CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2025-15023"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-14T18:16:34Z",
    "severity": "HIGH"
  },
  "details": "Incorrect Authorization vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Library Automation System: from v.19.5 before v.22.1.",
  "id": "GHSA-h279-5fw7-cc3m",
  "modified": "2026-05-14T18:32:57Z",
  "published": "2026-05-14T18:32:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15023"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0240"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-9155"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-26T15:15:18Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 9.10.x \u003c= 9.10.1, 9.9.x \u003c= 9.9.2, 9.5.x \u003c= 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of.",
  "id": "GHSA-h287-xx77-94v5",
  "modified": "2024-09-26T15:30:44Z",
  "published": "2024-09-26T15:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9155"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-42939"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-14T01:15:33Z",
    "severity": "MODERATE"
  },
  "details": "SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the application without affecting its confidentiality or availability.",
  "id": "GHSA-h2f2-x9qf-59r2",
  "modified": "2025-10-14T03:30:57Z",
  "published": "2025-10-14T03:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42939"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3625683"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-44172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-27T22:15:11Z",
    "severity": "LOW"
  },
  "details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.3, macOS Sonoma 14.7.3, macOS Sequoia 15. An app may be able to access contacts.",
  "id": "GHSA-h2jv-m23f-7xfh",
  "modified": "2025-11-03T21:32:24Z",
  "published": "2025-01-28T00:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44172"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/121238"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122069"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122070"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Jan/16"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Jan/17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-39352"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-28T06:15:06Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality. This allows remote authenticated users with administrator privileges to bypass firmware integrity check via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC500 and TC500.",
  "id": "GHSA-h2m9-38g2-xrh9",
  "modified": "2025-03-04T21:30:53Z",
  "published": "2025-03-04T21:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39352"
    },
    {
      "type": "WEB",
      "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_23_15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-6963"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-804",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-05T22:15:57Z",
    "severity": "MODERATE"
  },
  "details": "The Getwid \u2013 Gutenberg Blocks plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to bypass the Captcha Verification of the Contact Form block by omitting \u0027g-recaptcha-response\u0027 from the \u0027data\u0027 array.",
  "id": "GHSA-h2p5-5xgm-h7m9",
  "modified": "2026-04-08T21:32:12Z",
  "published": "2024-02-06T00:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6963"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3022982"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d317f2c7-06f3-4875-9f9b-eb7f450aa2f4?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-5377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T17:16:44Z",
    "severity": "MODERATE"
  },
  "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that could have allowed an authenticated user to access titles of confidential or private issues in public projects due to improper access control in the issue description rendering process.",
  "id": "GHSA-h2q6-mm6m-cfxp",
  "modified": "2026-04-22T18:31:47Z",
  "published": "2026-04-22T18:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5377"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3640688"
    },
    {
      "type": "WEB",
      "url": "https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/595553"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-19551"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-21T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code executiong.",
  "id": "GHSA-h2qh-93xp-94xr",
  "modified": "2022-05-24T19:15:23Z",
