Broken access control.

Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

• Temporal Technologies, Inc. Temporal Server
• Broken access control

Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

• Red Hat build of Quarkus 3.27.6.redhat
• Red Hat build of Quarkus 3.33.4.redhat
• Broken access control

WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability

• RocketGeek WP-Members
• Broken access control

WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability

• WPMU DEV Forminator
• Broken access control

WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

• Arraytics Booktics
• Broken access control

WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability

• VideoWhisper.com Broadcast Live Video
• Broken access control

WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability

• VideoWhisper.com Paid Videochat Turnkey Site
• Broken access control

Netcore NR268 CGI Endpoint cross-site request forgery

• Netcore NR268
• Cross-site request forgery (CSRF)
• Broken access control

Incorrect log file permissions in Progress MarkLogic Server

• Progress Software Corporation MarkLogic Server
• Broken access control

WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

• Arraytics Booktics
• Broken access control

ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation

• zitadel
• Broken access control

Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

• edgelesssys contrast
• Broken access control

LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

• librenms
• Broken access control

SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement

• surrealdb
• Broken access control

SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE

• surrealdb
• Broken access control

SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after

• surrealdb
• Broken access control

SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use

• surrealdb
• Broken access control

SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH

• surrealdb
• Broken access control

Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php

• admidio
• Broken access control

Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization

• getgrav grav-plugin-star-ratings
• Broken access control

Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

• getgrav grav-plugin-guestbook
• Broken access control

Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin

• getgrav grav-plugin-data-manager
• Broken access control

Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition

• cms
• Broken access control

Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query

• parse-community parse-server
• Broken access control

Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries

• parse-community parse-server
• Broken access control

Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes

• open-webui
• Broken access control

Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID

• open-webui
• Broken access control

Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata

• open-webui
• Broken access control

Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint

• open-webui
• Broken access control

Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange

• open-webui
• Broken access control

FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert

• FreeRDP
• Broken access control

FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File

• FreeRDP
• Broken access control

Quay: repository auto-prune policy uuid idor in quay api

• Red Hat Quay 3
• Broken access control

Quay: build trigger uuid idor in quay api

• Red Hat Quay 3
• Broken access control

Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout

• thirty bees
• Broken access control

QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers

• Webkul QloApps
• Broken access control

tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization

• tobychui zoraxy
• Privilege escalation
• Broken access control

@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier

• @neo4j/graphql
• Broken access control

LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet

• LogicalDOC Community Edition
• Broken access control

LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet

• LogicalDOC Community Edition
• Broken access control

LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService

• LogicalDOC Community Edition
• Broken access control

BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization

• BlackBeltTechnology pi-agent-dashboard
• Privilege escalation
• Broken access control

jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Mass Assignment via PUT /user/update

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Privilege Escalation via PUT /user/updateUser

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Missing Authorization via /log/list and /log/info

• jishenghua jshERP
• Broken access control

jshERP through 3.6 Missing Authorization via /log Audit Endpoints

• jishenghua jshERP
• Broken access control

MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

• moxi624 MoguBlog
• Broken access control

MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

• moxi624 MoguBlog
• Broken access control

MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

• moxi624 MoguBlog
• Broken access control

MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig

• moxi624 MoguBlog
• Broken access control

yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint

• guchengwuyue yshop-crm
• Broken access control

yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint

• guchengwuyue yshop-crm
• Broken access control

yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check

• guchengwuyue yshop-crm
• Broken access control