Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

7171 vulnerabilities reference this CWE, most recent first.

GCVE-1988-2026-0414

Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57

Title

HP Advance / Output Central: unauthenticated SYSTEM RCE and two additional vulnerabilities (CVE-2026-89082/89083/89084)

Summary

HP Advance / HP Output Central CVE-2026-89082, CVE-2026-89083, CVE-2026-89084 ================================================================ SUMMARY ================================================================ Vendor: HP Inc. Product family named by HP: HP Advance Products in HP's update table: HP AC Print & Scan; HP Output Central Components: Drivve SecureScan, MFPsecure Severity: two Critical (9.3), one High (8.8), CVSS 4.0 Confirmed on: V1R4.0.026 Vendor bulletin: HPSBPI04149 / PSR-2026-0126, published 2026-09-16 Researcher: Joseph Chiarchiaro, https://printoverrun.com ================================================================ [1] CVE-2026-89082 - 9.3 Critical Unauthenticated archive path traversal leading to SYSTEM code execution ================================================================ Vulnerable component: Drivve SecureScan log-viewer web application CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N HP CNA CWE: CWE-94 Researcher assessment: CWE-22, CWE-306 ================================================================ [2] CVE-2026-89083 - 9.3 Critical Forged-header bypass of a local-only authorization gate ================================================================ Vulnerable component: MFPsecure device-integration SOAP service CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N HP CNA CWE: CWE-94 Researcher assessment: CWE-290, CWE-863 ================================================================ [3] CVE-2026-89084 - 8.8 High Unauthenticated .xml file write and deletion as SYSTEM ================================================================ Vulnerable component: MFPsecure device-integration SOAP service CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N HP CNA CWE: CWE-22 Additional researcher assessment: CWE-306 ================================================================ AFFECTED VERSIONS AND REMEDIATION ================================================================ The underlying behavior for all three findings was confirmed on V1R4.0.026. HP's security bulletin lists the following updated R4 versions: - HP AC Print & Scan: V1R4.0.027 or later - HP Output Central: V1R4.0.029 ================================================================ MITIGATION ================================================================ The affected paths themselves require no authentication. ================================================================ DISCLOSURE TIMELINE ================================================================ 2026-06-01 Reported to HP PSRT. 2026-06-24 All three reported root behaviors confirmed on V1R4.0.026. 2026-07-21 HP validated the findings; fixes in progress. 2026-09-14 CVE assignments and CVSS scores communicated by HP. 2026-09-16 HP security bulletin and researcher advisories published. ================================================================ TECHNICAL DETAILS ================================================================ ================================================================ REFERENCES ================================================================ HP Security Bulletin HPSBPI04149 / PSR-2026-0126: https://support.hp.com/us-en/document/ish_15646496-15646518-16/hpsbpi04149 CVE-2026-89082: https://printoverrun.com/disclosures/cve-2026-89082/ https://www.cve.org/CVERecord?id=CVE-2026-89082 CVE-2026-89083: https://printoverrun.com/disclosures/cve-2026-89083/ https://www.cve.org/CVERecord?id=CVE-2026-89083 CVE-2026-89084: https://printoverrun.com/disclosures/cve-2026-89084/ https://www.cve.org/CVERecord?id=CVE-2026-89084 ================================================================ CVE assignment and CVSS scoring: HP Inc. as CNA. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

CWE

Assigner

VULNARCHIVE GNA GNA-1988

GNA scorecard E 38/100 over 445 records in the last 180 days details

References

12 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Sep/66	technical-description
https://nmap.org/mailman/listinfo/fulldisclosure
https://printoverrun.com
https://printoverrun.com/disclosures/cve-2026-89082/
https://printoverrun.com/disclosures/cve-2026-89083/
https://printoverrun.com/disclosures/cve-2026-89084/
https://seclists.org/fulldisclosure/
https://support.hp.com/us-en/document/ish_1564649…
https://www.cve.org/CVERecord?id=CVE-2026-89082
https://www.cve.org/CVERecord?id=CVE-2026-89083
https://www.cve.org/CVERecord?id=CVE-2026-89084

