CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14829 vulnerabilities reference this CWE, most recent first.
GHSA-RJ85-RWQP-58G9
Vulnerability from github – Published: 2026-04-08 09:31 – Updated: 2026-04-08 15:31Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.
{
"affected": [],
"aliases": [
"CVE-2026-39690"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T09:16:41Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through \u003c= 2.1.25.",
"id": "GHSA-rj85-rwqp-58g9",
"modified": "2026-04-08T15:31:43Z",
"published": "2026-04-08T09:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39690"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/author-avatars/vulnerability/wordpress-author-avatars-list-block-plugin-2-1-25-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RJ9R-F39X-H33W
Vulnerability from github – Published: 2026-02-10 06:30 – Updated: 2026-02-10 06:30An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.
{
"affected": [],
"aliases": [
"CVE-2026-0488"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T04:16:01Z",
"severity": "CRITICAL"
},
"details": "An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.",
"id": "GHSA-rj9r-f39x-h33w",
"modified": "2026-02-10T06:30:38Z",
"published": "2026-02-10T06:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0488"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3697099"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RJ9V-8PP5-CRVW
Vulnerability from github – Published: 2024-06-09 09:30 – Updated: 2024-06-09 09:30Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.
{
"affected": [],
"aliases": [
"CVE-2024-30537"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-09T09:15:10Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WPClever WPC Badge Management for WooCommerce.This issue affects WPC Badge Management for WooCommerce: from n/a through 2.4.0.",
"id": "GHSA-rj9v-8pp5-crvw",
"modified": "2024-06-09T09:30:34Z",
"published": "2024-06-09T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30537"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/wpc-badge-management/wordpress-wpc-badge-management-for-woocommerce-plugin-2-4-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RJCP-5FMG-8753
Vulnerability from github – Published: 2022-05-13 01:50 – Updated: 2022-05-13 01:50An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Missing Authorization Control for API Repository Storage.
{
"affected": [],
"aliases": [
"CVE-2018-16048"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-10-03T16:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Missing Authorization Control for API Repository Storage.",
"id": "GHSA-rjcp-5fmg-8753",
"modified": "2022-05-13T01:50:15Z",
"published": "2022-05-13T01:50:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16048"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/2018/08/28/security-release-gitlab-11-dot-2-dot-2-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/49947"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RJG6-39JM-RGG4
Vulnerability from github – Published: 2026-07-24 15:40 – Updated: 2026-07-24 15:40Am I affected?
You are affected if your application registers the @better-auth/scim plugin and lets authenticated users generate SCIM tokens. The default canGenerateToken policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account providers. The provider-ID collision issue additionally requires SSO, SAML, OIDC, generic OAuth, or social providers whose account rows use custom provider IDs, plus existing account rows under those IDs.
The deprovisioning and email-update issues require only the SCIM plugin and a valid SCIM bearer token. Published versions from @better-auth/scim@1.4.0-beta.27 through 1.6.21 are affected. Beta versions from 1.7.0-beta.0 through 1.7.0-beta.9 are affected. Upgrade to @better-auth/scim@1.6.22 or 1.7.0-beta.10.
Summary
@better-auth/scim used the same logical provider ID for SCIM provider configuration and account ownership. SCIM token issuance did not reject all account-provider namespaces. An authenticated user could therefore mint a SCIM token whose provider ID matched an existing SSO, SAML, OIDC, generic OAuth, or social provider. SCIM user routes then selected account rows by that provider ID and treated those users as SCIM-managed, even when the SCIM token had never provisioned them.
The same write path had 2 additional validation issues. First, SCIM active: false was not modeled, so identity providers could receive a successful response while the user stayed active. Second, SCIM PUT and PATCH updates changed global email addresses without the same uniqueness check used by create, and emailVerified stayed unchanged after an email reassignment.
Details
The SCIM bearer middleware decoded the provider ID from the bearer token and loaded the matching scimProvider row. User listing and user lookup then queried ordinary account rows by account.providerId. This made the provider ID a user-controlled authorization key. If a SCIM token used a provider ID that belonged to SSO, SAML, OIDC, generic OAuth, or another account provider, the SCIM routes could resolve users that the token did not own.
