CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5659 vulnerabilities reference this CWE, most recent first.
GHSA-7R7F-9XPJ-JMR7
Vulnerability from github – Published: 2025-10-13 13:33 – Updated: 2026-04-06 23:15Summary
When using filter authorization, two edge cases could cause the policy compiler/authorizer to generate a permissive filter:
-
Bypass policies whose condition can never pass at runtime were compiled as
OR(AND(condition, compiled_policies), NOT(condition)). If the condition could never be true at runtime, theNOT(condition)branch evaluated truthy and the overall expression became permissive. -
Runtime policy scenarios that reduce to “no checks are applicable” (an empty SAT scenario) were treated as an empty clause and dropped instead of being treated as
false, which could again produce an overly broad (permissive) filter.
These bugs could allow reads to return records that should have been excluded by policy.
Impact
Projects that rely on filter-based authorization and define:
bypass ... do ... endblocks whose condition(s) are only resolvable at runtime and can never pass in a given request context, or- runtime checks that simplify to an empty scenario for a clause
may unintentionally generate a permissive query filter, potentially returning unauthorized data.
Actions primarily affected: reads guarded by filter policies. Non-filter (e.g., hard forbid) policies are not impacted.
Technical details
This patch corrects two behaviors:
-
Ash.Policy.Policy.compile_policy_expression/1now treats bypass blocks asAND(condition_expression, compiled_policies)instead ofOR(AND(...), NOT(condition_expression)). This removes the permissiveNOT(condition)escape hatch when a bypass condition never passes. -
Ash.Policy.Authorizernow treats empty SAT scenarios (scenario == %{}) asfalse, ensuring impossible scenarios do not collapse into a no-op and inadvertently widen the filter. The reducer also normalizesnil→falseconsistently when buildingauto_filterfragments.
Relevant changes are in:
lib/ash/policy/policy.ex(bypass compilation)lib/ash/policy/authorizer/authorizer.ex(scenario handling / auto_filter normalization)- Tests added:
test/policy/filter_condition_test.exs(RuntimeFalsyCheck,RuntimeBypassResource) validate the corrected behavior.
Workarounds
- Avoid
bypasspolicies whose conditions are only decidable at runtime and may be perpetually false in some contexts; prefer explicitauthorize_if/forbid_ifblocks withoutbypassfor those cases. - Add an explicit final
forbid_if always()guard for sensitive reads as a belt-and-suspenders fallback until user can upgrade. - Where feasible, replace runtime-unknown checks with strict/compile-time checks or restructure to avoid empty SAT scenarios.
How to tell if user is affected
User is likely affected if ALL of the following are true:
- Uses filter authorization; and
- Defines
bypassblock withaccess_type :runtimewithout any policies after it; or - Defines
bypassblocks whose conditions are evaluated at runtime (e.g., checks withstrict_check/3returning:unknownand a runtimecheck/4that may never succeed in some contexts) without any policies after it
A quick sanity test is to issue a read expected to return no rows under such a bypass or runtime-falsy condition and verify it indeed returns []. The included test bypass works with filter policies demonstrates the corrected, non-permissive behavior.