Impacted products

1 product

Vendor	Product	Version
HP Inc.	HP Advance /	Affected: unknown

Credits

Joe via Fulldisclosure

Relationships

reference GCVE-1988-2026-0414 (this record)

related CVE-2026-89082
related CVE-2026-89083
related CVE-2026-89084

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "HP Advance /",
          "vendor": "HP Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joe via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HP Advance / HP Output Central\n\nCVE-2026-89082, CVE-2026-89083, CVE-2026-89084\n\n================================================================\nSUMMARY\n================================================================\n\nVendor: HP Inc.\nProduct family named by HP: HP Advance\nProducts in HP\u0027s update table: HP AC Print \u0026 Scan; HP Output Central\nComponents: Drivve SecureScan, MFPsecure\nSeverity: two Critical (9.3), one High (8.8), CVSS 4.0\nConfirmed on: V1R4.0.026\n\nVendor bulletin: HPSBPI04149 / PSR-2026-0126, published 2026-09-16\nResearcher: Joseph Chiarchiaro, https://printoverrun.com\n\n\n\n\n\n\n\n================================================================\n[1] CVE-2026-89082 - 9.3 Critical\nUnauthenticated archive path traversal leading to SYSTEM code execution\n================================================================\n\nVulnerable component: Drivve SecureScan log-viewer web application\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\nHP CNA CWE: CWE-94\nResearcher assessment: CWE-22, CWE-306\n\n\n\n\n\n================================================================\n[2] CVE-2026-89083 - 9.3 Critical\nForged-header bypass of a local-only authorization gate\n================================================================\n\nVulnerable component: MFPsecure device-integration SOAP service\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N\nHP CNA CWE: CWE-94\nResearcher assessment: CWE-290, CWE-863\n\n\n\n\n\n\n\n================================================================\n[3] CVE-2026-89084 - 8.8 High\nUnauthenticated .xml file write and deletion as SYSTEM\n================================================================\n\nVulnerable component: MFPsecure device-integration SOAP service\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N\nHP CNA CWE: CWE-22\nAdditional researcher assessment: CWE-306\n\n\n\n\n\n================================================================\nAFFECTED VERSIONS AND REMEDIATION\n================================================================\n\nThe underlying behavior for all three findings was confirmed on V1R4.0.026.\n\nHP\u0027s security bulletin lists the following updated R4 versions:\n\n- HP AC Print \u0026 Scan: V1R4.0.027 or later\n- HP Output Central: V1R4.0.029\n\n\n\n\n\n\n\n\n\n================================================================\nMITIGATION\n================================================================\n\n\n\n\n\nThe affected paths themselves require no authentication.\n\n================================================================\nDISCLOSURE TIMELINE\n================================================================\n\n2026-06-01 Reported to HP PSRT.\n2026-06-24 All three reported root behaviors confirmed on V1R4.0.026.\n\n2026-07-21 HP validated the findings; fixes in progress.\n2026-09-14 CVE assignments and CVSS scores communicated by HP.\n2026-09-16 HP security bulletin and researcher advisories published.\n\n================================================================\nTECHNICAL DETAILS\n================================================================\n\n\n\n\n\n================================================================\nREFERENCES\n================================================================\n\nHP Security Bulletin HPSBPI04149 / PSR-2026-0126:\nhttps://support.hp.com/us-en/document/ish_15646496-15646518-16/hpsbpi04149\n\nCVE-2026-89082:\nhttps://printoverrun.com/disclosures/cve-2026-89082/\nhttps://www.cve.org/CVERecord?id=CVE-2026-89082\n\nCVE-2026-89083:\nhttps://printoverrun.com/disclosures/cve-2026-89083/\nhttps://www.cve.org/CVERecord?id=CVE-2026-89083\n\nCVE-2026-89084:\nhttps://printoverrun.com/disclosures/cve-2026-89084/\nhttps://www.cve.org/CVERecord?id=CVE-2026-89084\n\n================================================================\n\nCVE assignment and CVSS scoring: HP Inc. as CNA.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-290",
              "description": "CWE-290",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-306",
              "description": "CWE-306",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-94",
              "description": "CWE-94",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/66"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/66"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://printoverrun.com"
        },
        {
          "url": "https://printoverrun.com/disclosures/cve-2026-89082/"
        },
        {
          "url": "https://printoverrun.com/disclosures/cve-2026-89083/"
        },
        {
          "url": "https://printoverrun.com/disclosures/cve-2026-89084/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.hp.com/us-en/document/ish_15646496-15646518-16/hpsbpi04149"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89082"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89083"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89084"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/66"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "HP Advance / Output Central: unauthenticated SYSTEM RCE and two additional vulnerabilities (CVE-2026-89082/89083/89084)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-89082",
              "type": "related"
            },
            {
              "destId": "CVE-2026-89083",
              "type": "related"
            },
            {
              "destId": "CVE-2026-89084",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0414",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/66",
            "automated": true,
            "contentSha256": "75c913fd2efa9eb3d96a8cda714ef4654ed992e9b3aa0b7155b60fbfa0d5b5dc",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/66",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-17T06:12:36Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0414"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:32Z",
    "dateUpdated": "2026-10-02T04:57:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0414"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0161

