Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

5629 vulnerabilities reference this CWE, most recent first.

GHSA-C23J-QP89-Q76C

Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2022-05-13 01:04
VLAI
Details

In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the "allow_active" element rather than "allow_any".

Severity
7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-3842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-09T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "In systemd before v242-rc4, it was discovered that pam_systemd does not properly sanitize the environment before using the XDG_SEAT variable. It is possible for an attacker, in some particular configurations, to set a XDG_SEAT environment variable which allows for commands to be checked against polkit policies using the \"allow_active\" element rather than \"allow_any\".",
  "id": "GHSA-c23j-qp89-q76c",
  "modified": "2022-05-13T01:04:09Z",
  "published": "2022-05-13T01:04:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3842"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3842"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STR36RJE4ZZIORMDXRERVBHMPRNRTHAC"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46743"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/152610/systemd-Seat-Verification-Active-Session-Spoofing.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C23X-R777-VMJW

Vulnerability from github – Published: 2022-05-13 00:01 – Updated: 2022-05-21 00:00
VLAI
Details

The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-30594"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-12T05:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.",
  "id": "GHSA-c23x-r777-vmjw",
  "modified": "2022-05-21T00:00:40Z",
  "published": "2022-05-13T00:01:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30594"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torvalds/linux/commit/ee1fee900537b5d9560e9f937402de5ddc8412f3"
    },
    {
      "type": "WEB",
      "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2276"
    },
    {
      "type": "WEB",
      "url": "https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee1fee900537b5d9560e9f937402de5ddc8412f3"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20220707-0001"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2022/dsa-5173"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/170362/Linux-PT_SUSPEND_SECCOMP-Permission-Bypass-Ptracer-Death-Race.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C2C9-MFW7-P8HW

Vulnerability from github – Published: 2026-05-20 15:45 – Updated: 2026-07-20 13:35
VLAI
Summary
Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows
Details

Summary

The /api/v1/chatflows/apikey/:apikey endpoint (whitelisted, accessible with API key auth only) returns all chatflows bound to the provided API key AND all chatflows across the entire system that have no API key assigned. This crosses workspace boundaries, allowing a user in Workspace A who has a valid API key to read the full configuration (including flowData, chatbotConfig, system prompts, and node configurations) of chatflows from Workspace B, Workspace C, and all other workspaces, as long as those chatflows have no API key assigned.

Details

The controller at packages/server/src/controllers/chatflows/index.ts:90-107 validates the API key and calls the service:

const getChatflowByApiKey = async (req: Request, res: Response, next: NextFunction) => {
    try {
        const apikey = await apiKeyService.getApiKey(req.params.apikey)
        if (\!apikey) {
            return res.status(401).send("Unauthorized")
        }
        const apiResponse = await chatflowsService.getChatflowByApiKey(apikey.id, req.query.keyonly)
        return res.json(apiResponse)  // Returns full chatflow objects with flowData
    } catch (error) {
        next(error)
    }
}

The service at packages/server/src/services/chatflows/index.ts:223-245 builds the database query:

const getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown): Promise<any> => {
    const appServer = getRunningExpressApp()
    let query = appServer.AppDataSource.getRepository(ChatFlow)
        .createQueryBuilder("cf")
        .where("cf.apikeyid = :apikeyid", { apikeyid: apiKeyId })
    if (keyonly === undefined) {
        // When keyonly is not set (default), also return ALL chatflows with no API key
        query = query.orWhere("cf.apikeyid IS NULL").orWhere("cf.apikeyid = ''")
    }
    const dbResponse = await query.orderBy("cf.name", "ASC").getMany()
    return dbResponse  // Returns full ChatFlow entities including flowData
}

When keyonly is not provided as a query parameter (which is the default case), the query expands to include: - All chatflows bound to the provided API key (same workspace, expected behavior) - ALL chatflows with apikeyid IS NULL (any workspace, no workspace filter) - ALL chatflows with empty apikeyid (any workspace, no workspace filter)

There is NO workspaceId filter in this query. The response includes the full ChatFlow entity, which contains: - flowData - the complete workflow graph including system prompts, model names, internal URLs, custom code - chatbotConfig - chatbot configuration including allowed origins - apiConfig - API configuration and override settings - textToSpeech / speechToText - TTS/STT configuration including credential IDs - analytic - analytics configuration