{
"affected": [
{
"package": {
"ecosystem": "Hex",
"name": "ash"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-48043"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-13T13:33:22Z",
"nvd_published_at": "2025-10-10T16:15:52Z",
"severity": "HIGH"
},
"details": "### Summary\n\nWhen using **filter** authorization, two edge cases could cause the policy compiler/authorizer to generate a permissive filter:\n\n1. **Bypass policies whose condition can never pass at runtime** were compiled as\n `OR(AND(condition, compiled_policies), NOT(condition))`.\n If the condition could never be true at runtime, the `NOT(condition)` branch evaluated truthy and the overall expression became permissive.\n\n2. **Runtime policy scenarios that reduce to \u201cno checks are applicable\u201d** (an empty SAT scenario) were treated as an empty clause and dropped instead of being treated as **`false`**, which could again produce an overly broad (permissive) filter.\n\nThese bugs could allow reads to return records that should have been excluded by policy.\n\n### Impact\n\nProjects that rely on **filter-based authorization** and define:\n\n* `bypass ... do ... end` blocks whose condition(s) are only resolvable at runtime and can never pass in a given request context, **or**\n* runtime checks that simplify to an **empty** scenario for a clause\n\nmay unintentionally generate a permissive query filter, potentially returning unauthorized data.\n\n*Actions primarily affected:* reads guarded by filter policies. Non-filter (e.g., hard forbid) policies are not impacted.\n\n### Technical details\n\nThis patch corrects two behaviors:\n\n* **`Ash.Policy.Policy.compile_policy_expression/1`** now treats **bypass** blocks as\n `AND(condition_expression, compiled_policies)`\n instead of `OR(AND(...), NOT(condition_expression))`. This removes the permissive `NOT(condition)` escape hatch when a bypass condition never passes.\n\n* **`Ash.Policy.Authorizer`** now treats **empty SAT scenarios** (`scenario == %{}`) as **`false`**, ensuring impossible scenarios do not collapse into a no-op and inadvertently widen the filter. The reducer also normalizes `nil` \u2192 `false` consistently when building `auto_filter` fragments.\n\nRelevant changes are in:\n\n* `lib/ash/policy/policy.ex` (bypass compilation)\n* `lib/ash/policy/authorizer/authorizer.ex` (scenario handling / auto_filter normalization)\n* Tests added: `test/policy/filter_condition_test.exs` (`RuntimeFalsyCheck`, `RuntimeBypassResource`) validate the corrected behavior.\n\n### Workarounds\n\n* Avoid `bypass` policies whose conditions are only decidable at runtime and may be perpetually false in some contexts; prefer explicit `authorize_if`/`forbid_if` blocks without `bypass` for those cases.\n* Add an explicit **final `forbid_if always()`** guard for sensitive reads as a belt-and-suspenders fallback until user can upgrade.\n* Where feasible, replace runtime-unknown checks with strict/compile-time checks or restructure to avoid empty SAT scenarios.\n\n### How to tell if user is affected\n\nUser is likely affected if ALL of the following are true:\n\n* Uses **filter authorization**; and\n* Defines `bypass` block with `access_type :runtime` without any policies after it; or\n* Defines `bypass` blocks whose conditions are evaluated at runtime (e.g., checks with `strict_check/3` returning `:unknown` and a runtime `check/4` that may never succeed in some contexts) without any policies after it\n\nA quick sanity test is to issue a read expected to return **no** rows under such a bypass or runtime-falsy condition and verify it indeed returns `[]`. The included test `bypass works with filter policies` demonstrates the corrected, non-permissive behavior.",
"id": "GHSA-7r7f-9xpj-jmr7",
"modified": "2026-04-06T23:15:07Z",
"published": "2025-10-13T13:33:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ash-project/ash/security/advisories/GHSA-7r7f-9xpj-jmr7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48043"
},
{
"type": "WEB",
"url": "https://github.com/ash-project/ash/commit/66d81300065b970da0d2f4528354835d2418c7ae"
},
{
"type": "WEB",
"url": "https://cna.erlef.org/cves/CVE-2025-48043.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/ash-project/ash"
},
{
"type": "WEB",
"url": "https://github.com/ash-project/ash/releases/tag/v3.6.2"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/EEF-CVE-2025-48043"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Ash Framework: Filter authorization misapplies impossible bypass/runtime policies"
}
GHSA-7R83-P869-7995
Vulnerability from github – Published: 2025-08-20 12:31 – Updated: 2025-08-20 12:31In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files
{
"affected": [],
"aliases": [
"CVE-2025-57728"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-20T10:15:30Z",
"severity": "MODERATE"
},
"details": "In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files",
"id": "GHSA-7r83-p869-7995",
"modified": "2025-08-20T12:31:14Z",
"published": "2025-08-20T12:31:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-57728"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7R86-H946-G8H2
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 and all prior versions. The vulnerability could be exploited to gain unauthorized system privileges.
{
"affected": [],
"aliases": [
"CVE-2021-22521"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-30T21:15:00Z",
"severity": "HIGH"
},
"details": "A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting version 2020 Update 1 and all prior versions. The vulnerability could be exploited to gain unauthorized system privileges.",
"id": "GHSA-7r86-h946-g8h2",
"modified": "2022-05-24T19:09:19Z",
"published": "2022-05-24T19:09:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22521"
},
{
"type": "WEB",
"url": "https://support.microfocus.com/kb/doc.php?id=7025205"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7RJ5-723H-386Q
Vulnerability from github – Published: 2023-08-09 06:31 – Updated: 2026-04-08 21:31The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.
