Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5703 vulnerabilities reference this CWE, most recent first.
CVE-2016-9575 (GCVE-0-2016-9575)
Vulnerability from cvelistv5 – Published: 2018-03-13 13:00 – Updated: 2024-09-16 22:51
VLAI
EPSS
VEX
Summary
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
Severity
No CVSS data available.
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1395311 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/95068 | vdb-entryx_refsource_BID |
| http://rhn.redhat.com/errata/RHSA-2017-0001.html | vendor-advisoryx_refsource_REDHAT |
Impacted products
Date Public
2016-12-14 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:59:01.675Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1395311"
},
{
"name": "95068",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95068"
},
{
"name": "RHSA-2017:0001",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0001.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ipa",
"vendor": "FreeIPA",
"versions": [
{
"status": "affected",
"version": "4.2.x"
},
{
"status": "affected",
"version": "4.3.x before 4.3.3"
},
{
"status": "affected",
"version": "4.4.x before 4.4.3"
}
]
}
],
"datePublic": "2016-12-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user\u0027s permissions while modifying certificate profiles in IdM\u0027s certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-30T20:57:02.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1395311"
},
{
"name": "95068",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95068"
},
{
"name": "RHSA-2017:0001",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2017-0001.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"DATE_PUBLIC": "2016-12-14T00:00:00",
"ID": "CVE-2016-9575",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ipa",
"version": {
"version_data": [
{
"version_value": "4.2.x"
},
{
"version_value": "4.3.x before 4.3.3"
},
{
"version_value": "4.4.x before 4.4.3"
}
]
}
}
]
},
"vendor_name": "FreeIPA"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user\u0027s permissions while modifying certificate profiles in IdM\u0027s certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1395311",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1395311"
},
{
"name": "95068",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95068"
},
{
"name": "RHSA-2017:0001",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2017-0001.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-9575",
"datePublished": "2018-03-13T13:00:00.000Z",
"dateReserved": "2016-11-23T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:51:45.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2525 (GCVE-0-2010-2525)
Vulnerability from cvelistv5 – Published: 2021-06-22 11:39 – Updated: 2024-08-07 02:39
VLAI
EPSS
VEX
Summary
A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system.
Severity
No CVSS data available.
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://ubuntu.com/security/CVE-2010-2525 | x_refsource_MISC |
| https://git.kernel.org/pub/scm/linux/kernel/git/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:39:37.258Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ubuntu.com/security/CVE-2010-2525"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2646a1f61a3b5525914757f10fa12b5b94713648"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "kernel",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "kernel 2.6.33-rc1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was discovered in gfs2 file system\u2019s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-22T11:39:48.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ubuntu.com/security/CVE-2010-2525"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2646a1f61a3b5525914757f10fa12b5b94713648"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-2525",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "kernel",
"version": {
"version_data": [
{
"version_value": "kernel 2.6.33-rc1"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw was discovered in gfs2 file system\u2019s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ubuntu.com/security/CVE-2010-2525",
"refsource": "MISC",
"url": "https://ubuntu.com/security/CVE-2010-2525"
},
{
"name": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2646a1f61a3b5525914757f10fa12b5b94713648",
"refsource": "MISC",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2646a1f61a3b5525914757f10fa12b5b94713648"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-2525",
"datePublished": "2021-06-22T11:39:48.000Z",
"dateReserved": "2010-06-30T00:00:00.000Z",
"dateUpdated": "2024-08-07T02:39:37.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-1435 (GCVE-0-2010-1435)
Vulnerability from cvelistv5 – Published: 2021-06-21 22:24 – Updated: 2024-08-07 01:21
VLAI
EPSS
VEX
Summary
Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Severity
No CVSS data available.