Vulnerability from gna-1988 – Published: 2026-09-07 13:35 – Updated: 2026-09-11 11:56

Title

[0day-rubbish] Akana API Platform 8.4.29 Unauthenticated RCE via path-normalization filter/dispatcher discrepancy (9.8)

Summary

0day Rubbish Research Team is publicly disclosing a vulnerability in Akana API Platform 8.4.29. Type: Unauthenticated RCE via path-normalization filter/dispatcher discrepancy (CWE-863) CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Impact: Unauthenticated code execution inside the API platform container: gateway policies, credentials, proxied traffic, and the management plane become accessible. Authentication: unauthenticated / pre-auth Full technical analysis and a reproducible proof-of-concept: https://0day-rubbish.com/blog/akana-api-platform-path-normalization-unauth-rce Project archive (ongoing disclosure series): https://github.com/Exploit-Garbage/0day-Rubbish Vendor has been notified. CVE ID is pending. -- 0day Rubbish Research Team disclosure () 0day-rubbish com https://0day-rubbish.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

CWE

CWE-863

Assigner

VULNARCHIVE GNA GNA-1988

GNA scorecard E 38/100 over 445 records in the last 180 days details

References

7 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-descriptionexploit
https://seclists.org/fulldisclosure/2026/Sep/1	technical-description
https://0day-rubbish.com
https://0day-rubbish.com/blog/akana-api-platform-…
https://github.com/Exploit-Garbage/0day-Rubbish
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

Impacted products

1 product

Vendor	Product	Version
Akana	Akana Api Platform	Affected: unknown

Credits

disclosure via Fulldisclosure

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Akana Api Platform",
          "vendor": "Akana",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Akana API Platform 8.4.29.\n\nType: Unauthenticated RCE via path-normalization filter/dispatcher discrepancy (CWE-863)\nCVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)\nImpact: Unauthenticated code execution inside the API platform container: gateway policies, credentials, proxied \ntraffic, and the management plane become accessible.\nAuthentication: unauthenticated / pre-auth\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/akana-api-platform-path-normalization-unauth-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nVendor has been notified. CVE ID is pending.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T11:56:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/1"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/akana-api-platform-path-normalization-unauth-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/1"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Akana API Platform 8.4.29 Unauthenticated RCE via path-normalization filter/dispatcher discrepancy (9.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0161",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/1",
            "automated": true,
            "contentSha256": "320bc2cdcdd33d88a073a0d0c4bec80b90af34055bc7de4a8ca9577b609077fa",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/1",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-31T15:09:53Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:35:56Z",
    "dateUpdated": "2026-09-11T11:56:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0161"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1-2026-0030 (CVE-2026-44380)

Vulnerability from gna-1 – Published: 2026-04-29 20:10 – Updated: 2026-05-06 16:01

Title

MISP - Improper access control in auth key reset allows privilege escalation to site administrator

Summary

An improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. The issue is fixed by preventing non-site administrators from viewing or resetting authentication keys associated with site administrator roles.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

CWE

CWE-863 - Incorrect Authorization

Assigner

CIRCL GNA GNA-1 This instance

GNA scorecard B 90/100 over 243 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/MISP/MISP/commit/cb4048873ca93…	patch

Impacted products

1 product

Vendor	Product	Version
misp	misp	Affected: 0 , < <2.5.37 (semver)