The highest-impact path was non-organization deletion. On affected versions, DELETE /scim/v2/Users/:id for a non-organization SCIM token deleted the global Better Auth user and their sessions after resolving the user through the colliding provider ID. A low-privileged authenticated user could therefore delete users associated with a colliding provider namespace.
Organization-scoped tokens were also affected by the provider-ID collision. If the colliding provider ID matched the organization's SSO or OIDC connection, SCIM PUT or PATCH could resolve an SSO-provisioned organization member and rewrite global profile fields. Before the patch, changing a user's email through SCIM skipped the uniqueness check and left emailVerified unchanged.
SCIM deactivation had a separate failure mode. The SCIM active attribute was missing from the user schemas and PATCH mapping, so active: false was stripped from requests. A standard identity-provider deactivation signal could return success while the user kept their identity, sessions, and access.
Patches
Fixed in @better-auth/scim@1.6.22 and @better-auth/scim@1.7.0-beta.10.
The patch rejects SCIM provider IDs that collide with built-in providers, configured social providers, generic OAuth providers, and SSO provider rows before a token is minted. It also scopes SCIM deletion to the SCIM account link when the user has other identities. The global user is deleted only when the SCIM account is the user's sole linked account.
The patch models the SCIM active attribute. App-level SCIM deactivation maps active: false to the admin plugin's enforced disabled-user state and revokes sessions. If the admin plugin is absent, the request is rejected instead of being silently dropped.
The patch adds the email uniqueness check to SCIM PUT and PATCH updates and resets emailVerified whenever SCIM changes a user's email.
Workarounds
If you cannot upgrade immediately, configure canGenerateToken to reject provider IDs that match any account provider ID used by your application. Include built-in providers, social providers, generic OAuth providers, SSO, SAML, and OIDC provider IDs. Also restrict which users can generate SCIM tokens.
Do not rely on deactivation reports from your identity provider until you have upgraded. Confirm that deactivated users have actually lost access, especially if your identity provider deprovisions through active: false.
If you use SCIM account linking, avoid broad domain-based linking rules. A shared email domain is not proof that a SCIM token may manage a pre-existing user. Prefer organization-membership checks or an explicit application predicate.
Audit existing scimProvider rows and remove any row whose providerId matches another account provider namespace.
Impact
With the provider-ID collision issue, an authenticated attacker could act through a provider namespace they did not own. They could list and read SCIM user resources for users linked to the colliding provider. They could also update profile and account fields and delete global user records on the non-organization path. In organization-scoped deployments, a colliding token could mutate global profile fields for SSO-provisioned organization members.
With the deactivation issue, a terminated user could remain active after an identity provider reported successful deprovisioning through active: false. With the email-update issue, SCIM could assign one user's email to another user on adapters without an enforced unique index. That could corrupt email-keyed login and lookup, while SQL adapters could raise an unhandled adapter error.
Credit
Found through internal validation.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.6.21"
},
"package": {
"ecosystem": "npm",
"name": "@better-auth/scim"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0-beta.27"
},
{
"fixed": "1.6.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.7.0-beta.9"
},
"package": {
"ecosystem": "npm",
"name": "@better-auth/scim"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.0-beta.0"
},
{
"fixed": "1.7.0-beta.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-639",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T15:40:54Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Am I affected?\n\nYou are affected if your application registers the `@better-auth/scim` plugin and lets authenticated users generate SCIM tokens. The default `canGenerateToken` policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account providers. The provider-ID collision issue additionally requires SSO, SAML, OIDC, generic OAuth, or social providers whose account rows use custom provider IDs, plus existing account rows under those IDs.\n\nThe deprovisioning and email-update issues require only the SCIM plugin and a valid SCIM bearer token. Published versions from `@better-auth/scim@1.4.0-beta.27` through `1.6.21` are affected. Beta versions from `1.7.0-beta.0` through `1.7.0-beta.9` are affected. Upgrade to `@better-auth/scim@1.6.22` or `1.7.0-beta.10`.\n\n### Summary\n\n`@better-auth/scim` used the same logical provider ID for SCIM provider configuration and account ownership. SCIM token issuance did not reject all account-provider namespaces. An authenticated user could therefore mint a SCIM token whose provider ID matched an existing SSO, SAML, OIDC, generic OAuth, or social provider. SCIM user routes then selected account rows by that provider ID and treated those users as SCIM-managed, even when the SCIM token had never provisioned them.