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://developer.joomla.org/security-centre/308-… | x_refsource_MISC |
| https://www.acunetix.com/vulnerabilities/web/joom… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T01:21:19.045Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://developer.joomla.org/security-centre/308-20100423-core-password-reset-tokens.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.acunetix.com/vulnerabilities/web/joomla-core-1-5-x-security-bypass-1-5-0-1-5-15/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Joomla",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Joomla core from 1.5.0 up to and including 1.5.15"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-21T22:24:23.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://developer.joomla.org/security-centre/308-20100423-core-password-reset-tokens.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.acunetix.com/vulnerabilities/web/joomla-core-1-5-x-security-bypass-1-5-0-1-5-15/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-1435",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Joomla",
"version": {
"version_data": [
{
"version_value": "Joomla core from 1.5.0 up to and including 1.5.15"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://developer.joomla.org/security-centre/308-20100423-core-password-reset-tokens.html",
"refsource": "MISC",
"url": "https://developer.joomla.org/security-centre/308-20100423-core-password-reset-tokens.html"
},
{
"name": "https://www.acunetix.com/vulnerabilities/web/joomla-core-1-5-x-security-bypass-1-5-0-1-5-15/",
"refsource": "MISC",
"url": "https://www.acunetix.com/vulnerabilities/web/joomla-core-1-5-x-security-bypass-1-5-0-1-5-15/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-1435",
"datePublished": "2021-06-21T22:24:23.000Z",
"dateReserved": "2010-04-15T00:00:00.000Z",
"dateUpdated": "2024-08-07T01:21:19.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-222P-485J-75XG
Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2022-05-13 01:31
VLAI
Details
ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations.
Severity
6.8 (Medium)
{
"affected": [],
"aliases": [
"CVE-2018-7366"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-28T16:29:00Z",
"severity": "MODERATE"
},
"details": "ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentication bypass vulnerability, which may allows an unauthorized user to perform unauthorized operations.",
"id": "GHSA-222p-485j-75xg",
"modified": "2022-05-13T01:31:54Z",
"published": "2022-05-13T01:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7366"
},
{
"type": "WEB",
"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1010023"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2237-6M5H-9JW6
Vulnerability from github – Published: 2025-07-15 21:31 – Updated: 2025-07-15 21:31
VLAI
Details
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-50084"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-15T20:15:44Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).",
"id": "GHSA-2237-6m5h-9jw6",
"modified": "2025-07-15T21:31:41Z",
"published": "2025-07-15T21:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50084"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-223J-7CJ4-4CW7
Vulnerability from github – Published: 2025-01-09 21:31 – Updated: 2025-01-10 18:31
VLAI
Details
Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-13278"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T20:15:36Z",
"severity": "CRITICAL"
},
"details": "Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.",
"id": "GHSA-223j-7cj4-4cw7",
"modified": "2025-01-10T18:31:40Z",
"published": "2025-01-09T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13278"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2024-042"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-223W-3RXG-P29X
Vulnerability from github – Published: 2022-11-02 12:00 – Updated: 2022-11-03 19:00
VLAI
Details
Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-3780"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-01T19:15:00Z",
"severity": "HIGH"
},
"details": "Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions.",
"id": "GHSA-223w-3rxg-p29x",
"modified": "2022-11-03T19:00:24Z",
"published": "2022-11-02T12:00:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3780"
},
{
"type": "WEB",
"url": "https://devolutions.net/security/advisories/DEVO-2022-0008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2268-HC24-W7PM
Vulnerability from github – Published: 2022-12-13 21:30 – Updated: 2022-12-13 21:30
VLAI
Details
Azure Network Watcher Agent Security Feature Bypass Vulnerability.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-44699"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-13T19:15:00Z",
"severity": "MODERATE"
},
"details": "Azure Network Watcher Agent Security Feature Bypass Vulnerability.",
"id": "GHSA-2268-hc24-w7pm",
"modified": "2022-12-13T21:30:27Z",
"published": "2022-12-13T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44699"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44699"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-44699"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-226G-QX73-56W6
Vulnerability from github – Published: 2026-03-06 00:31 – Updated: 2026-03-06 00:31
VLAI
Details
Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-28709"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-06T00:16:11Z",
"severity": "MODERATE"
},
"details": "Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.",
"id": "GHSA-226g-qx73-56w6",
"modified": "2026-03-06T00:31:35Z",
"published": "2026-03-06T00:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28709"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-5889"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-228V-WC5R-J8M7
Vulnerability from github – Published: 2026-03-12 14:20 – Updated: 2026-03-12 14:21
VLAI
Summary
OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream
Details
Summary
OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.
