# CWE-602.

Every Advisory and CVE whose sources give the weakness CWE-602, newest first.

## Records, newest first

- [Yealink MeetingBoard Pro: In Yealink MeetingBoard Pro before 331.320.0.64…](https://agentprime.io/advisories/CVE-2026-122148.md)
  `CVE-2026-122148` · CVE record: Yealink MeetingBoard Pro · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-602
- [ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies](https://agentprime.io/advisories/CVE-2026-119746.md)
  `CVE-2026-119746` · CVE record: ProSoft Technology X35-HWC-A and 1 more · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, CWE-602
- [Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering](https://agentprime.io/advisories/CVE-2026-89293.md)
  `CVE-2026-89293` · CVE record: Eclipse Foundation Eclipse Mnestix · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-602
- [Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php](https://agentprime.io/advisories/CVE-2026-117554.md)
  `CVE-2026-117554` · CVE record: admidio admidio · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-602
- [SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security](https://agentprime.io/advisories/CVE-2026-116605.md)
  `CVE-2026-116605` · CVE record: SourceCodester Online Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-602
- [WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit](https://agentprime.io/advisories/GHSA-2v5v-8f9v-xh85.md)
  `GHSA-2v5v-8f9v-xh85`, `CVE-2026-110314`, `EEF-CVE-2026-110314` · Hex `bandit`: affected `>=0.5.1, <1.14.0`, fixed in `1.14.0` · CVSS 6.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-602
- [A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0).](https://agentprime.io/advisories/CVE-2026-89206.md)
  `CVE-2026-89206` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-602
- [A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0).](https://agentprime.io/advisories/CVE-2026-89205.md)
  `CVE-2026-89205` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-602
- [Improper Authorization in Divasoft Software's Biletiva Ticketing Platform](https://agentprime.io/advisories/CVE-2026-13138.md)
  `CVE-2026-13138` · CVE record: Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-602
- [TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement](https://agentprime.io/advisories/CVE-2026-100306.md)
  `CVE-2026-100306` · CVE record: TDuckCloud tduck-survey-form · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-602
- [TREK: Public trip share link ignores the \`share_map\` permission server-side (client-enforced authorization → itinerary/location disclosure)](https://agentprime.io/advisories/CVE-2026-77320.md)
  `CVE-2026-77320` · CVE record: mauriceboe TREK · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Information disclosure, Broken access control, CWE-602
- [Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7](https://agentprime.io/advisories/CVE-2026-82189.md)
  `CVE-2026-82189` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-472, CWE-602
- [Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation](https://agentprime.io/advisories/CVE-2026-54047.md)
  `CVE-2026-54047` · CVE record: LaciSynchroni server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, CWE-349, CWE-602
- [Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication](https://agentprime.io/advisories/CVE-2026-89175.md)
  `CVE-2026-89175` · CVE record: Kingdom Communication Associated EH3040 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-602
- [Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6](https://agentprime.io/advisories/CVE-2026-77999.md)
  `CVE-2026-77999` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-472, CWE-602
- [tsi-coop tsi-dpdp-cms client-side enforcement of server-side security](https://agentprime.io/advisories/CVE-2026-84841.md)
  `CVE-2026-84841` · CVE record: tsi-coop tsi-dpdp-cms · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-602
- [RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field](https://agentprime.io/advisories/CVE-2026-77793.md)
  `CVE-2026-77793` · CVE record: Unknown RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-602
- [Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security](https://agentprime.io/advisories/CVE-2026-84110.md)
  `CVE-2026-84110` · CVE record: Releasit Releasit COD Form & Upsells · CVSS 6.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-602
- [Starlette-Admin's unvalidated \`order_by\` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS](https://agentprime.io/advisories/GHSA-6753-gr46-6wpr.md)
  `GHSA-6753-gr46-6wpr`, `CVE-2026-54553`, `PYSEC-2026-3924` · PyPI `starlette-admin`: affected `<0.16.1`, fixed in `0.16.1` · CVSS 5.4 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Information disclosure, Broken access control, CWE-248, CWE-602
- [Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check](https://agentprime.io/advisories/CVE-2026-73267.md)
  `CVE-2026-73267` · CVE record: Red Hat multicluster engine for Kubernetes 2.10 and 4 more · CVSS 7.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-602
- [Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5](https://agentprime.io/advisories/CVE-2026-77026.md)
  `CVE-2026-77026` · CVE record: tassos.gr Convert Forms extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-602
- [MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement](https://agentprime.io/advisories/CVE-2026-45274.md)
  `CVE-2026-45274` · CVE record: PoxenStudio talebook · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-602
- [Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2](https://agentprime.io/advisories/CVE-2026-67363.md)
  `CVE-2026-67363` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 7.7 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-472, CWE-602
- [Priority – CWE-602: Client-Side Enforcement of Server-Side Security](https://agentprime.io/advisories/CVE-2026-59504.md)
  `CVE-2026-59504` · CVE record: Priority Portal Generator addon to Priority ERP (developed by Soft Solutions) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-602
- [IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.](https://agentprime.io/advisories/CVE-2026-16480.md)
  `CVE-2026-16480` · CVE record: IBM Db2 · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-602
