CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2023-25923"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-21T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an attacker to upload files that could be used in a denial of service attack due to incorrect authorization. IBM X-Force ID: 247629.",
  "id": "GHSA-3887-7vpg-g78m",
  "modified": "2023-03-24T21:30:53Z",
  "published": "2023-03-21T18:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25923"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247629"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6962729"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2640"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-26T02:15:09Z",
    "severity": "HIGH"
  },
  "details": "On Ubuntu kernels carrying both c914c0e27eb0 and \"UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs\", an unprivileged user may set privileged extended attributes on the mounted files, leading them to be set on the upper files without the appropriate security checks.",
  "id": "GHSA-38f7-vv5r-859m",
  "modified": "2024-04-04T06:21:33Z",
  "published": "2023-07-26T03:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2640"
    },
    {
      "type": "WEB",
      "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2640"
    },
    {
      "type": "WEB",
      "url": "https://lists.ubuntu.com/archives/kernel-team/2023-July/140923.html"
    },
    {
      "type": "WEB",
      "url": "https://ubuntu.com/security/notices/USN-6250-1"
    },
    {
      "type": "WEB",
      "url": "https://wiz.io/blog/ubuntu-overlayfs-vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-24609"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-03-10T17:46:00Z",
    "severity": "CRITICAL"
  },
  "details": "Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell file.",
  "id": "GHSA-38gx-pgpj-9cw5",
  "modified": "2022-03-18T00:01:21Z",
  "published": "2022-03-11T00:02:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24609"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jsjbcyber/bug_report/blob/main/bug_p"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "directus"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "11.17.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35442"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-04T06:13:57Z",
    "nvd_published_at": "2026-04-06T22:16:22Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAggregate functions (`min`, `max`) applied to fields with the `conceal` special type incorrectly return raw database values instead of the masked placeholder. When combined with `groupBy`, any authenticated user with read access to the affected collection can extract concealed field values, including static API tokens and two-factor authentication secrets from `directus_users`.\n\n### Details\n\nFields marked with `conceal` are protected by payload processing logic that replaces real values with a masked placeholder on read. This protection works correctly for standard item queries, but aggregate query results are structured differently, operations are nested under their function name rather than appearing as flat field keys. The masking logic does not account for this nested structure, causing it to silently skip concealed fields in aggregate responses and return their raw values to the client.\n\n### Impact\n\n- **Account Takeover** An authenticated attacker can harvest static API tokens for all users, including administrators, enabling immediate authentication as any account without credentials.\n\n- **2FA Bypass** TOTP seeds stored in directus_users can similarly be extracted, allowing an attacker to bypass two-factor authentication for any account.",
  "id": "GHSA-38hg-ww64-rrwc",
  "modified": "2026-04-07T14:20:19Z",
  "published": "2026-04-04T06:13:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/directus/directus/security/advisories/GHSA-38hg-ww64-rrwc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35442"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/directus/directus"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Directus: Authenticated Users Can Extract Concealed Fields via Aggregate Queries"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-25283"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-09-11T22:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions on a certain mode. The LG ID is LVE-SMP-200021 (September 2020).",
  "id": "GHSA-38rq-33wv-8xmv",
  "modified": "2022-05-24T17:28:10Z",
  "published": "2022-05-24T17:28:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25283"
    },
    {
      "type": "WEB",
      "url": "https://lgsecurity.lge.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-12492"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-06T20:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creation and information disclosure via the FT Command Centre Service and FT Controller Service services.",
  "id": "GHSA-38x8-4ffv-qww9",
  "modified": "2024-04-04T00:53:26Z",
  "published": "2022-05-24T16:47:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12492"
    },
    {
      "type": "WEB",
      "url": "https://security.gallagher.com/CVE-2019-12492"
    },
    {
      "type": "WEB",
      "url": "https://security.gallagher.com/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-superset"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-28T18:57:14Z",
