CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2026-47988"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T20:17:04Z",
    "severity": "HIGH"
  },
  "details": "Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.",
  "id": "GHSA-5pcm-62qr-xhc5",
  "modified": "2026-07-14T21:32:17Z",
  "published": "2026-07-14T21:32:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47988"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/magento/apsb26-73.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-3833"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-697",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-07T16:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Integria IMS login check uses a loose comparator (\"==\") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords.",
  "id": "GHSA-5pf8-m5c6-qc44",
  "modified": "2024-09-17T00:31:00Z",
  "published": "2022-05-24T19:16:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3833"
    },
    {
      "type": "WEB",
      "url": "https://integriaims.com/en/services/updates"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/integria-ims-incorrect-authorization"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/integria-ims-incorrect-authorization"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-47827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-11-30T14:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect Authorization vulnerability in NicheAddons Events Addon for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Events Addon for Elementor: from n/a through 2.1.3.",
  "id": "GHSA-5pvh-vhhw-w4x6",
  "modified": "2026-04-28T21:33:13Z",
  "published": "2023-11-30T15:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47827"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/events-addon-for-elementor/wordpress-events-addon-for-elementor-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-24479"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-28T19:15:14Z",
    "severity": "HIGH"
  },
  "details": "A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user.",
  "id": "GHSA-5q2h-rcfj-xc9g",
  "modified": "2025-01-28T21:31:03Z",
  "published": "2025-01-28T21:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24479"
    },
    {
      "type": "WEB",
      "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1719.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-25561"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-07T22:16:01Z",
    "severity": "HIGH"
  },
  "details": "WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as boardId, cardId, swimlaneId, and listId) are consistent and refer to a coherent card/board relationship, enabling attempts to upload attachments with mismatched object relationships.",
  "id": "GHSA-5q4r-452w-ggwq",
  "modified": "2026-02-11T00:30:14Z",
  "published": "2026-02-08T00:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25561"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wekan/wekan/commit/1d16955b6d4f0a0282e89c2c1b0415c7597019b8"
    },
    {
      "type": "WEB",
      "url": "https://wekan.fi"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/wekan-attachment-upload-object-relationship-validation-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.3.4.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.3.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.3.4.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.3.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-12-21T17:43:25Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\nAuthenticated Privilege Escalation\n\n### Patches\nWe recommend to update to the current version 6.3.4.1. You can get the update to 6.3.4.1 regularly via the Auto-Updater or directly via the download overview.\n\nhttps://www.shopware.com/en/download/#shopware-6\n\n### Workarounds\nFor older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:\n\nhttps://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659\n\n### For more information\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-12-2020",
  "id": "GHSA-5q58-x5h2-v5rx",
  "modified": "2020-12-21T17:43:25Z",
  "published": "2020-12-21T18:01:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopware/platform/security/advisories/GHSA-5q58-x5h2-v5rx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Authenticated Privilege Escalation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-4812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-12T14:15:48Z",
    "severity": "HIGH"
  },
  "details": "An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request.",
  "id": "GHSA-5q5j-r39w-wc64",
  "modified": "2024-01-12T15:30:32Z",
  "published": "2024-01-12T15:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4812"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2115574"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/424398"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.5.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "grumpydictator/firefly-iii"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.4.23"
            },
            {