{
"affected": [],
"aliases": [
"CVE-2023-4242"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-09T04:15:10Z",
"severity": "MODERATE"
},
"details": "The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check.",
"id": "GHSA-7rj5-723h-386q",
"modified": "2026-04-08T21:31:59Z",
"published": "2023-08-09T06:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4242"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Health.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/full-customer/tags/2.3/app/api/Controller.php?rev=2951561"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7RJH-PX4V-5W55
Vulnerability from github – Published: 2026-05-08 19:50 – Updated: 2026-05-15 23:52Channel Access Grants Bypass filter_allowed_access_grants
Affected Component
Channel creation and update endpoints:
- backend/open_webui/routers/channels.py (lines 291-340, create_new_channel)
- backend/open_webui/routers/channels.py (lines 617-638, update_channel_by_id)
- backend/open_webui/models/channels.py (lines 825-826, set_access_grants call without filtering)
Affected Versions
Current main branch (commit 6fdd19bf1) and likely all versions supporting user-created group channels with access grants.
Description
All resource routers in Open WebUI (knowledge, models, notes, prompts, tools, skills) call filter_allowed_access_grants() before persisting access grants. This function strips principal_id: "*" wildcard grants from users who lack the relevant sharing.public_* permission, and strips individual user grants from users who lack access_grants.allow_users permission.
The channel router does not call filter_allowed_access_grants on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants — including public wildcard grants — and those grants are stored verbatim, bypassing the admin's permission framework.
# channels.py — access_grants from form data flow directly into persistence
# No call to filter_allowed_access_grants() anywhere in these paths.
# Compare with knowledge.py / models.py / notes.py / prompts.py / tools.py / skills.py,
# all of which do:
# form_data.access_grants = filter_allowed_access_grants(user, form_data.access_grants)
# before creating or updating.
Attack Scenario
- Admin configures permissions so that regular users do NOT have
sharing.public_channels— public sharing of channels is intended to be admin-only. - Attacker (a regular user) creates or owns a group channel.
- Attacker sends:
POST /api/v1/channels/ { "name": "public-channel", "type": "group", "access_control": { "access_grants": [ {"principal_type": "user", "principal_id": "*", "permission": "read"} ] } } set_access_grantsis called directly withoutfilter_allowed_access_grants— the wildcard grant is persisted.- The channel becomes publicly readable to every user on the instance, despite the admin's policy prohibiting public channels for regular users.
The same attack works via POST /api/v1/channels/{id}/update for any channel the attacker owns.
Impact
- Regular users can bypass the
sharing.public_channelspermission and make channels publicly accessible - Regular users can bypass
access_grants.allow_usersto grant individual-user access in environments where only group-based sharing is intended - Admin's permission framework for channels is silently ineffective
- Creates an inconsistency with every other resource type in the codebase, making the security posture harder to reason about
Preconditions
- Attacker must have an account with the ability to create group channels (default user capability), or ownership of an existing channel
- Admin must have configured restrictive sharing permissions for regular users (otherwise there's no policy to bypass)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.12"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44558"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T19:50:51Z",
"nvd_published_at": "2026-05-15T20:16:47Z",
"severity": "MODERATE"
},