Credits

Andras Iklody (the Insomniac MISP lead dev) Jeroen Gui

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "misp",
          "vendor": "misp",
          "versions": [
            {
              "lessThan": "\u003c2.5.37",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Gui"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. The issue is fixed by preventing non-site administrators from viewing or resetting authentication keys associated with site administrator roles."
            }
          ],
          "value": "An improper access control vulnerability in the authentication key reset functionality allowed an authenticated organization administrator to reset authentication keys belonging to site administrator accounts within the same organization. Because non-site administrators were not explicitly prevented from accessing or resetting site administrator auth keys, an attacker with organization administrator privileges could potentially obtain a newly generated auth key for a higher-privileged account and use it to escalate privileges. The issue is fixed by preventing non-site administrators from viewing or resetting authentication keys associated with site administrator roles."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/MISP/MISP/commit/cb4048873ca934855007406b87ae0d124f50224a"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP - Improper access control in auth key reset allows privilege escalation to site administrator",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-0030"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "cveId": "CVE-2026-44380",
    "datePublished": "2026-04-29T20:10:00.000Z",
    "dateUpdated": "2026-05-06T16:01:17.334511Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "GCVE-1-2026-0030",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-04-29T20:10:32.991353Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-05-06T16:01:17.334511Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GCVE-1-2026-0004

Vulnerability from gna-1 – Published: 2026-01-13 15:28 – Updated: 2026-01-13 15:38

Title

Authorization Bypass in Cerebrate IndividualsController Edit Function

Summary

A privilege escalation vulnerability exists in the IndividualsController::edit() function of Cerebrate prior to the fixed version, where an inverted permission check allowed unauthorized users to modify the uuid field of Individual records. Due to an incorrect conditional statement, non-community-admin users were able to set or alter the UUID of an individual, potentially leading to identity spoofing, data corruption, or unauthorized object takeover.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

CWE

CWE-863 - Incorrect Authorization
CWE-269 - Improper Privilege Management

Assigner

CIRCL GNA GNA-1 This instance

GNA scorecard B 90/100 over 243 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/cerebrate-project/cerebrate/co…	patch

Impacted products

1 product

Vendor	Product	Version
cerebrate	cerebrate	Affected: < 1.31

Credits

🕵️‍♂️ Jeroen Pinoy 🐞 Andras Iklody

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cerebrate",
          "vendor": "cerebrate",
          "versions": [
            {
              "lessThan": "1.31",
              "status": "affected"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jeroen Pinoy"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Andras Iklody"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A privilege escalation vulnerability exists in the \u003cem\u003eIndividualsController::edit()\u003c/em\u003e function of Cerebrate prior to the fixed version, where an inverted permission check allowed unauthorized users to modify the \u003ccode\u003euuid\u003c/code\u003e field of Individual records. Due to an incorrect conditional statement, non-community-admin users were able to set or alter the UUID of an individual, potentially leading to identity spoofing, data corruption, or unauthorized object takeover."
            }
          ],
          "value": "A privilege escalation vulnerability exists in the IndividualsController::edit() function of Cerebrate prior to the fixed version, where an inverted permission check allowed unauthorized users to modify the uuid field of Individual records. Due to an incorrect conditional statement, non-community-admin users were able to set or alter the UUID of an individual, potentially leading to identity spoofing, data corruption, or unauthorized object takeover."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "00000000-0000-4000-9000-000000000000"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/cerebrate-project/cerebrate/commit/2d803ae9e2d6c7a678de892de88aca3119d7926f"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authorization Bypass in Cerebrate IndividualsController Edit Function",
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "gcve-1-2026-0004"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "00000000-0000-4000-9000-000000000000",
    "datePublished": "2026-01-13T15:28:00.000Z",
    "dateUpdated": "2026-01-13T15:38:37.744618Z",
    "requesterUserId": "00000000-0000-4000-9000-000000000000",
    "serial": 1,
    "state": "PUBLISHED",
    "vulnId": "gcve-1-2026-0004",
    "vulnerabilitylookup_history": [
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-13T15:28:17.530156Z"
      ],
      [
        "alexandre.dulaunoy@circl.lu",
        "2026-01-13T15:38:37.744618Z"
      ]
    ]
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-71390 (GCVE-0-2025-71390)

Vulnerability from cvelistv5 – Published: 2026-07-18 13:10 – Updated: 2026-07-28 01:48

Title

SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution

Summary

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::<fn>(<url>) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment.

