\n\n**`packages/sync-server/src/account-db.js:56-63`** \u2014 a client can force the `password` login method regardless of server configuration by sending `loginMethod` in the request body:\n\n```js\nif (req.body.loginMethod \u0026\u0026 config.get(\u0027allowedLoginMethods\u0027).includes(req.body.loginMethod)) {\n return req.body.loginMethod;\n}\n```\n\nWhen a server is migrated from password \u2192 OpenID via `enableOpenID()`, the password row is set to `active = 0` but **never deleted**, leaving it available for exploitation.\n\n---\n\n### PoC\n\n**Prerequisites:** Server originally bootstrapped with password auth, then switched to OpenID. Default `allowedLoginMethods` configuration (includes `password`). Attacker has any valid OpenID session token (any role).\n\n```bash\n# Step 1 \u2014 overwrite the password hash using a BASIC-role session\ncurl -s -X POST https://\u003chost\u003e/account/change-password \\\n -H \"Content-Type: application/json\" \\\n -H \"X-Actual-Token: \u003cany_valid_session_token\u003e\" \\\n -d \u0027{\"password\": \"attacker123\"}\u0027\n# \u2192 {\"status\":\"ok\",\"data\":{}}\n\n# Step 2 \u2014 log in via password method to obtain an ADMIN session\ncurl -s -X POST https://\u003chost\u003e/account/login \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"loginMethod\": \"password\", \"password\": \"attacker123\"}\u0027\n# \u2192 {\"status\":\"ok\",\"data\":{\"token\":\"\u003cadmin_token\u003e\"}}\n```\n\nThe returned token belongs to the `user_name = \u0027\u0027` admin account (created by `1719409568000-multiuser.js`).\n\nVerify admin access:\n```bash\ncurl -s https://\u003chost\u003e/account/validate \\\n -H \"X-Actual-Token: \u003cadmin_token\u003e\"\n# \u2192 {\"status\":\"ok\",\"data\":{\"permission\":\"ADMIN\", ...}}\n```\n\n---\n\n### Impact\n\n**Privilege escalation** \u2014 any authenticated user can gain full `ADMIN` access on affected deployments. An ADMIN can manage all users, access all budget files regardless of ownership, modify file access controls, and change server configuration.\n\nAffected deployments: multi-user servers running OpenID Connect that were previously configured with password authentication. Servers bootstrapped exclusively with OpenID from initial setup are not affected (no password row exists in the `auth` table).\n\n---\n\n### Recommendations\n\n**1. Restrict `POST /account/change-password` to password-authenticated sessions only**\n(`packages/sync-server/src/app-account.js`)\n\nThe endpoint should reject requests from sessions that were authenticated via OpenID. The active auth method can be checked against the session\u0027s `auth_method` field or by querying the `auth` table for the currently active method. If the server is running in OpenID mode, this endpoint should return `403 Forbidden`.\n\n**2. Require current-password confirmation before accepting a new password**\n(`packages/sync-server/src/accounts/password.js`)\n\n`changePassword()` should accept the current password as a parameter and verify it against the stored hash before applying the update. This prevents any session (even a legitimate password session) from silently overwriting the credential without proving possession of the existing one.\n\n**3. Enforce `active` status and remove client control over login method selection**\n(`packages/sync-server/src/account-db.js` \u2014 `getLoginMethod()`)\n\nTwo issues exist in `getLoginMethod()`: (a) a client can supply `loginMethod` in the request body to select any method listed in `allowedLoginMethods`, regardless of whether it is currently active on the server; (b) the function does not check the `active` column, so an administratively disabled method (e.g. `password` after migrating to OpenID) remains accessible. The fix is to determine the permitted method server-side from `WHERE active = 1` in the `auth` table and ignore any client-supplied `loginMethod` override entirely. Servers intentionally running both methods simultaneously can be supported by allowing multiple `active = 1` rows rather than relying on client input.\n\n**4. Immediate mitigation for existing deployments (OpenID-only servers)**\n\nAdministrators who have fully migrated to OpenID and do not need password auth can remove the orphaned row:\n\n```sql\nDELETE FROM auth WHERE method = \u0027password\u0027;\n```\n\n####\n\nThe three weaknesses form a single, sequential exploit chain \u2014 none produces privilege escalation on its own:\n\nMissing authorization on POST /change-password \u2014 allows overwriting a password hash, but only matters if there is an orphaned row to target.\nOrphaned password row persisting after migration \u2014 provides the target row, but is harmless without the ability to authenticate using it.\nClient-controlled loginMethod: \"password\" \u2014 allows forcing password-based auth, but is useless without a known hash established by step 1.\n\nAll three must be chained in sequence to achieve the impact. No single weakness independently results in privilege escalation, which under CVE CNA rule 4.1.2 means they should not each be treated as standalone vulnerabilities.\nThe single root cause is the missing authorization check on /change-password; the other two are preconditions that make it exploitable. A single CVE reflecting that root cause is the appropriate representation \u2014 splitting them would falsely imply each carries independent risk.",