    "nvd_published_at": "2023-11-27T11:15:07Z",
    "severity": "MODERATE"
  },
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-f678-j579-4xf5. This link is maintained to preserve external references.\n\n### Original Description\n\nImproper authorization check and possible privilege escalation on Apache Superset\u00a0up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset\u0027s metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data.",
  "id": "GHSA-392c-vjfv-h7wr",
  "modified": "2025-02-13T19:25:31Z",
  "published": "2023-11-27T12:30:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-f678-j579-4xf5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40610"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/superset"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/11/27/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Duplicate Advisory: Apache Superset - Elevation of Privilege",
  "withdrawn": "2024-01-10T19:16:30Z"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-48466"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-24T03:15:34Z",
    "severity": "HIGH"
  },
  "details": "Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks.",
  "id": "GHSA-3936-ppm9-g3c2",
  "modified": "2025-06-26T21:31:04Z",
  "published": "2025-06-26T21:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48466"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shipcod3/CVE-2025-48466"
    },
    {
      "type": "WEB",
      "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-0934"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T05:16:50Z",
    "severity": "LOW"
  },
  "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with custom role permissions to view, create, or delete protected environment configurations despite CI/CD visibility being disabled for the project.",
  "id": "GHSA-394r-q6wg-v263",
  "modified": "2026-06-25T06:30:42Z",
  "published": "2026-06-25T06:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0934"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3508760"
    },
    {
      "type": "WEB",
      "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/585961"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nezhahq/nezha"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.14"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53521"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T23:02:37Z",
    "nvd_published_at": "2026-06-12T22:16:52Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`PATCH /server/{id}` accepts and persists nonexistent `ddns_profiles` IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user\u0027s DDNS profile configuration in the context of the attacker\u0027s server.\n\nThis is a second-order authorization bypass: direct binding to an existing foreign DDNS profile is correctly denied, but an unresolved future ID can be stored first and later becomes a live cross-user reference.\n\n## Affected versions\n\nConfirmed on:\n\n- Nezha `v2.0.14`\n- Commit: `8b5e382fe217107c7b777ea9c6b4bc3d2e156202`\n\nThe exact affected version range was not determined.\n\n## Impact\n\nA normal member who owns a server can prebind one or more future DDNS profile IDs to that server. If another user later creates a DDNS profile with a matching ID, the dashboard DDNS worker can use the victim\u0027s DDNS profile/provider configuration for the attacker\u0027s server.\n\nIn the validated worker path, the dispatched DDNS update combines:\n\n- the victim DDNS profile ID and owner\n- the victim profile\u0027s provider type\n- victim profile fields such as domains, access ID, access secret, and retry policy\n- attacker server context, including the attacker\u0027s server ID, owner, IPv4 address, and override DDNS domains\n\nThis can result in unauthorized DDNS update attempts using another user\u0027s DDNS profile context. The attacker does not need permission to bind the victim profile after it exists.\n\nThe following were not validated: credential disclosure, account takeover, or guaranteed external DNS modification across all providers. The credentials remain server-side in the worker path. The downstream DNS impact depends on the victim profile\u0027s provider configuration and what that provider account is authorized to update.\n\n## Affected components\n\n- `PATCH /server/{id}`\n- `cmd/dashboard/controller/server.go`\n- `service/singleton/singleton.go`\n- `service/singleton/ddns.go`\n- `service/singleton/server.go`\n- `pkg/ddns/ddns.go`\n\n## Root cause\n\nThe server update path validates submitted DDNS profile IDs through `CheckPermission`, but that check only rejects existing objects owned by another user. Nonexistent IDs are skipped.\n\nThe `updateServer` path then persists the submitted raw IDs into `DDNSProfilesRaw`, along with override domain data. Later, the DDNS worker resolves the stored profile IDs by ID and dispatches provider updates without revalidating that the resolved profiles belong to the server owner.\n\nAs a result, an invalid unresolved reference can become a valid cross-user reference after another user creates a DDNS profile with the same global auto-increment ID.\n\n## Reproduction summary\n\nThe behavior was validated locally with focused regression tests.