"details": "# Channel Access Grants Bypass filter_allowed_access_grants\n\n## Affected Component\n\nChannel creation and update endpoints:\n- `backend/open_webui/routers/channels.py` (lines 291-340, `create_new_channel`)\n- `backend/open_webui/routers/channels.py` (lines 617-638, `update_channel_by_id`)\n- `backend/open_webui/models/channels.py` (lines 825-826, `set_access_grants` call without filtering)\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions supporting user-created group channels with access grants.\n\n## Description\n\nAll resource routers in Open WebUI (knowledge, models, notes, prompts, tools, skills) call `filter_allowed_access_grants()` before persisting access grants. This function strips `principal_id: \"*\"` wildcard grants from users who lack the relevant `sharing.public_*` permission, and strips individual user grants from users who lack `access_grants.allow_users` permission.\n\nThe channel router does not call `filter_allowed_access_grants` on either create or update paths. A non-admin user who can create group channels (or who owns a channel) can submit arbitrary access grants \u2014 including public wildcard grants \u2014 and those grants are stored verbatim, bypassing the admin\u0027s permission framework.\n\n```python\n# channels.py \u2014 access_grants from form data flow directly into persistence\n# No call to filter_allowed_access_grants() anywhere in these paths.\n\n# Compare with knowledge.py / models.py / notes.py / prompts.py / tools.py / skills.py,\n# all of which do:\n# form_data.access_grants = filter_allowed_access_grants(user, form_data.access_grants)\n# before creating or updating.\n```\n\n## Attack Scenario\n\n1. Admin configures permissions so that regular users do NOT have `sharing.public_channels` \u2014 public sharing of channels is intended to be admin-only.\n2. Attacker (a regular user) creates or owns a group channel.\n3. Attacker sends:\n ```\n POST /api/v1/channels/\n {\n \"name\": \"public-channel\",\n \"type\": \"group\",\n \"access_control\": {\n \"access_grants\": [\n {\"principal_type\": \"user\", \"principal_id\": \"*\", \"permission\": \"read\"}\n ]\n }\n }\n ```\n4. `set_access_grants` is called directly without `filter_allowed_access_grants` \u2014 the wildcard grant is persisted.\n5. The channel becomes publicly readable to every user on the instance, despite the admin\u0027s policy prohibiting public channels for regular users.\n\nThe same attack works via `POST /api/v1/channels/{id}/update` for any channel the attacker owns.\n\n## Impact\n\n- Regular users can bypass the `sharing.public_channels` permission and make channels publicly accessible\n- Regular users can bypass `access_grants.allow_users` to grant individual-user access in environments where only group-based sharing is intended\n- Admin\u0027s permission framework for channels is silently ineffective\n- Creates an inconsistency with every other resource type in the codebase, making the security posture harder to reason about\n\n## Preconditions\n\n- Attacker must have an account with the ability to create group channels (default user capability), or ownership of an existing channel\n- Admin must have configured restrictive sharing permissions for regular users (otherwise there\u0027s no policy to bypass)",
"id": "GHSA-7rjh-px4v-5w55",
"modified": "2026-05-15T23:52:41Z",
"published": "2026-05-08T19:50:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-7rjh-px4v-5w55"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44558"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI\u0027s Channel Access Grants Bypass filter_allowed_access_grants"
}
GHSA-7RQ8-F887-2R5G
Vulnerability from github – Published: 2026-05-20 18:31 – Updated: 2026-05-20 18:31In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted through srchFilter configurations on custom roles.
The app contains an authorize.conf configuration file with a srchFilter entry that modifies the built-in ‘user’ role. Because the Splunk platform combines inherited search filters with the OR SPL operator, the injected filter overrides more restrictive filters on child roles.
{
"affected": [],
"aliases": [
"CVE-2026-20238"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-20T18:16:26Z",
"severity": "MODERATE"
},
"details": "In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the \u0027admin\u0027 or \u0027power\u0027 roles could access confidential data that was restricted through `srchFilter` configurations on custom roles.\u003cbr\u003e\u003cbr\u003eThe app contains an `authorize.conf` configuration file with a `srchFilter` entry that modifies the built-in \u2018user\u2019 role. Because the Splunk platform combines inherited search filters with the `OR` SPL operator, the injected filter overrides more restrictive filters on child roles.",
"id": "GHSA-7rq8-f887-2r5g",
"modified": "2026-05-20T18:31:36Z",
"published": "2026-05-20T18:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20238"
},
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2026-0502"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7V2Q-XF3F-PFHP
Vulnerability from github – Published: 2024-10-11 21:31 – Updated: 2024-10-15 21:30An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update process.