- [WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.](https://agentprime.io/advisories/CVE-2026-65938.md)
  `CVE-2026-65938` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 4.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Broken access control, CWE-602
- [Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)](https://agentprime.io/advisories/CVE-2026-72867.md)
  `CVE-2026-72867` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection, CWE-20, CWE-602
- [Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass](https://agentprime.io/advisories/CVE-2026-14831.md)
  `CVE-2026-14831` · CVE record: Unknown Easy Booking · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed…](https://agentprime.io/advisories/CVE-2026-17985.md)
  `CVE-2026-17985` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72…](https://agentprime.io/advisories/CVE-2026-17974.md)
  `CVE-2026-17974` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…](https://agentprime.io/advisories/CVE-2026-17960.md)
  `CVE-2026-17960` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in WebView in Google Chrome on Android prior to…](https://agentprime.io/advisories/CVE-2026-17953.md)
  `CVE-2026-17953` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72…](https://agentprime.io/advisories/CVE-2026-17821.md)
  `CVE-2026-17821` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…](https://agentprime.io/advisories/CVE-2026-17813.md)
  `CVE-2026-17813` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Glic in Google Chrome on Android prior to…](https://agentprime.io/advisories/CVE-2026-17805.md)
  `CVE-2026-17805` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72…](https://agentprime.io/advisories/CVE-2026-17756.md)
  `CVE-2026-17756` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…](https://agentprime.io/advisories/CVE-2026-17703.md)
  `CVE-2026-17703` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-602
- [Denial of Service in Quick.CMS](https://agentprime.io/advisories/CVE-2026-63301.md)
  `CVE-2026-63301` · CVE record: OpenSolution Quick.CMS · CVSS 7.0 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-602
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible…](https://agentprime.io/advisories/CVE-2026-64813.md)
  `CVE-2026-64813` · CVE record: JetBrains IntelliJ IDEA · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-602
- [JupyterLab PluginManager lock-rule enforcement bypass](https://agentprime.io/advisories/GHSA-h5v5-8746-g7mm.md)
  `GHSA-h5v5-8746-g7mm`, `BIT-jupyterlab-2026-73627`, `CVE-2026-73627` · PyPI `jupyterlab`: affected `>=4.1.0, <4.5.10 || >=4.6.0, <4.6.2`, fixed in `4.5.10`, `4.6.2` · CVSS 6.0 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control, CWE-602
- [Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler](https://agentprime.io/advisories/CVE-2026-65051.md)
  `CVE-2026-65051` · CVE record: Saturday Drive Ninja Forms · CVSS 6.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-602
- [Business Logic Bypass in Gobito's Corporate Training Management System](https://agentprime.io/advisories/CVE-2026-13724.md)
  `CVE-2026-13724` · CVE record: Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System · CVSS 4.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-602
- [Dash: Users can write to config despire permissions (OIDC tested)](https://agentprime.io/advisories/CVE-2026-46485.md)
  `CVE-2026-46485` · CVE record: lissy93 dashy · CVSS 8.2 High · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control, Authentication bypass, CWE-15, CWE-602
- [Google Chrome: Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115…](https://agentprime.io/advisories/CVE-2026-15130.md)
  `CVE-2026-15130` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a…](https://agentprime.io/advisories/CVE-2026-14109.md)
  `CVE-2026-14109` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a…](https://agentprime.io/advisories/CVE-2026-14086.md)
  `CVE-2026-14086` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47…](https://agentprime.io/advisories/CVE-2026-14081.md)
  `CVE-2026-14081` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…](https://agentprime.io/advisories/CVE-2026-14075.md)
  `CVE-2026-14075` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47…](https://agentprime.io/advisories/CVE-2026-14054.md)
  `CVE-2026-14054` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47…](https://agentprime.io/advisories/CVE-2026-14047.md)
  `CVE-2026-14047` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed…](https://agentprime.io/advisories/CVE-2026-14041.md)
  `CVE-2026-14041` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47…](https://agentprime.io/advisories/CVE-2026-14036.md)
  `CVE-2026-14036` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Media in Google Chrome on Windows prior to…](https://agentprime.io/advisories/CVE-2026-14033.md)
  `CVE-2026-14033` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to…](https://agentprime.io/advisories/CVE-2026-14007.md)
  `CVE-2026-14007` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed…](https://agentprime.io/advisories/CVE-2026-13930.md)
  `CVE-2026-13930` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47…](https://agentprime.io/advisories/CVE-2026-13919.md)
  `CVE-2026-13919` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47…](https://agentprime.io/advisories/CVE-2026-13903.md)
  `CVE-2026-13903` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-13901.md)
  `CVE-2026-13901` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-20, CWE-602
- [Google Chrome: Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a…](https://agentprime.io/advisories/CVE-2026-13896.md)
  `CVE-2026-13896` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602
- [Google Chrome: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47…](https://agentprime.io/advisories/CVE-2026-13894.md)
  `CVE-2026-13894` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-602

Older: <https://agentprime.io/advisories/tag/cwe-602.md?cursor=WyIyMDI2LTA2LTMwVDIyOjM4OjEyLjIxMzAwMFoiLCJDVkUtMjAyNi0xMzg5NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-602>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-602/>. Everything for agents: <https://agentprime.io/llms.txt>.