  "published": "2022-05-24T19:15:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19551"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wuzhicms/wuzhicms/issues/177"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:26:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe published npm package `praisonai` exports `createAgentLoop()`, whose `onToolCall` callback is documented and exampled as an approval hook. The implementation calls PraisonAI\u0027s `generateText()` wrapper with the caller\u0027s executable tools first, receives `toolResults`, and only then calls `onToolCall()`.\n\nBecause AI SDK `generateText()` executes tools with an `execute` function as part of the generation call, `onToolCall` can deny a tool only after the sensitive side effect has already happened. PraisonAI then returns `finishReason: \"tool_rejected\"`, which is a false security signal: the rejected tool already ran.\n\nThe PoV is deterministic and local-only. It uses mock AI SDK modules, no live model call, no API key, and no network target. The tool increments an in-memory counter rather than touching the filesystem or executing commands.\n\n## Technical Details\n\nIn `src/praisonai-ts/src/ai/agent-loop.ts`, the public config says:\n\n```ts\n/** On tool call callback (for approval) */\nonToolCall?: (toolCall: ToolCallInfo) =\u003e Promise\u003cboolean\u003e;\n```\n\nThe inline approval example also asks a user for approval and returns the decision:\n\n```ts\nonToolCall: async (toolCall) =\u003e {\n  const approved = await askUserForApproval(toolCall);\n  return approved;\n}\n```\n\nHowever, `AgentLoop.step()` calls `generateText()` with the executable tools before invoking `onToolCall`:\n\n```ts\nconst result = await generateText({\n  model: this.config.model,\n  messages: this.messages as any,\n  tools: this.config.tools,\n  maxSteps: 1,\n});\n```\n\nIt then materializes `toolResults`:\n\n```ts\ntoolResults: result.toolResults.map(tr =\u003e ({\n  toolCallId: tr.toolCallId,\n  toolName: tr.toolName,\n  result: tr.result,\n})),\n```\n\nOnly afterward does the approval callback run:\n\n```ts\nif (this.config.onToolCall) {\n  for (const toolCall of step.toolCalls) {\n    const approved = await this.config.onToolCall(toolCall);\n    if (!approved) {\n      this.complete = true;\n      step.finishReason = \u0027tool_rejected\u0027;\n      break;\n    }\n  }\n}\n```\n\n`src/praisonai-ts/src/ai/generate-text.ts` forwards the caller\u0027s tools directly to AI SDK:\n\n```ts\nconst result = await sdk.generateText({\n  model,\n  ...\n  tools: options.tools,\n  maxSteps: options.maxSteps,\n  ...\n});\n```\n\nAI SDK documents that `generateText()` \"generates text and calls tools\", and that tools with an `execute` function run automatically unless approval is handled before execution with `needsApproval`.\n\nThe published `npm:praisonai@1.7.1` dist files preserve the same order:\n\n- `dist/ai/agent-loop.js` lines 150-157 call `generateText()` with executable tools.\n- lines 162-171 materialize `toolResults`.\n- lines 183-195 call `onToolCall()` and set `tool_rejected` afterward.\n\n### Why This Is Not Intended Behavior\n\nThis is not a trust-model-only issue. PraisonAI explicitly labels `onToolCall` as an approval callback and shows an approval example. A user who returns `false` from that callback expects the tool not to run.\n\nIt also conflicts with the AI SDK execution model PraisonAI wraps:\n\n- AI SDK `generateText()` executes tools that include an `execute` function.\n- AI SDK approval is a pre-execution boundary (`needsApproval`), not a post-execution notification.\n- AI SDK loop control documentation treats \"a tool call needs approval\" as a condition that stops or pauses the loop before executing the tool.\n\nPraisonAI\u0027s current behavior instead creates a post-execution audit hook while naming and documenting it as approval.\n\n## PoV\n\nRun from a local reproduction checkout:\n\n```bash\nnode poc/pov_poc.js 1.7.1\n```\n\nExpected output includes:\n\n```json\n{\n  \"praisonaiVersion\": \"1.7.1\",\n  \"createAgentLoopExported\": true,\n  \"eventOrder\": [\"tool-executed\", \"approval-denied\"],\n  \"sideEffects\": 1,\n  \"finishReason\": \"tool_rejected\",\n  \"toolCallCount\": 1,\n  \"toolResultCount\": 1,\n  \"rejectedAfterExecution\": true,\n  \"vulnerable\": true,\n  \"patchedControl\": {\n    \"order\": [\"approval-denied\"],\n    \"sideEffects\": 0,\n    \"toolCallCount\": 1,\n    \"toolResultCount\": 0,\n    \"blocksBeforeExecution\": true\n  }\n}\n```\n\nThe PoV installs `npm:praisonai@1.7.1` into a temporary project and supplies mock `ai` and `@ai-sdk/openai` modules. The mocked `generateText()` returns one tool-call intent and executes a supplied `execute` handler if present. This keeps the proof deterministic and isolates PraisonAI\u0027s ordering bug.\n\nThe vulnerable run uses `createAgentLoop()` with:\n\n- a `dangerousWrite` tool whose `execute()` handler increments an in-memory side-effect counter and records `tool-executed`;\n- an `onToolCall` approval callback that always returns `false` and records `approval-denied`.\n\nThe observed order is:\n\n```text\ntool-executed \u003e approval-denied\n```\n\nThat proves denial happens after execution. The `toolResults` array contains the tool\u0027s result even though PraisonAI reports `finishReason: \"tool_rejected\"`.