\n\n### Controller chain proof\n\nTest file:\n\n`cmd/dashboard/controller/ddns_second_order_test.go`\n\nTest name:\n\n`TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile`\n\nCommand:\n\n```bash\ngo test ./cmd/dashboard/controller -run TestUpdateServerAllowsFutureDDNSProfileBindingThenResolvesVictimProfile -count=1\n```\n\nResult:\n\n`pass`\n\nThe test demonstrates:\n\n1. A normal member owns server `1`.\n2. DDNS profile ID `1` does not exist.\n3. The member updates their server with `enable_ddns=true` and `ddns_profiles=[1]`.\n4. The request succeeds.\n5. The server persists `DDNSProfiles=[1]`.\n6. Another user later creates a DDNS profile and receives ID `1`.\n7. A fresh attempt by the attacker to bind profile `1` is correctly denied.\n8. The previously stored reference remains active and resolves in the DDNS worker path.\n\n### Provider-level worker proof\n\nTest file:\n\n`service/singleton/ddns_worker_authz_test.go`\n\nTest name:\n\n`TestUpdateDDNSDispatchesVictimProfileForAttackerServer`\n\nCommand:\n\n```bash\ngo test ./service/singleton -run TestUpdateDDNSDispatchesVictimProfileForAttackerServer -count=1\n```\n\nResult:\n\n`pass`\n\nThe test proves that the DDNS worker does not merely resolve the victim profile. It dispatches a DDNS update using the victim profile configuration and attacker server context.\n\nValidated assertions include:\n\n- resolved profile ID is `1`\n- resolved profile owner is victim user `200`\n- processed server is attacker server `1` owned by user `100`\n- provider type is the victim profile\u0027s provider\n- victim profile fields are present in worker dispatch:\n  - domains\n  - access ID\n  - access secret\n  - max retries\n- attacker server context is present in the same dispatch:\n  - IPv4 `198.51.100.44`\n- attacker-controlled override domains are passed to the worker:\n  - `attacker-controlled.example`\n\n## Practicality\n\nThe attack requires predicting or prebinding future DDNS profile IDs. This limits severity, but does not remove the authorization issue.\n\nEvidence supporting practicality:\n\n- DDNS profile IDs are `uint64` GORM primary keys from `model/common.go`.\n- `createDDNS` uses a normal `DB.Create(\u0026p)` flow and returns `p.ID`.\n- `DDNSProfiles` is an unbounded `[]uint64` in `model/server_api.go`.\n- No length or existence validation is applied in `updateServer`.\n- Invalid/future IDs are preserved in the server record.\n- Stored unresolved IDs survive reload.\n- Range prebinding was validated with `[1,2,3,4]`.\n- The DDNS worker consumes stored IDs on future DDNS update events.\n- Worker dispatch can occur after server edit and agent IP-change events.\n- Each DDNS update can retry according to the victim profile\u0027s `MaxRetries`.\n\nThis makes the issue semi-practical: exploitation depends on future ID prediction or range prebinding, but the unresolved IDs persist and can become active later.\n\n## Expected behavior\n\n`PATCH /server/{id}` should reject any submitted DDNS profile ID that does not both:\n\n1. exist, and\n2. belong to the caller or the owner of the server being updated.\n\nThe DDNS worker should also avoid trusting stored profile IDs without revalidating ownership before provider resolution or dispatch.\n\n## Actual behavior\n\n`PATCH /server/{id}` accepts nonexistent DDNS profile IDs and persists them. If another user later creates a DDNS profile with a matching ID, the stored reference resolves to that user\u0027s profile and is consumed by the DDNS worker for the attacker\u0027s server.\n\n## Suggested remediation\n\nApply both bind-time and worker-time validation.\n\nAt bind time:\n\n- Reject nonexistent DDNS profile IDs.\n- Reject DDNS profile IDs that do not belong to the caller/server owner.\n- Reject or limit excessive DDNS profile ID lists if range prebinding is not intended.\n\nAt worker time:\n\n- Revalidate that every resolved DDNS profile still belongs to the owner of the server being processed.\n- Skip or remove stale, nonexistent, or foreign DDNS profile references before provider dispatch.\n\nSuggested regression tests:\n\n- `TestUpdateServerRejectsNonexistentDDNSProfileIDs`\n- `TestUpdateServerRejectsForeignDDNSProfileIDs`\n- `TestUpdateServerAcceptsOwnedDDNSProfileIDs`\n- `TestUpdateDDNSSkipsStaleOrForeignStoredDDNSProfiles`\n\n## Security relevance\n\nA direct bind to an existing foreign DDNS profile is already denied, which shows the intended ownership boundary. The issue is that the same boundary can be bypassed by storing a future unresolved ID before the victim profile exists.\n\nThe worker later treats the stored ID as trusted and dispatches a DDNS update using the victim profile\u0027s provider configuration with attacker server context. This is an authorization issue in a deferred worker path, not merely malformed input.\n\n## Limitations\n\n- The attacker does not read victim DDNS credentials through the validated path.\n- Exploitation may require predicting or prebinding future global auto-increment DDNS profile IDs.\n- The downstream DNS impact depends on the victim profile\u0027s provider configuration.\n- External DNS modification was not claimed as guaranteed across all providers.",
  "id": "GHSA-39g2-8x68-pmx8",
  "modified": "2026-06-26T23:02:37Z",
  "published": "2026-06-26T23:02:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53521"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nezhahq/nezha"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user\u0027s DDNS profile context"
}