Details
The issue is in the live event streaming path.
EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:
- service/internal/api/api.go:776
After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:
- service/internal/api/api.go:846 OnExecutionStarted
- service/internal/api/api.go:869 OnExecutionFinished
- service/internal/api/api.go:1047 OnOutputChunk
The event payload includes action output through:
- service/internal/api/api.go:295 internalLogEntryToPb
- service/internal/api/api.go:302 Output
By contrast, the normal log APIs do apply per-action authorization checks:
- service/internal/api/api.go:518 GetLogs
- service/internal/api/api.go:585 GetActionLogs
- service/internal/api/api.go:544 isLogEntryAllowed
Root cause:
- the subscription path enforces only coarse dashboard access
- execution callbacks broadcast to every connected client
- no per-recipient ACL check is applied before sending action metadata or output
I validated the issue using:
- an admin user with full ACLs
- an alice user with no ACLs
- a protected action that outputs TOPSECRET=alpha-bravo-charlie
Despite having no relevant ACLs, alice still receives the ExecutionFinished event for the privileged action, including the protected output.
PoC
Tested version:
- 3000.10.2
- Fetch and check out 3000.10.2 in a clean worktree:
git -C OliveTin fetch origin tag 3000.10.2
git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2
- Copy the PoC test into the clean tree:
cp OliveTin/service/internal/api/event_stream_leak_test.go \
OliveTin-3000.10.2/service/internal/api/
- Run the targeted PoC test:
cd OliveTin-3000.10.2/service
go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v
- Optional: save validation output:
go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v \
2>&1 | tee /tmp/olivetin_eventstream_3000.10.2.log
Observed validation output:
=== RUN TestEventStreamLeaksUnauthorizedExecutionOutput
time="2026-03-01T04:44:59-05:00" level=info msg="Action requested" actionTitle=secret-action tags="[]"
time="2026-03-01T04:44:59-05:00" level=info msg="Action parse args - Before" actionTitle=secret-action cmd="echo 'TOPSECRET=alpha-bravo-charlie'"
time="2026-03-01T04:44:59-05:00" level=info msg="Action parse args - After" actionTitle=secret-action cmd="echo 'TOPSECRET=alpha-bravo-charlie'"
time="2026-03-01T04:44:59-05:00" level=info msg="Action started" actionTitle=secret-action timeout=1
time="2026-03-01T04:44:59-05:00" level=info msg="Action finished" actionTitle=secret-action exit=0 outputLength=30 timedOut=false
--- PASS: TestEventStreamLeaksUnauthorizedExecutionOutput (0.00s)
PASS
ok github.com/OliveTin/OliveTin/internal/api 0.025s
What this proves:
- admin can execute the protected action
- alice has no ACLs
- alice still receives the streamed completion event for the protected action
- protected action output is exposed through the event stream
Impact
This is an authenticated broken access control / information disclosure vulnerability.