Severity

5.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-20 13:38 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , ≤ 2.1.7 (semver) Affected: 2.2.0 , < 2.2.6 (semver) Unaffected: 2.2.6 (semver) Affected: 2.3.0 , < 2.3.6 (semver) Unaffected: 2.3.6 (semver) Affected: 3.0.0-alpha.1 , ≤ 3.0.0-alpha.7 (semver) cpe:2.3:a:surrealdb:surrealdb:::::::: cpe:2.3:a:surrealdb:surrealdb:::::::: cpe:2.3:a:surrealdb:surrealdb:::::::: cpe:2.3:a:surrealdb:surrealdb::::::::

Date Public

2025-06-26 00:00

Credits

manelmontilla

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71390",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:38:50.029459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:38:56.393Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/SurrealDB",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThanOrEqual": "2.1.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.2.6",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.2.6",
              "versionType": "semver"
            },
            {
              "lessThan": "2.3.6",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.3.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.0.0-alpha.7",
              "status": "affected",
              "version": "3.0.0-alpha.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.1.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.2.6",
                  "versionStartIncluding": "2.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.3.6",
                  "versionStartIncluding": "2.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.0.0-alpha.7",
                  "versionStartIncluding": "3.0.0-alpha.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "manelmontilla"
        }
      ],
      "datePublic": "2025-06-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http::\u003cfn\u003e(\u003curl\u003e) with a hostname that resolves to a denied IP address, causing the server to issue the request anyway and return the response. This bypasses network access controls, allowing access to restricted internal endpoints and potentially retrieving or altering sensitive information and credentials, depending on the deployment."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:48:14.882Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m3c3-78fh-w3w7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-m3c3-78fh-w3w7"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-deny-net-bypass-via-dns-resolution"
        }
      ],
      "title": "SurrealDB before 2.3.6 deny-net Bypass via DNS Resolution",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71390",
    "datePublished": "2026-07-18T13:10:10.319Z",
    "dateReserved": "2026-07-16T12:14:41.770Z",
    "dateUpdated": "2026-07-28T01:48:14.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-71278 (GCVE-0-2025-71278)

Vulnerability from cvelistv5 – Published: 2026-04-01 00:30 – Updated: 2026-04-01 15:52

Title

XenForo OAuth2 Unauthorized Scope Request

Summary

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-01 14:55 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 5277 records in the last 180 days details

References

2 references

URL	Tags
https://xenforo.com/community/threads/xenforo-2-3…	vendor-advisorypatch
https://www.vulncheck.com/advisories/xenforo-oaut…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
XenForo	XenForo	Affected: 2.3.0 , < 2.3.5 (semver) cpe:2.3:a:xenforo:xenforo::::::::

Date Public

2025-01-30 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-01T14:55:30.808142Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-01T15:52:08.811Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "XenForo",
          "vendor": "XenForo",
          "versions": [
            {
              "lessThan": "2.3.5",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xenforo:xenforo:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.3.5",
                  "versionStartIncluding": "2.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-01-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond their intended authorization level."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-01T01:43:18.772Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "XenForo 2.3.5 (Includes Security Fix) \u0026 Add-ons Released",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://xenforo.com/community/threads/xenforo-2-3-5-includes-security-fix-add-ons-released.228812/"
        },
        {
          "name": "VulnCheck Advisory: XenForo OAuth2 Unauthorized Scope Request",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/xenforo-oauth2-unauthorized-scope-request"
        }
      ],
      "title": "XenForo OAuth2 Unauthorized Scope Request",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-71278",
    "datePublished": "2026-04-01T00:30:08.405Z",
    "dateReserved": "2026-04-01T00:19:58.851Z",
    "dateUpdated": "2026-04-01T15:52:08.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69417 (GCVE-0-2025-69417)

Vulnerability from cvelistv5 – Published: 2026-01-02 16:55 – Updated: 2026-01-02 21:04 Exclusively Hosted Service

Summary

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-02 21:04 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

mitre CNA under the mitre root

CNA scorecard E 27/100 over 2350 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/lufinkey/vulnerability-researc…