PoC

# Step 1: Attacker has a valid API key for Workspace A
API_KEY="<attacker-workspace-a-api-key>"

# Step 2: Query the chatflows/apikey endpoint WITHOUT keyonly parameter
# Returns the attacker chatflows PLUS all chatflows without API keys from ALL workspaces
curl -s "http://localhost:3000/api/v1/chatflows/apikey/" | jq ".[].workspaceId"

# Step 3: With keyonly parameter, only chatflows bound to the API key are returned
curl -s "http://localhost:3000/api/v1/chatflows/apikey/?keyonly=true" | jq ".[].workspaceId"

Impact

  • Cross-Workspace Information Disclosure: A user in any workspace can read the full configuration of chatflows from all other workspaces that do not have an API key assigned. This breaks workspace isolation.
  • Intellectual Property Exposure: System prompts, custom function code, and workflow architecture of chatflows from other workspaces/organizations are exposed.
  • Credential Reference Leakage: The textToSpeech and speechToText fields include credential IDs, which can be abused via the TTS generate endpoint.
  • Amplified by Default: Most chatflows are created without an API key assigned (API keys are opt-in), so the majority of chatflows in a multi-workspace deployment are affected.

Recommended Fix

Add workspace scoping to the getChatflowByApiKey query by passing the API key workspace ID and filtering the OR clause:

// packages/server/src/services/chatflows/index.ts
const getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown, workspaceId?: string): Promise<any> => {
    const appServer = getRunningExpressApp()
    let query = appServer.AppDataSource.getRepository(ChatFlow)
        .createQueryBuilder("cf")
        .where("cf.apikeyid = :apikeyid", { apikeyid: apiKeyId })
    if (keyonly === undefined && workspaceId) {
        // Only include unprotected chatflows from the SAME workspace
        query = query.orWhere(
            "(cf.apikeyid IS NULL OR cf.apikeyid = :empty) AND cf.workspaceId = :workspaceId",
            { empty: "", workspaceId }
        )
    }
    const dbResponse = await query.orderBy("cf.name", "ASC").getMany()
    return dbResponse
}
Severity
7.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "flowise"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56268"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-20T15:45:19Z",
    "nvd_published_at": "2026-06-22T22:16:51Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe `/api/v1/chatflows/apikey/:apikey` endpoint (whitelisted, accessible with API key auth only) returns all chatflows bound to the provided API key AND all chatflows across the entire system that have no API key assigned. This crosses workspace boundaries, allowing a user in Workspace A who has a valid API key to read the full configuration (including flowData, chatbotConfig, system prompts, and node configurations) of chatflows from Workspace B, Workspace C, and all other workspaces, as long as those chatflows have no API key assigned.\n\n## Details\n\nThe controller at `packages/server/src/controllers/chatflows/index.ts:90-107` validates the API key and calls the service:\n\n```typescript\nconst getChatflowByApiKey = async (req: Request, res: Response, next: NextFunction) =\u003e {\n    try {\n        const apikey = await apiKeyService.getApiKey(req.params.apikey)\n        if (\\!apikey) {\n            return res.status(401).send(\"Unauthorized\")\n        }\n        const apiResponse = await chatflowsService.getChatflowByApiKey(apikey.id, req.query.keyonly)\n        return res.json(apiResponse)  // Returns full chatflow objects with flowData\n    } catch (error) {\n        next(error)\n    }\n}\n```\n\nThe service at `packages/server/src/services/chatflows/index.ts:223-245` builds the database query:\n\n```typescript\nconst getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown): Promise\u003cany\u003e =\u003e {\n    const appServer = getRunningExpressApp()\n    let query = appServer.AppDataSource.getRepository(ChatFlow)\n        .createQueryBuilder(\"cf\")\n        .where(\"cf.apikeyid = :apikeyid\", { apikeyid: apiKeyId })\n    