\n\nThe same write path had 2 additional validation issues. First, SCIM `active: false` was not modeled, so identity providers could receive a successful response while the user stayed active. Second, SCIM PUT and PATCH updates changed global email addresses without the same uniqueness check used by create, and `emailVerified` stayed unchanged after an email reassignment.\n\n### Details\n\nThe SCIM bearer middleware decoded the provider ID from the bearer token and loaded the matching `scimProvider` row. User listing and user lookup then queried ordinary account rows by `account.providerId`. This made the provider ID a user-controlled authorization key. If a SCIM token used a provider ID that belonged to SSO, SAML, OIDC, generic OAuth, or another account provider, the SCIM routes could resolve users that the token did not own.\n\nThe highest-impact path was non-organization deletion. On affected versions, `DELETE /scim/v2/Users/:id` for a non-organization SCIM token deleted the global Better Auth user and their sessions after resolving the user through the colliding provider ID. A low-privileged authenticated user could therefore delete users associated with a colliding provider namespace.\n\nOrganization-scoped tokens were also affected by the provider-ID collision. If the colliding provider ID matched the organization\u0027s SSO or OIDC connection, SCIM PUT or PATCH could resolve an SSO-provisioned organization member and rewrite global profile fields. Before the patch, changing a user\u0027s email through SCIM skipped the uniqueness check and left `emailVerified` unchanged.\n\nSCIM deactivation had a separate failure mode. The SCIM `active` attribute was missing from the user schemas and PATCH mapping, so `active: false` was stripped from requests. A standard identity-provider deactivation signal could return success while the user kept their identity, sessions, and access.\n\n### Patches\n\nFixed in `@better-auth/scim@1.6.22` and `@better-auth/scim@1.7.0-beta.10`.\n\nThe patch rejects SCIM provider IDs that collide with built-in providers, configured social providers, generic OAuth providers, and SSO provider rows before a token is minted. It also scopes SCIM deletion to the SCIM account link when the user has other identities. The global user is deleted only when the SCIM account is the user\u0027s sole linked account.\n\nThe patch models the SCIM `active` attribute. App-level SCIM deactivation maps `active: false` to the admin plugin\u0027s enforced disabled-user state and revokes sessions. If the admin plugin is absent, the request is rejected instead of being silently dropped.\n\nThe patch adds the email uniqueness check to SCIM PUT and PATCH updates and resets `emailVerified` whenever SCIM changes a user\u0027s email.\n\n### Workarounds\n\nIf you cannot upgrade immediately, configure `canGenerateToken` to reject provider IDs that match any account provider ID used by your application. Include built-in providers, social providers, generic OAuth providers, SSO, SAML, and OIDC provider IDs. Also restrict which users can generate SCIM tokens.\n\nDo not rely on deactivation reports from your identity provider until you have upgraded. Confirm that deactivated users have actually lost access, especially if your identity provider deprovisions through `active: false`.\n\nIf you use SCIM account linking, avoid broad domain-based linking rules. A shared email domain is not proof that a SCIM token may manage a pre-existing user. Prefer organization-membership checks or an explicit application predicate.\n\nAudit existing `scimProvider` rows and remove any row whose `providerId` matches another account provider namespace.\n\n### Impact\n\nWith the provider-ID collision issue, an authenticated attacker could act through a provider namespace they did not own. They could list and read SCIM user resources for users linked to the colliding provider. They could also update profile and account fields and delete global user records on the non-organization path. In organization-scoped deployments, a colliding token could mutate global profile fields for SSO-provisioned organization members.\n\nWith the deactivation issue, a terminated user could remain active after an identity provider reported successful deprovisioning through `active: false`. With the email-update issue, SCIM could assign one user\u0027s email to another user on adapters without an enforced unique index. That could corrupt email-keyed login and lookup, while SQL adapters could raise an unhandled adapter error.\n\n### Credit\n\nFound through internal validation.",
"id": "GHSA-rjg6-39jm-rgg4",
"modified": "2026-07-24T15:40:54Z",
"published": "2026-07-24T15:40:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/pull/10242"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/commit/7c126dcd1aad24468ec37e876545c1d083d8acca"
},
{
"type": "PACKAGE",
"url": "https://github.com/better-auth/better-auth"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.22"
},
{
"type": "WEB",
"url": "https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "@better-auth/scim: account takeover and stale access via SCIM provider-id collision"
}
GHSA-RJGV-2M3V-C2V3
Vulnerability from github – Published: 2025-12-13 18:30 – Updated: 2025-12-13 18:30The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary user accounts with the administrator role.