{
"affected": [],
"aliases": [
"CVE-2024-48784"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-11T20:15:06Z",
"severity": "CRITICAL"
},
"details": "An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the firmware update process.",
"id": "GHSA-7v2q-xf3f-pfhp",
"modified": "2024-10-15T21:30:37Z",
"published": "2024-10-11T21:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48784"
},
{
"type": "WEB",
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.sampmax.homemax/com.sampmax.homemax.md"
},
{
"type": "WEB",
"url": "http://comsampmaxhomemax.com"
},
{
"type": "WEB",
"url": "http://sampmax.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7V4Q-3CH3-MJC7
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
{
"affected": [],
"aliases": [
"CVE-2021-25777"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-03T16:15:00Z",
"severity": "MODERATE"
},
"details": "In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.",
"id": "GHSA-7v4q-3ch3-mjc7",
"modified": "2022-05-24T17:40:53Z",
"published": "2022-05-24T17:40:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25777"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com"
},
{
"type": "WEB",
"url": "https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7VH7-FHP3-J32J
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-05-24 17:42Insufficient access control in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially enable denial of service via local access.
{
"affected": [],
"aliases": [
"CVE-2020-24495"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-17T14:15:00Z",
"severity": "MODERATE"
},
"details": "Insufficient access control in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially enable denial of service via local access.",
"id": "GHSA-7vh7-fhp3-j32j",
"modified": "2022-05-24T17:42:28Z",
"published": "2022-05-24T17:42:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24495"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7VM2-J586-VCVC
Vulnerability from github – Published: 2025-09-11 21:53 – Updated: 2025-09-26 16:58LIVE SELECT statements are used to capture changes to data within a table in real time. Documents included in WHERE conditions and DELETE notifications were not properly reduced to respect the querying user's security context. Instead the leaked documents reflect the context of the user triggering the notification.
This allows a record or guest user with permissions to run live query subscriptions on a table to observe unauthorised records within the same table, when another user is altering or deleting these records, bypassing access controls.
Impact
A record or guest user with permissions to run live query subscriptions on a table is able to observe unauthorised records within the same table, with unauthorised records returned when deleted, or when records matching the WHERE conditions are created, updated, or deleted, by another user. This impacts confidentiality, limited to the table the attacker has access to, and with the data disclosed dependent of the actions taken by other users.
Patches
A patch has been created for the following versions:
- Versions 2.1.9, 2.2.8 and 2.3.8 and later are not affected by this issue.
- The first release following v3.0.0-alpha.7 will be patched.
Workarounds
Assess the impact of users with permissions on table records effectively having full read access to the table, use separate tables if required, with impacts to functionality.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "SurrealDB"
},
"ranges": [
{
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "SurrealDB"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "crates.io",
"name": "SurrealDB"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c 3.0.0-alpha.7"
},
"package": {
"ecosystem": "crates.io",
"name": "SurrealDB"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0-alpha.0"
},
{
"fixed": "3.0.0-alpha.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-11060"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-11T21:53:23Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "`LIVE SELECT` statements are used to capture changes to data within a table in real time. Documents included in `WHERE` conditions and `DELETE` notifications were not properly reduced to respect the querying user\u0027s security context. Instead the leaked documents reflect the context of the user triggering the notification.\n\nThis allows a record or guest user with permissions to run live query subscriptions on a table to observe unauthorised records within the same table, when another user is altering or deleting these records, bypassing access controls.\n\n### Impact\nA record or guest user with permissions to run live query subscriptions on a table is able to observe unauthorised records within the same table, with unauthorised records returned when deleted, or when records matching the WHERE conditions are created, updated, or deleted, by another user. This impacts confidentiality, limited to the table the attacker has access to, and with the data disclosed dependent of the actions taken by other users.\n\n### Patches\nA patch has been created for the following versions:\n\n- Versions 2.1.9, 2.2.8 and 2.3.8 and later are not affected by this issue. \n- The first release following v3.0.0-alpha.7 will be patched.\n\n### Workarounds\nAssess the impact of users with permissions on table records effectively having full read access to the table, use separate tables if required, with impacts to functionality.",
"id": "GHSA-7vm2-j586-vcvc",
"modified": "2025-09-26T16:58:08Z",
"published": "2025-09-11T21:53:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11060"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/pull/6247"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-11060"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394708"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
},
{
"type": "WEB",
"url": "https://surrealdb.com/docs/surrealql/statements/live"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.