if (keyonly === undefined) {\n        // When keyonly is not set (default), also return ALL chatflows with no API key\n        query = query.orWhere(\"cf.apikeyid IS NULL\").orWhere(\"cf.apikeyid = \u0027\u0027\")\n    }\n    const dbResponse = await query.orderBy(\"cf.name\", \"ASC\").getMany()\n    return dbResponse  // Returns full ChatFlow entities including flowData\n}\n```\n\nWhen `keyonly` is not provided as a query parameter (which is the default case), the query expands to include:\n- All chatflows bound to the provided API key (same workspace, expected behavior)\n- ALL chatflows with `apikeyid IS NULL` (any workspace, no workspace filter)\n- ALL chatflows with empty `apikeyid` (any workspace, no workspace filter)\n\nThere is NO `workspaceId` filter in this query. The response includes the full `ChatFlow` entity, which contains:\n- `flowData` - the complete workflow graph including system prompts, model names, internal URLs, custom code\n- `chatbotConfig` - chatbot configuration including allowed origins\n- `apiConfig` - API configuration and override settings\n- `textToSpeech` / `speechToText` - TTS/STT configuration including credential IDs\n- `analytic` - analytics configuration\n\n## PoC\n\n```bash\n# Step 1: Attacker has a valid API key for Workspace A\nAPI_KEY=\"\u003cattacker-workspace-a-api-key\u003e\"\n\n# Step 2: Query the chatflows/apikey endpoint WITHOUT keyonly parameter\n# Returns the attacker chatflows PLUS all chatflows without API keys from ALL workspaces\ncurl -s \"http://localhost:3000/api/v1/chatflows/apikey/\" | jq \".[].workspaceId\"\n\n# Step 3: With keyonly parameter, only chatflows bound to the API key are returned\ncurl -s \"http://localhost:3000/api/v1/chatflows/apikey/?keyonly=true\" | jq \".[].workspaceId\"\n```\n\n## Impact\n\n- **Cross-Workspace Information Disclosure**: A user in any workspace can read the full configuration of chatflows from all other workspaces that do not have an API key assigned. This breaks workspace isolation.\n- **Intellectual Property Exposure**: System prompts, custom function code, and workflow architecture of chatflows from other workspaces/organizations are exposed.\n- **Credential Reference Leakage**: The `textToSpeech` and `speechToText` fields include credential IDs, which can be abused via the TTS generate endpoint.\n- **Amplified by Default**: Most chatflows are created without an API key assigned (API keys are opt-in), so the majority of chatflows in a multi-workspace deployment are affected.\n\n## Recommended Fix\n\nAdd workspace scoping to the `getChatflowByApiKey` query by passing the API key workspace ID and filtering the OR clause:\n\n```typescript\n// packages/server/src/services/chatflows/index.ts\nconst getChatflowByApiKey = async (apiKeyId: string, keyonly?: unknown, workspaceId?: string): Promise\u003cany\u003e =\u003e {\n    const appServer = getRunningExpressApp()\n    let query = appServer.AppDataSource.getRepository(ChatFlow)\n        .createQueryBuilder(\"cf\")\n        .where(\"cf.apikeyid = :apikeyid\", { apikeyid: apiKeyId })\n    if (keyonly === undefined \u0026\u0026 workspaceId) {\n        // Only include unprotected chatflows from the SAME workspace\n        query = query.orWhere(\n            \"(cf.apikeyid IS NULL OR cf.apikeyid = :empty) AND cf.workspaceId = :workspaceId\",\n            { empty: \"\", workspaceId }\n        )\n    }\n    const dbResponse = await query.orderBy(\"cf.name\", \"ASC\").getMany()\n    return dbResponse\n}\n```",
  "id": "GHSA-c2c9-mfw7-p8hw",
  "modified": "2026-07-20T13:35:08Z",
  "published": "2026-05-20T15:45:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-c2c9-mfw7-p8hw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56268"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FlowiseAI/Flowise"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/flowise-cross-workspace-information-disclosure-via-chatflows-apikey-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Flowise: Cross-Workspace Chatflow Disclosure via chatflows/apikey Endpoint Returns All Unprotected Chatflows"
}

