# CWE-1259.

Every Advisory and CVE whose sources give the weakness CWE-1259, newest first.

## Records, newest first

- [Gitea admin API public-only token scope bypass](https://agentprime.io/advisories/CVE-2026-117635.md)
  `CVE-2026-117635` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control, CWE-1259
- [Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability](https://agentprime.io/advisories/CVE-2026-76413.md)
  `CVE-2026-76413` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 8.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1259
- [Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted \`file.create\` permissions](https://agentprime.io/advisories/GHSA-8r6w-3qq5-4p4r.md)
  `GHSA-8r6w-3qq5-4p4r`, `CVE-2026-54593`, `GO-2026-6120`, `PKSA-hhbv-vvdq-cchz` · Go `github.com/pterodactyl/wings` and 1 more: affected `<1.12.2`, fixed in `1.12.2` · CVSS 8.1 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-1259, CWE-1270
- [Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints](https://agentprime.io/advisories/GHSA-fq2p-5p22-8g6j.md)
  `GHSA-fq2p-5p22-8g6j`, `CVE-2026-58429`, `GO-2026-6053` · Go `code.gitea.io/gitea`: affected `<1.27.0`, fixed in `1.27.0` · CVSS 4.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Broken access control, CWE-1259
- [Apache Answer: AdminToken not invalidated after admin deactivation](https://agentprime.io/advisories/GHSA-4gw2-vg4x-7p29.md)
  `GHSA-4gw2-vg4x-7p29`, `CVE-2026-25700`, `GO-2026-6249` · Go `github.com/apache/answer` and 1 more: affected `<2.0.1`, fixed in `2.0.1` · CVSS 7.2 High · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-1259
- [OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation](https://agentprime.io/advisories/GHSA-p49j-v9wc-wg57.md)
  `GHSA-p49j-v9wc-wg57`, `BIT-openbao-2026-40264`, `CVE-2026-40264`, `GO-2026-5526` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260420162526-f58111d2ca54`, fixed in `0.0.0-20260420162526-f58111d2ca54` · CVSS 2.0 Low · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-1259
- [jose4j is vulnerable to DoS via compressed JWE content](https://agentprime.io/advisories/GHSA-3677-xxcr-wjqv.md)
  `GHSA-3677-xxcr-wjqv`, `CVE-2024-29371` · Maven `org.bitbucket.b_c:jose4j`: affected `<0.9.6`, fixed in `0.9.6` · CVSS 7.5 High · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-1259
- [TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality.](https://agentprime.io/advisories/CVE-2025-56676.md)
  `CVE-2025-56676` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-1259
- [A security flaw in the '\_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT) project, allows users or attackers to tr…](https://agentprime.io/advisories/CVE-2025-56207.md)
  `CVE-2025-56207` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-1259
- [Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator](https://agentprime.io/advisories/CVE-2024-4598.md)
  `CVE-2024-4598` · CVE record: WSO2 WSO2 API Manager and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: CWE-1259
- [A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, particularly JWT tokens, due to improper validation of the Origin header.](https://agentprime.io/advisories/CVE-2025-50579.md)
  `CVE-2025-50579` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-1259
- [In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session management.](https://agentprime.io/advisories/CVE-2025-51306.md)
  `CVE-2025-51306` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-1259
- [Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout and allows a remote attacker to obtain sensitive information and execute arbitrary…](https://agentprime.io/advisories/CVE-2025-27955.md)
  `CVE-2025-27955` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-1259
- [Page table protection configuration vulnerability in the trusted firmware module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-45448.md)
  `CVE-2024-45448` · CVE record: Huawei HarmonyOS and 1 more · CVSS 4.1 Medium · Not analysed yet · Published 4 Sept 2024 · Tags: CWE-1259
- [AAD Pod Identity obtaining token with backslash in github.com/Azure/aad-pod-identity](https://agentprime.io/advisories/GHSA-p82q-rxpm-hjpc.md)
  `GHSA-p82q-rxpm-hjpc`, `CVE-2022-23551`, `GO-2022-1181` · Go `github.com/Azure/aad-pod-identity`: affected `<1.8.13`, fixed in `1.8.13` · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2024 · Tags: Broken access control, CWE-1259
- [Volcano has insecure permissions in volcano.sh/volcano](https://agentprime.io/advisories/GHSA-5g3x-8g2v-r8x8.md)
  `GHSA-5g3x-8g2v-r8x8`, `CVE-2024-36533`, `GO-2024-3034` · Go `volcano.sh/volcano`: affected `<1.10.0-alpha.0`, fixed in `1.10.0-alpha.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-1259
- [biscuit-java vulnerable to public key confusion in third party block](https://agentprime.io/advisories/GHSA-5hcj-rwm6-xmw4.md)
  `GHSA-5hcj-rwm6-xmw4`, `CVE-2024-41948` · Maven `org.biscuitsec:biscuit`: affected `>=3.0.0, <4.0.0`, fixed in `4.0.0` · CVSS 3.0 Low · Not analysed yet · Published 31 Jul 2024 · Tags: CWE-1259
- [KubePi's JWT token validation has a defect](https://agentprime.io/advisories/CVE-2024-36111.md)
  `CVE-2024-36111` · CVE record: 1Panel-dev KubePi · CVSS 6.3 Medium · Not analysed yet · Published 25 Jul 2024 · Tags: CWE-1259
- [jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC](https://agentprime.io/advisories/GHSA-hjrf-2m68-5959.md)
  `GHSA-hjrf-2m68-5959`, `CVE-2022-23541` · npm `jsonwebtoken`: affected `<9.0.0`, fixed in `9.0.0` · CVSS 5.0 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: Authentication bypass, CWE-1259

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1259>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1259/>. Everything for agents: <https://agentprime.io/llms.txt>.