Advisories · Weakness
CWE-602.
Every Advisory and CVE whose sources give the weakness CWE-602, newest first.
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Vulnerabilities found in Watson Data Intelligence
- IBM watsonx.data intelligence
- CWE-602
- CVSS 7.5 High
Johnson & Johnson Audit Tracking Management System: Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows…
- Johnson & Johnson Audit Tracking Management System
- CWE-602
- CVSS 7.5 High
Johnson & Johnson Campus Recruiting: Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by…
- Johnson & Johnson Campus Recruiting
- CWE-602
- CVSS 7.1 High
Capgo - Two-Factor Authentication Bypass via Organization Management API
- Capgo
- CWE-602
- CVSS 6.8 Medium
NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action
- nanocoai nanoclaw
- CWE-602
- CVSS 8.7 High
U.S. GAO EPDS and CBCA EDS client-based privilege escalation
- Government Accountability Office Electronic Protest Docketing System (EPDS)
- Civilian Board of Contract Appeals Electronic Docketing System (EDS)
- CWE-602
- CVSS 6.5 Medium
Improper input validation in Google Chrome
- Google Chrome
- CWE-20
- CWE-602
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53…
- Google Chrome
- CWE-602
- CVSS 8.3 High
Google Chrome: Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53…
- Google Chrome
- CWE-602
- CVSS 6.3 Medium
Google Chrome: Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed…
- Google Chrome
- CWE-602
- CVSS 8.8 High
Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53…
- Google Chrome
- CWE-602
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Navigation in Google Chrome on Android prior to…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed…
- Google Chrome
- CWE-602
- CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53…
- Google Chrome
- CWE-602
- CVSS 8.1 High
Google Chrome: Insufficient policy enforcement in Password Manager in Google Chrome prior to…
- Google Chrome
- CWE-602
- CVSS 4.7 Medium
Iris has an Open Redirect issue
- dfir-iris iris-web
- CWE-602
- CVSS 7.3 High
Open WebUI has Improper Authorization Control
- Broken access control
- CWE-602
<0.1.124 · fixed in 0.1.124
GHSA-4vg5-rp28-gvjf · CVE-2026-44567 - CVSS 10.0 CriticalCritical · CVSS 9+
Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend
- sovity dataspace-portal
- Broken access control
- CWE-602
- CVSS 8.8 High
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
- Command injection
- CWE-20
>=4.0.0, <4.5.7 · fixed in 4.5.7
GHSA-37w4-hwhx-4rc4 · CVE-2026-42266 - CVSS 6.5 Medium
Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55…
- Google Chrome
- CWE-602
- CVSS 5.3 Medium
Frappe Learning Management System has Client-Side Manipulation of Quiz Scores
- frappe lms
- CWE-602
- CVSS 6.5 Medium
A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation.
- CWE-602
- CVSS 6.5 Medium
A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation.
- CWE-602
- CVSS 4.3 Medium
Google Chrome: Insufficient policy enforcement in DevTools in Google Chrome prior to 146.0.7680.71…
- Google Chrome
- CWE-602
- CVSS 8.9 High
Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)
- budibase
- CWE-602
- CVSS 7.5 High
FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info
- Information disclosure
- Authentication bypass
<0.0.0-20260307130210-09713b32a5f6 · fixed in 0.0.0-20260307130210-09713b32a5f6
GHSA-525j-95gf-766f · CVE-2026-30933 - CVSS 7.1 High
Frappe: Broken Access Control in DocShare
- frappe
- Broken access control
- CWE-602
- CVSS 4.8 Medium
RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies
- rustdesk-client RustDesk Client
- CWE-602
- CWE-841
- CVSS 7.1 High
FileBrowser Quantum: Password Protection Not Enforced on Shared File Links
- Information disclosure
- Authentication bypass
<0.0.0-20260221163904-dbcfba993b85 · fixed in 0.0.0-20260221163904-dbcfba993b85
GHSA-8vrh-3pm2-v4v6 · CVE-2026-27611 - CVSS 2.7 Low
Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.5…
- Dell Wyse Management Suite
- CWE-602
- CVSS 3.1 Low
Multiple vulnerabilities found in IBM ApplinX.