GHSA-C2HX-PWR4-GFHP

Vulnerability from github – Published: 2025-10-17 21:31 – Updated: 2025-10-18 03:30
VLAI
Details

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-62648"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-17T21:15:37Z",
    "severity": "MODERATE"
  },
  "details": "The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.",
  "id": "GHSA-c2hx-pwr4-gfhp",
  "modified": "2025-10-18T03:30:24Z",
  "published": "2025-10-17T21:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62648"
    },
    {
      "type": "WEB",
      "url": "https://archive.today/fMYQp"
    },
    {
      "type": "WEB",
      "url": "https://bobdahacker.com/blog/rbi-hacked-drive-thrus"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus"
    },
    {
      "type": "WEB",
      "url": "https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers"
    },
    {
      "type": "WEB",
      "url": "https://www.yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C2X5-MPJ8-V9V9

Vulnerability from github – Published: 2025-05-08 18:30 – Updated: 2025-05-08 21:32
VLAI
Details

An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-26842"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-08T16:15:25Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Znuny through 7.1.3. If access to a ticket is not given, the content of S/MIME encrypted e-mail messages is visible to users with access to the CommunicationLog.",
  "id": "GHSA-c2x5-mpj8-v9v9",
  "modified": "2025-05-08T21:32:55Z",
  "published": "2025-05-08T18:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26842"
    },
    {
      "type": "WEB",
      "url": "https://www.znuny.org/en/advisories/zsa-2025-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C2XJ-3MXC-4W9Q

Vulnerability from github – Published: 2024-12-09 03:30 – Updated: 2024-12-09 03:30
VLAI
Details

An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection objects that trigger execution of arbitrary EXE files. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-55579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-09T03:15:05Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR. An unprivileged user with network access may be able to create connection objects that trigger execution of arbitrary EXE files. This is fixed in November 2024 IR, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15.",
  "id": "GHSA-c2xj-3mxc-4w9q",
  "modified": "2024-12-09T03:30:59Z",
  "published": "2024-12-09T03:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55579"
    },
    {
      "type": "WEB",
      "url": "https://community.qlik.com/t5/Official-Support-Articles/High-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows-CVEs/tac-p/2496004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C34F-6CMX-FCVV

Vulnerability from github – Published: 2022-05-13 01:31 – Updated: 2025-08-29 15:30
VLAI
Details

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.

Severity
6.6 (Medium)
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-14665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-10-25T20:29:00Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.",
  "id": "GHSA-c34f-6cmx-fcvv",
  "modified": "2025-08-29T15:30:37Z",
  "published": "2022-05-13T01:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14665"
    },
    {
      "type": "WEB",
      "url": "https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46142"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45938"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45922"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45908"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45832"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45742"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/45697"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4328"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3802-1"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201810-09"
    },
    {
      "type": "WEB",
      "url": "https://lists.x.org/archives/xorg-announce/2018-October/002927.html"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2018:3410"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/105741"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1041948"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C36X-H252-G9X2

Vulnerability from github – Published: 2026-06-19 21:42 – Updated: 2026-06-19 21:42
VLAI
Summary
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808
Details

Summary

OpenBao users with access to the sys/leases/revoke/:lease_id endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations.

Impact

OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant.

Patch

This will be fixed in OpenBao v2.5.5.

References

This vulnerability is similar to but distinct from:

  • CVE-2026-45808 / GHSA-v8v8-cm84-m686
  • CVE-2026-40264 / GHSA-p49j-v9wc-wg57
Severity
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.0"
            },
            {
              "last_affected": "2.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260617103932-b20b999dd404"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T21:42:04Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\n\nOpenBao users with access to the `sys/leases/revoke/:lease_id` endpoint in any namespace can revoke leases in any other namespace as long as the lease identifier is known to them, bypassing ACLs that should apply for cross-namespace revocations.\n\n### Impact\n\nOpenBao\u0027s namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked by a user in another tenant.\n\n### Patch\n\nThis will be fixed in OpenBao v2.5.5.\n\n### References\n\nThis vulnerability is similar to but distinct from:\n\n- CVE-2026-45808 / GHSA-v8v8-cm84-m686\n- CVE-2026-40264 / GHSA-p49j-v9wc-wg57",
  "id": "GHSA-c36x-h252-g9x2",
  "modified": "2026-06-19T21:42:04Z",
  "published": "2026-06-19T21:42:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-c36x-h252-g9x2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/pull/3307"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/b20b999dd4044d7b419a5472d8fe08407828be37"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openbao/openbao"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/releases/tag/v2.5.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} \u2014 incomplete fix of CVE-2026-45808"
}

GHSA-C39G-G6JH-QHQ6

Vulnerability from github – Published: 2023-05-08 21:31 – Updated: 2024-04-04 03:52
VLAI
Details

Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-24505"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-05-08T21:15:10Z",
    "severity": "HIGH"
  },
  "details": "\nMilesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request. \n\n",
  "id": "GHSA-c39g-g6jh-qhq6",
  "modified": "2024-04-04T03:52:43Z",
  "published": "2023-05-08T21:31:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24505"
    },
    {
      "type": "WEB",
      "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-C3CQ-WGRQ-QM9R

Vulnerability from github – Published: 2026-03-25 15:31 – Updated: 2026-03-25 15:31
VLAI
Details

GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.

Severity
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4363"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T15:16:50Z",
    "severity": "LOW"
  },
  "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that under certain conditions could have allowed an authenticated user to gain unauthorized access to resources due to improper caching of authorization decisions.",
  "id": "GHSA-c3cq-wgrq-qm9r",
  "modified": "2026-03-25T15:31:29Z",
  "published": "2026-03-25T15:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4363"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/578561"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list