              "fixed": "6.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-07T02:10:45Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe User management API endpoints (`GET /api/v1/users` and `GET /api/v1/users/{id}`) are accessible to any authenticated user without admin/owner role verification, exposing all users\u0027 email addresses, roles, and account status.\n\n### Affected Endpoints\n\n1. **GET /api/v1/users** (UserController::index, line 94) \u2014 Lists ALL users with full details. No role check.\n2. **GET /api/v1/users/{id}** (UserController::show, line 126) \u2014 Shows any user\u0027s details by ID. No role check.\n\n### Root Cause (1-of-N Inconsistency)\n\nOther methods in the same controller properly check for the \u0027owner\u0027 role:\n\n- `store()` \u2014 `UserStoreRequest::authorize()` checks `auth()-\u003euser()-\u003ehasRole(\u0027owner\u0027)` \u2713\n- `destroy()` \u2014 Explicitly checks `$this-\u003erepository-\u003ehasRole($admin, \u0027owner\u0027)` \u2713\n\nBut `index()` and `show()` have no role check at all. The route group at `routes/api.php:734-747` has no admin middleware, only the global `auth:api` middleware.\n\n### Exposed Data\n\nThe `UserTransformer` (line 40-54) returns:\n- `email` \u2014 user\u0027s email address\n- `role` \u2014 user\u0027s role (owner/demo)\n- `blocked` \u2014 account blocked status\n- `blocked_code` \u2014 block reason\n- `created_at` / `updated_at` \u2014 timestamps\n\n### Impact\n\nAny authenticated user can:\n1. Enumerate ALL user accounts in the instance\n2. Harvest email addresses for phishing/social engineering\n3. Identify admin/owner accounts by role\n4. Determine which accounts are blocked\n\n### Exploitation\n\n```bash\n# List all users\ncurl -H \"Authorization: Bearer \u003cany_user_token\u003e\" https://instance/api/v1/users\n\n# View specific user details\ncurl -H \"Authorization: Bearer \u003cany_user_token\u003e\" https://instance/api/v1/users/1\n```\n\n### Suggested Fix\n\nAdd owner role checks to `index()` and `show()`, or restrict the route group with admin middleware:\n\n```php\n// Option 1: Add check in controller methods\npublic function show(User $user): JsonResponse\n{\n    if (!$this-\u003erepository-\u003ehasRole(auth()-\u003euser(), \u0027owner\u0027) \u0026\u0026 auth()-\u003euser()-\u003eid !== $user-\u003eid) {\n        throw new FireflyException(\u0027200025: No access to function.\u0027);\n    }\n    // ...\n}\n\n// Option 2: Add middleware to route group\nRoute::group([\u0027middleware\u0027 =\u003e [\u0027admin\u0027], ...], ...)\n```",
  "id": "GHSA-5q8v-j673-m5v4",
  "modified": "2026-03-07T02:10:45Z",
  "published": "2026-03-07T02:10:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/firefly-iii/firefly-iii/security/advisories/GHSA-5q8v-j673-m5v4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/firefly-iii/firefly-iii"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Firefly III user API endpoints expose all users\u0027 information to any authenticated user (IDOR)"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.13.3"
      },
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-06T18:10:05Z",
    "nvd_published_at": "2026-02-06T18:15:56Z",
    "severity": "MODERATE"
  },
  "details": "## Vulnerability Description\n\nThe endpoint\n`PUT /repos/:owner/:repo/contents/*`\ndoes not require write permissions and allows access with **read permission only** via `repoAssignment()`.\n\nAfter passing the permission check, `PutContents()` invokes `UpdateRepoFile()`, which results in:\n\n* Commit creation\n* Execution of `git push`\n\nAs a result, a token with **read-only permission** can be used to modify repository contents.\n\n---\n\n## Attack Prerequisites\n\n* Possession of a valid access token\n* Read permission on the target repository\n  (public repository or collaborator with read access)\n\n---\n\n## Attack Scenario\n\n1. The attacker accesses the target repository with a read-only token\n2. The attacker sends a `PUT /contents` request to update an arbitrary file\n3. The server creates a commit and performs a git push on behalf of the attacker\n\n---\n\n## Potential Impact\n\n* Source code tampering\n* Injection of backdoors\n* Compromise of release artifacts and distributed packages",
  "id": "GHSA-5qhx-gwfj-6jqr",
  "modified": "2026-02-06T19:06:54Z",
  "published": "2026-02-06T18:10:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23632"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/pull/8102/commits/b6afcdb2e8d291e2adaaf6a8b7f88d240606515d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/releases/tag/v0.13.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Gogs user can update repository content with read-only permission"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-0067"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-09T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "\u0026nbsp;Improper access control in system firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.",
  "id": "GHSA-5qmf-2cww-78m3",
  "modified": "2022-07-13T00:00:52Z",
  "published": "2022-05-24T19:04:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0067"
    },
    {
      "type": "WEB",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00511.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}