"id": "GHSA-prp4-2f49-fcgp",
"modified": "2026-04-27T16:35:53Z",
"published": "2026-04-23T21:23:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/actualbudget/actual/security/advisories/GHSA-prp4-2f49-fcgp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33318"
},
{
"type": "WEB",
"url": "https://actualbudget.org/blog/release-26.4.0"
},
{
"type": "PACKAGE",
"url": "https://github.com/actualbudget/actual"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Actual has Privilege Escalation via \u0027change-password\u0027 Endpoint on OpenID-Migrated Servers"
}
GHSA-PRP6-7XRH-X9FQ
Vulnerability from github – Published: 2026-01-08 12:30 – Updated: 2026-01-20 15:33Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: from n/a through <= 19.9.5.
{
"affected": [],
"aliases": [
"CVE-2025-14358"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-08T10:15:45Z",
"severity": "CRITICAL"
},
"details": "Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: from n/a through \u003c= 19.9.5.",
"id": "GHSA-prp6-7xrh-x9fq",
"modified": "2026-01-20T15:33:07Z",
"published": "2026-01-08T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14358"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/rehub-framework/vulnerability/wordpress-rehub-framework-plugin-19-9-5-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/rehub-framework/vulnerability/wordpress-rehub-framework-plugin-19-9-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PRP9-W269-43R4
Vulnerability from github – Published: 2023-01-28 00:30 – Updated: 2023-02-06 21:30Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).
{
"affected": [],
"aliases": [
"CVE-2022-39811"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-27T22:15:00Z",
"severity": "CRITICAL"
},
"details": "Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).",
"id": "GHSA-prp9-w269-43r4",
"modified": "2023-02-06T21:30:34Z",
"published": "2023-01-28T00:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39811"
},
{
"type": "WEB",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRPH-5CFV-59C9
Vulnerability from github – Published: 2024-06-20 03:30 – Updated: 2026-04-08 18:33The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and modify settings.
{
"affected": [],
"aliases": [
"CVE-2024-3627"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T02:15:11Z",
"severity": "MODERATE"
},
"details": "The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts and modify settings.",
"id": "GHSA-prph-5cfv-59c9",
"modified": "2026-04-08T18:33:26Z",
"published": "2024-06-20T03:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3627"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wheel-of-life/trunk/includes/functions/AjaxFunctions.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3107222%40wheel-of-life\u0026new=3107222%40wheel-of-life\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0615d1be-f9fa-45b3-9d5b-3ad1f36be8e1?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-PRQP-27GF-5PXP
Vulnerability from github – Published: 2026-05-26 13:30 – Updated: 2026-05-26 13:30Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects WP Search Analytics: from n/a before 1.5.0.
{
"affected": [],
"aliases": [
"CVE-2026-27357"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-25T22:16:33Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Cornel Raiu WP Search Analytics allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects WP Search Analytics: from n/a before 1.5.0.",
"id": "GHSA-prqp-27gf-5pxp",
"modified": "2026-05-26T13:30:52Z",
"published": "2026-05-26T13:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27357"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/search-analytics/vulnerability/wordpress-wp-search-analytics-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRRR-CQJJ-3CHG
Vulnerability from github – Published: 2025-12-18 09:30 – Updated: 2026-01-20 15:32Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.
{
"affected": [],
"aliases": [
"CVE-2025-64273"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-18T08:16:13Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through \u003c= 1.5.3.",
"id": "GHSA-prrr-cqjj-3chg",
"modified": "2026-01-20T15:32:31Z",
"published": "2025-12-18T09:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64273"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/getresponse-official/vulnerability/wordpress-email-marketing-for-wordpress-by-getresponse-official-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/getresponse-official/vulnerability/wordpress-email-marketing-for-wordpress-by-getresponse-official-plugin-1-5-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.