\n\nThe patched-control comparison strips executable handlers before the model step, requests approval on the tool-call intent, and only executes if approval succeeds. With the same denial decision, the control output is:\n\n```text\napproval-denied\nsideEffects = 0\ntoolResultCount = 0\n```\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nAny application using npm PraisonAI `createAgentLoop()` with `onToolCall` as a human-in-the-loop or policy approval boundary can execute denied tools.\n\nIf the application exposes the agent loop to lower-trust prompts or users and registers powerful tools, an attacker can cause the model to call a tool that the approval callback denies. The denial occurs too late. Depending on the registered tool, impact can include file modification, command execution, external API calls, data mutation, credential use, or other side effects with the privileges of the PraisonAI process.\n\nThe report does not claim that npm PraisonAI exposes this as a default network service. It is a library-level approval-boundary bypass in the exported TypeScript agent-loop API.\n\n### Severity\n\nSuggested severity: High.\n\nRationale:\n\n- `AV`: common deployment pattern is an application exposing agent prompts over a network.\n- `AC`: attacker only needs to induce a tool call.\n- `PR`: conservative base score assumes the attacker can submit prompts to the application.\n- `UI`: no additional operator action is needed for the tool to execute before denial; even a denial callback is too late.\n- `S`: impact is in the PraisonAI-hosting application process.\n- `C/I/A`: depends on registered tools; shell/file/API tools can affect confidentiality, integrity, and availability.\n\nIf maintainers score only local scripts that process untrusted repositories or prompts, `AV:L` may be reasonable. If they score public unauthenticated prompt endpoints built on this API, `PR:N` may be reasonable.\n\n## Suggested Fix\n\nDo not pass executable tool handlers into `generateText()` before approval.\n\nOne safe shape:\n\n1. Convert configured tools into intent-only tool definitions without `execute`.\n2. Call `generateText()` to obtain the model\u0027s tool-call intent.\n3. Invoke `onToolCall(toolCall)` before any side effect.\n4. Execute the selected tool only if approval returns true.\n5. Append approved tool results to the conversation and continue the loop.\n\nAlternatively, if PraisonAI wants to delegate approval to AI SDK v6, translate `onToolCall` into per-tool `needsApproval` semantics so AI SDK pauses before calling `execute`.\n\nRegression tests should include:\n\n- `onToolCall` returns false and the tool `execute()` counter remains zero;\n- `onToolCall` returns true and the tool executes exactly once;\n- `tool_rejected` is never reported together with a tool result produced by the denied tool;\n- streaming and non-streaming loop variants use the same approval ordering if added later.\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Package: `npm:praisonai`\n- Component: TypeScript `AgentLoop`\n- Current head validated: `1ad58ca02975ff1398efeda694ea2ab78f20cf3e`\n- Current tag validated: `v4.6.58`\n- Latest npm package validated: `1.7.1`\n\nSuggested affected range:\n\n```text\nnpm:praisonai \u003e= 1.4.0, \u003c= 1.7.1\n```\n\nSelected version sweep:\n\n- `1.0.0`: package main cannot be required in the selected test environment.\n- `1.2.0`: `createAgentLoop` is not exported.\n- `1.3.6`: `createAgentLoop` is not exported.\n- `1.4.0`: vulnerable.\n- `1.5.0`: vulnerable.\n- `1.5.4`: vulnerable.\n- `1.6.0`: vulnerable.\n- `1.7.0`: vulnerable.\n- `1.7.1`: vulnerable.\n\n## Advisory History\n\nThis is distinct from known and previously submitted PraisonAI issues:\n\n- `GHSA-ffp3-3562-8cv3` covers Python `praisonaiagents` approval cache keyed by tool name rather than invocation arguments.\n- `GHSA-qwgj-rrpj-75xm` covers Python Chainlit UI overriding configured approval mode with `auto`.\n- `GHSA-63v4-w882-g4x2` / poc covers Python `HTTPApproval` approval-page XSS.\n- poc covers npm TypeScript `AgentOS` missing authentication.\n- poc covers npm TypeScript `codeMode` sandbox escape.\n- poc covers npm TypeScript `MCPServer` missing authentication.\n\nNo visible local or GitHub advisory covers npm TypeScript `AgentLoop.onToolCall` executing after tool results already exist.",
  "id": "GHSA-h2w2-v7j6-xqm4",
  "modified": "2026-06-18T14:26:51Z",
  "published": "2026-06-18T14:26:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-h2w2-v7j6-xqm4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "npm PraisonAI AgentLoop onToolCall approval runs after tool execution"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-27236"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-03T12:15:43Z",
    "severity": "LOW"
  },
  "details": "A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to.",
  "id": "GHSA-h34r-wgpp-r3p4",
  "modified": "2025-10-08T15:32:26Z",
  "published": "2025-10-03T12:33:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27236"
    },
    {
      "type": "WEB",
      "url": "https://support.zabbix.com/browse/ZBX-27060"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}