{
"affected": [],
"aliases": [
"CVE-2025-14397"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-13T16:16:49Z",
"severity": "HIGH"
},
"details": "The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the postem_ipsum_generate_users() function in all versions up to, and including, 3.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary user accounts with the administrator role.",
"id": "GHSA-rjgv-2m3v-c2v3",
"modified": "2025-12-13T18:30:21Z",
"published": "2025-12-13T18:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14397"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/postem-ipsum/trunk/admin/postem-ipsum-admin.php#L1150"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/229c146d-3f99-4f63-9a6f-997075846815?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RJH4-5HVF-F2F8
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.
{
"affected": [],
"aliases": [
"CVE-2021-30155"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-09T07:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permissions to create and set the content model of a nonexistent page.",
"id": "GHSA-rjh4-5hvf-f2f8",
"modified": "2022-05-24T17:47:01Z",
"published": "2022-05-24T17:47:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30155"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00003.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00006.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT"
},
{
"type": "WEB",
"url": "https://phabricator.wikimedia.org/T270988"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202107-40"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4889"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RJH7-PFJ7-7MQ7
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through <= 4.3.4.
{
"affected": [],
"aliases": [
"CVE-2026-32434"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:55:03Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VW Fitness: from n/a through \u003c= 4.3.4.",
"id": "GHSA-rjh7-pfj7-7mq7",
"modified": "2026-03-13T21:31:50Z",
"published": "2026-03-13T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32434"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Theme/vw-fitness/vulnerability/wordpress-vw-fitness-theme-4-3-4-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RJJ3-8XXQ-VXR6
Vulnerability from github – Published: 2025-09-06 06:30 – Updated: 2025-09-06 06:30The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings' action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters for organization settings and passes them directly to update_option() without any check of the user’s capabilities or a CSRF nonce. This makes it possible for unauthenticated attackers to change critical configuration (including toggling signing and encryption), potentially breaking the SSO flow and causing a denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2025-7040"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-06T04:16:02Z",
"severity": "HIGH"
},
"details": "The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the \u0027set_organization_settings\u0027 action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters for organization settings and passes them directly to update_option() without any check of the user\u2019s capabilities or a CSRF nonce. This makes it possible for unauthenticated attackers to change critical configuration (including toggling signing and encryption), potentially breaking the SSO flow and causing a denial-of-service.",
"id": "GHSA-rjj3-8xxq-vxr6",
"modified": "2025-09-06T06:30:32Z",
"published": "2025-09-06T06:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7040"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/assets/CSSO_Init.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/assets/base/CSSO_ActionHandler.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/assets/base/CSSO_services.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/tags/1.0.19/saml-sso-plugin.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/cloud-sso-single-sign-on/trunk/assets/base/CSSO_ActionHandler.php?rev=3354459#L202"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/cloud-sso-single-sign-on/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59622166-3316-42e5-bf28-69eb38231755?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-RJM5-8QXF-JGHP
Vulnerability from github – Published: 2026-01-23 15:31 – Updated: 2026-01-23 22:35Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through <= 1.7.3.
{
"affected": [],
"aliases": [
"CVE-2026-24625"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-23T15:16:21Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through \u003c= 1.7.3.",
"id": "GHSA-rjm5-8qxf-jghp",
"modified": "2026-01-23T22:35:52Z",
"published": "2026-01-23T15:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24625"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/woo-addon-uploads/vulnerability/wordpress-file-uploads-addon-for-woocommerce-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.