Advisories · Weakness
CWE-602.
Every Advisory and CVE whose sources give the weakness CWE-602, newest first.
- CVSS 8.2 High
Yealink MeetingBoard Pro: In Yealink MeetingBoard Pro before 331.320.0.64…
- Yealink MeetingBoard Pro
- CWE-602
- CVSS 8.2 High
ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies
- ProSoft Technology X35-HWC-A
- ProSoft Technology ICX35-HWC-E
- Authentication bypass
- CWE-602
- CVSS 8.8 High
Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering
- Eclipse Foundation Eclipse Mnestix
- Broken access control
- CWE-602
- CVSS 5.3 Medium
Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
- admidio
- CWE-602
- CVSS 6.9 Medium
SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security
- SourceCodester Online Food Ordering System
- CWE-602
- CVSS 6.3 Medium
WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
- CWE-602
>=0.5.1, <1.14.0 · fixed in 1.14.0
GHSA-2v5v-8f9v-xh85 · CVE-2026-110314 - CVSS 5.3 Medium
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0).
- Siemens RUGGEDCOM CROSSBOW
- CWE-602
- CVSS 5.3 Medium
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0).
- Siemens RUGGEDCOM CROSSBOW
- CWE-602
- CVSS 8.6 High
Improper Authorization in Divasoft Software's Biletiva Ticketing Platform
- Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform
- CWE-602
- CVSS 6.9 Medium
TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement
- TDuckCloud tduck-survey-form
- CWE-602
- CVSS 5.3 Medium
TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
- mauriceboe TREK
- Information disclosure
- Broken access control
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- CWE-472
- CWE-602
- CVSS 9.2 CriticalCritical · CVSS 9+
Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation
- LaciSynchroni server
- Authentication bypass
- CWE-349
- CVSS 6.9 Medium
Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication
- Kingdom Communication Associated EH3040
- Kingdom Communication Associated EH4200
- CWE-602
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
- j2commerce.com J2Store extension for Joomla
- CWE-472
- CWE-602
- CVSS 6.9 Medium
tsi-coop tsi-dpdp-cms client-side enforcement of server-side security
- tsi-coop tsi-dpdp-cms
- CWE-602
- CVSS 5.3 Medium
RegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price Field
- RegistrationMagic
- CWE-602
- CVSS 6.9 Medium
Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security
- Releasit COD Form & Upsells
- CWE-602
- CVSS 5.4 Medium
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
- Information disclosure
- Broken access control
<0.16.1 · fixed in 0.16.1
GHSA-6753-gr46-6wpr · CVE-2026-54553 - CVSS 7.7 High
Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.namespace with no local ownership check
- Red Hat multicluster engine for Kubernetes 2.10
- Red Hat multicluster engine for Kubernetes 2.11
- CWE-602
- CVSS 6.9 Medium
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5
- tassos.gr Convert Forms extension for Joomla
- CWE-602
- CVSS 6.9 Medium
MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enforcement
- PoxenStudio talebook
- CWE-602
- CVSS 7.7 High
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
- balbooa.com Balbooa Forms extension for Joomla
- CWE-472
- CWE-602
- CVSS 9.1 CriticalCritical · CVSS 9+
Priority – CWE-602: Client-Side Enforcement of Server-Side Security
- Portal Generator addon to Priority ERP (developed by Soft Solutions)
- CWE-602
- CVSS 4.3 Medium
IBM® Db2® is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.
- IBM Db2
- CWE-602
- CVSS 4.3 Medium
WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.
- Progress Software Corporation WhatsUp Gold
- Broken access control
- CWE-602
- CVSS 9.9 CriticalCritical · CVSS 9+
Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fields in Compose Deployment Pipeline (server-side regex missing in compose.ts)
- dokploy
- Command injection
- CWE-20
- CVSS 5.3 Medium
Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass
- Easy Booking
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72…
- Google Chrome
- CWE-602
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in WebView in Google Chrome on Android prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Glic in Google Chrome on Android prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…
- Google Chrome
- CWE-602
- CVSS 7.0 High
Denial of Service in Quick.CMS
- OpenSolution Quick.CMS
- CWE-602
- CVSS 10.0 CriticalCritical · CVSS 9+
JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible…
- JetBrains IntelliJ IDEA
- CWE-602
- CVSS 6.0 Medium
JupyterLab PluginManager lock-rule enforcement bypass
- Broken access control
- CWE-602
>=4.1.0, <4.5.10 || >=4.6.0, <4.6.2 · fixed in 4.5.10, 4.6.2
GHSA-h5v5-8746-g7mm · CVE-2026-73627 - CVSS 6.9 Medium
Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler
- Saturday Drive Ninja Forms
- CWE-602
- CVSS 4.3 Medium
Business Logic Bypass in Gobito's Corporate Training Management System
- Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System
- CWE-602
- CVSS 8.2 High
Dash: Users can write to config despire permissions (OIDC tested)
- lissy93 dashy
- Broken access control
- Authentication bypass
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115…
- Google Chrome
- CWE-602
- CVSS 9.6 CriticalCritical · CVSS 9+
Google Chrome: Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a…
- Google Chrome
- CWE-602
- CVSS 8.8 High
Google Chrome: Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…
- Google Chrome
- CWE-602
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602
- CVSS 8.8 High
Google Chrome: Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed…
- Google Chrome
- CWE-602
- CVSS 8.8 High
Google Chrome: Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Media in Google Chrome on Windows prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602
- CVSS 8.8 High
Google Chrome: Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602
- CVSS 9.6 CriticalCritical · CVSS 9+
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602