A low-privileged authenticated user can subscribe to EventStream and receive:
- action execution metadata
- execution tracking IDs
- initiating username
- live output chunks
- final command output
Who is impacted:
- multi-user OliveTin deployments
- environments where privileged actions produce secrets, tokens, internal system details, or other sensitive operational output
- deployments where lower-privileged authenticated users can access the dashboard and subscribe to live events
This bypasses intended per-action log/view restrictions for protected actions.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/OliveTin/OliveTin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3000.10.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32102"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-12T14:20:16Z",
"nvd_published_at": "2026-03-11T21:16:16Z",
"severity": "HIGH"
},
"details": "### Summary\n\n OliveTin\u2019s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are\n not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.\n\n\n\n\n### Details\nThe issue is in the live event streaming path.\n\n EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:\n\n - service/internal/api/api.go:776\n\n After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:\n\n - service/internal/api/api.go:846 OnExecutionStarted\n - service/internal/api/api.go:869 OnExecutionFinished\n - service/internal/api/api.go:1047 OnOutputChunk\n\n The event payload includes action output through:\n\n - service/internal/api/api.go:295 internalLogEntryToPb\n - service/internal/api/api.go:302 Output\n\n By contrast, the normal log APIs do apply per-action authorization checks:\n\n - service/internal/api/api.go:518 GetLogs\n - service/internal/api/api.go:585 GetActionLogs\n - service/internal/api/api.go:544 isLogEntryAllowed\n\n Root cause:\n\n - the subscription path enforces only coarse dashboard access\n - execution callbacks broadcast to every connected client\n - no per-recipient ACL check is applied before sending action metadata or output\n\n I validated the issue using:\n\n - an admin user with full ACLs\n - an alice user with no ACLs\n - a protected action that outputs TOPSECRET=alpha-bravo-charlie\n\n Despite having no relevant ACLs, alice still receives the ExecutionFinished event for the privileged action, including the protected output.\n\n\n\n### PoC\nTested version:\n```\n - 3000.10.2\n```\n 1. Fetch and check out 3000.10.2 in a clean worktree:\n```bash\n git -C OliveTin fetch origin tag 3000.10.2\n git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2\n```\n 2. Copy the PoC test into the clean tree:\n```bash\n cp OliveTin/service/internal/api/event_stream_leak_test.go \\\n OliveTin-3000.10.2/service/internal/api/\n```\n 3. Run the targeted PoC test:\n```bash\n cd OliveTin-3000.10.2/service\n go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v\n```\n 4. Optional: save validation output:\n```bash\n go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v \\\n 2\u003e\u00261 | tee /tmp/olivetin_eventstream_3000.10.2.log\n```\n Observed validation output:\n```bash\n === RUN TestEventStreamLeaksUnauthorizedExecutionOutput\n time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action requested\" actionTitle=secret-action tags=\"[]\"\n time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action parse args - Before\" actionTitle=secret-action cmd=\"echo \u0027TOPSECRET=alpha-bravo-charlie\u0027\"\n time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action parse args - After\" actionTitle=secret-action cmd=\"echo \u0027TOPSECRET=alpha-bravo-charlie\u0027\"\n time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action started\" actionTitle=secret-action timeout=1\n time=\"2026-03-01T04:44:59-05:00\" level=info msg=\"Action finished\" actionTitle=secret-action exit=0 outputLength=30 timedOut=false\n --- PASS: TestEventStreamLeaksUnauthorizedExecutionOutput (0.00s)\n PASS\n ok github.com/OliveTin/OliveTin/internal/api 0.025s\n```\n What this proves:\n\n - admin can execute the protected action\n - alice has no ACLs\n - alice still receives the streamed completion event for the protected action\n - protected action output is exposed through the event stream\n\n\n### Impact\n This is an authenticated broken access control / information disclosure vulnerability.\n\n A low-privileged authenticated user can subscribe to EventStream and receive:\n\n - action execution metadata\n - execution tracking IDs\n - initiating username\n - live output chunks\n - final command output\n\n Who is impacted:\n\n - multi-user OliveTin deployments\n - environments where privileged actions produce secrets, tokens, internal system details, or other sensitive operational output\n - deployments where lower-privileged authenticated users can access the dashboard and subscribe to live events\n\n This bypasses intended per-action log/view restrictions for protected actions.",
"id": "GHSA-228v-wc5r-j8m7",
"modified": "2026-03-12T14:21:00Z",
"published": "2026-03-12T14:20:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-228v-wc5r-j8m7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32102"
},
{
"type": "PACKAGE",
"url": "https://github.com/OliveTin/OliveTin"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.