Impacted products

1 product

Vendor	Product	Version
Plex	plex.tv backend	Affected: 0 , ≤ 2025-12-31 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69417",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-02T21:04:17.089916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-02T21:04:29.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "plex.tv backend",
          "vendor": "Plex",
          "versions": [
            {
              "lessThanOrEqual": "2025-12-31",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T18:01:04.650Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md"
        }
      ],
      "tags": [
        "exclusively-hosted-service"
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-69417",
    "datePublished": "2026-01-02T16:55:18.307Z",
    "dateReserved": "2026-01-02T16:55:17.936Z",
    "dateUpdated": "2026-01-02T21:04:29.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69416 (GCVE-0-2025-69416)

Vulnerability from cvelistv5 – Published: 2026-01-02 16:52 – Updated: 2026-01-02 21:03 Exclusively Hosted Service

Summary

In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml.

Severity

5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-02 21:03 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

mitre CNA under the mitre root

CNA scorecard E 27/100 over 2350 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/lufinkey/vulnerability-researc…

Impacted products

1 product

Vendor	Product	Version
Plex	plex.tv backend	Affected: 0 , ≤ 2025-12-31 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69416",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-02T21:03:28.264471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-02T21:03:41.577Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "plex.tv backend",
          "vendor": "Plex",
          "versions": [
            {
              "lessThanOrEqual": "2025-12-31",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devices.xml."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T18:00:33.583Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md"
        }
      ],
      "tags": [
        "exclusively-hosted-service"
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-69416",
    "datePublished": "2026-01-02T16:52:56.991Z",
    "dateReserved": "2026-01-02T16:52:56.748Z",
    "dateUpdated": "2026-01-02T21:03:41.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69414 (GCVE-0-2025-69414)

Vulnerability from cvelistv5 – Published: 2026-01-02 16:43 – Updated: 2026-01-02 21:01

Summary

Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-02 21:01 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

mitre CNA under the mitre root

CNA scorecard E 27/100 over 2350 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/lufinkey/vulnerability-researc…

Impacted products

1 product

Vendor	Product	Version
Plex	Media Server	Affected: 0 , ≤ 1.42.2.10156 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69414",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-02T21:01:29.264915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-02T21:01:44.527Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Media Server",
          "vendor": "Plex",
          "versions": [
            {
              "lessThanOrEqual": "1.42.2.10156",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-02T17:59:42.790Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-69414",
    "datePublished": "2026-01-02T16:43:09.568Z",
    "dateReserved": "2026-01-02T16:43:09.328Z",
    "dateUpdated": "2026-01-02T21:01:44.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-69289 (GCVE-0-2025-69289)

Vulnerability from cvelistv5 – Published: 2026-01-28 19:33 – Updated: 2026-01-28 20:15

Title

Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change

Summary

Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the "require_change_email_confirmation" setting.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-28 20:13 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/discourse/discourse/security/a…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
discourse	discourse	Affected: < 3.5.4 Affected: >= 2025.11.0-latest, < 2025.11.2 Affected: >= 2025.12.0-latest, < 2025.12.1 Affected: >= 2026.1.0-latest, < 2026.1.0

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-69289",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-28T20:13:19.827893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-28T20:15:03.696Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "discourse",
          "vendor": "discourse",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.5.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 2025.11.0-latest, \u003c 2025.11.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2025.12.0-latest, \u003c 2025.12.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2026.1.0-latest, \u003c 2026.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a non-admin moderator to bypass email-change restrictions, allowing a takeover of non-staff accounts. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, ensure moderators are trusted or enable the \"require_change_email_confirmation\" setting."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T19:49:35.501Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/discourse/discourse/security/advisories/GHSA-p39j-x54c-rwqq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/discourse/discourse/security/advisories/GHSA-p39j-x54c-rwqq"
        }
      ],
      "source": {
        "advisory": "GHSA-p39j-x54c-rwqq",
        "discovery": "UNKNOWN"
      },
      "title": "Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-69289",
    "datePublished": "2026-01-28T19:33:58.921Z",
    "dateReserved": "2025-12-31T16:40:52.676Z",
    "dateUpdated": "2026-01-28T20:15:03.696Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Mitigation

Architecture and Design

Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

Mitigation

Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4

Architecture and Design

Strategy: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

Mitigation

Architecture and Design

For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

Mitigation

System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list