- IBM ApplinX
- CWE-602
- CVSS 5.3 Medium
Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
- bdthemes Spin Wheel – Interactive spinning wheel that offers coupons
- CWE-602
- CVSS 10.0 CriticalCritical · CVSS 9+
Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback
- calcom cal.com
- Broken access control
- CWE-602
- CVSS 4.3 Medium
Client-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center
- IBM Db2 Intelligence Center
- CWE-602
- CVSS 7.5 High
1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel
- Authentication bypass
- CWE-602
<2.0.14+incompatible · fixed in 2.0.14+incompatible
GHSA-qmg5-v42x-qqhq · CVE-2025-66507 - CVSS 2.7 Low
IBM Controller Validation Bypass
- IBM Controller
- IBM Cognos Controller
- CWE-602
- CVSS 9.8 CriticalCritical · CVSS 9+
mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features.
- CWE-602
- CVSS 7.5 High
SKT PayPal for WooCommerce <= 1.4 - Unauthenticated Payment Bypass
- sonalsinha21 SKT PayPal for WooCommerce
- CWE-602
- CVSS 7.3 High
Authentication Bypass in Turkguven's Perfektive
- Turkguven Software Technologies Inc. Perfektive
- Authentication bypass
- CWE-602
- CVSS 5.3 Medium
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
- themefic Hydra Booking — Appointment Scheduling & Booking Calendar
- CWE-602
- CVSS 4.8 Medium
security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.
- IBM Cloud Pak For Business Automation
- CWE-602
- CVSS 7.5 High
WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration
- wpclever WPC Name Your Price for WooCommerce
- CWE-602
- CVSS 5.5 Medium
Gallagher Command Centre Server: Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server…
- Gallagher Command Centre Server
- CWE-602
- CVSS 9.8 CriticalCritical · CVSS 9+
Missing Server-Side Authentication Checks in EfficientLab WorkExaminer Professional
- EfficientLab WorkExaminer Professional
- CWE-602
- CVSS 3.5 Low
IBM Engineering Requirements Management Doors Next data modification
- IBM Engineering Requirements Management Doors Next
- CWE-602
- CVSS 3.5 Low
IBM Engineering Requirements Management Doors Next security bypass
- IBM Engineering Requirements Management Doors Next
- CWE-602
- CVSS 8.9 High
An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 allows a remote attacker to escalate privileges via the app…
- CWE-602
- CVSS 8.7 High
Viessmann Vitogate 300 Authentication Bypass
- Viessmann Vitogate 300
- CWE-602
- CVSS 8.6 High
Cognex In-Sight Explorer and In-Sight Camera Firmware Client-Side Enforcement of Server-Side Security
- Cognex In-Sight 2000 series
- Cognex In-Sight 7000 series
- CWE-602
- CVSS 5.8 Medium
Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums.
- CWE-602
- CVSS 7.5 High
Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts
- railmedia Order Tip for WooCommerce
- CWE-602
- CVSS 5.3 Medium
LitmusChaos Litmus client-side enforcement of server-side security
- Litmus
- CWE-602
- CVSS 6.9 Medium
OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass
- OPEXUS FOIAXpress Public Access Link (PAL)
- Authentication bypass
- CWE-602
- CVSS 6.5 Medium
IBM Aspera Faspex bypass security
- IBM Aspera Faspex
- CWE-602
- CVSS 5.5 Medium
IBM SmartCloud Analytics - Log Analysis security bypass
- IBM SmartCloud Analytics Log Analysis
- CWE-602
- CVSS 5.5 Medium
IBM SmartCloud Analytics - Log Analysis security bypass
- IBM SmartCloud Analytics Log Analysis
- CWE-602
- CVSS 8.4 High
Lenovo FileZ Client: An authentication bypass vulnerability was reported in FileZ client application that…
- Lenovo FileZ Client
- CWE-602