EUVD-2026-92547

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2026-105632

The open-source project management tool Plane is vulnerable to a broken access control flaw in versions prior to 1.4.0 . The GraphQL joinProject mutation allows any workspace member to add themselves to any project within that workspace, including private/secret projects (network=0 ) to which the...

CVE-2026-105632 Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace including network=0 secret/private projects they were never invited to and grants them a full Member role read + write. The...

CVE-2025-25614

CVE-2025-25614 Incorrect Access Control in Unifiedtransform v2.0 leads to Privilege Escalation, allowing teachers to update the personal data of fellow teachers. Vendor: Unifiedtransform PoC Step 1: Log in to the application as a Teacher. Step 2: Browse to the following endpoint: /teachers/edit/3...

CVE-2021-33104

CVE-2021-33104 Intel Advisory - Improper access control in the IntelR OFU software before version 14.1.28 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00769.html...

CVE-2024-32371

CVE-2024-32371 Description Description A vulnerability identified as CVE-2024-32371 allows an attacker to elevate privileges by changing the type parameter from 1 to 0. This vulnerability enables an attacker with a regular user account to escalate their privileges and gain administrative access t...

CVE-2023-22515-POC

CVE-2023-22515 CVE-2023-22515, a critical vulnerability affecting on-premises instances of Confluence Server and Confluence Data Center, a Broken Access Control vulnerability. Attlassian has provided a CVSS base score of 10.0 Exploit Brief explanation: 1- Due to how Xwork interceptors parses...

CVE-2026-78122-POC

CVE-2026-78122 — Proof of Concept Tecnativadocker-socket-proxy ≤ 0.5.0 — Insufficient Access-Control Granularity CWE-1220 CVSS 4.0: 8.3 High — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N Attack Vector is Adjacent AV:A: the attacker needs local/adjacent network reach to the pro...

enforcement-coverage

Enforcement Coverage Finds API routes that carry a weaker authorization control than their siblings. It found CVE-2026-45316 in Open WebUI from source alone, with no advisory knowledge: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3 comparable write operations on note require hasaccesswrite...

CVE-2026-104966

Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspace through PATCH...

CVE-2026-104967

Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's workspace and project. The permission...

route-detect

route-detect Find authentication authn and authorization authz security bugs in web application routes: Routes fromkoel streaming server Web application HTTP route authn and authz bugs are some of the most common security issues found today. These industry standard resources highlight the severit...

EUVD-2026-92486

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

CVE-2021-21551

CVE-2021-21551 Dell Driver EoP CVE-2021-21551 Description Dell dbutil23.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required. This exploit was tested o...

CVE-2023-22515

1vere$k CVE-2023-22515 iveresk-CVE-2023-22515 El 4 de octubre de 2023, Atlassian publicó un aviso para CVE-2023-22515, una vulnerabilidad crítica que afecta a instancias locales de Confluence Server y Confluence Data Center. Atlassian describió inicialmente esta vulnerabilidad como una Escalada d...

CVE-2023-49978

CVE-2023-49978 Customer Support System 1.0 - Control de Acceso Incorrecto Descripción : El control de acceso incorrecto en Customer Support System v1 permite que usuarios no administradores accedan a páginas administrativas y ejecuten acciones reservadas para administradores. Versión del Producto...

CVE-2024-25832-PoC

CVE-2024-25830 y CVE-2024-25832 - DataCube3: Control de Acceso Inadecuado y Carga de Archivos Sin Restricciones. Resumen Este repositorio presenta una Prueba de Concepto PoC para una cadena de explotación de dos pasos dirigida a dispositivos DataCube3. Combina CVE-2024-25830 Control de Acceso...

CVE-2024-48217

CVE-2024-48217 Sismart Vulnerability CVE Assigned: CVE-2024-48217 mitre.org nvd.nist.org tenable.com Date: 5 September 2024 Author: Ajriel Rizqy Maulana Software Link: SiSMART Aplikasi Pintar Penunjang Proses Pendidikan - 7.4.0 SiSMART Aplikasi Pintar Penunjang Proses Pendidikan API Version: 7.4....

CVE-2026-105421

Missing Authorization vulnerability in Kit Kit formerly ConvertKit for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit formerly ConvertKit for WooCommerce: from n/a through 2.2.0...