CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions...

Combined image style - Moderately critical - Improper access control - SA-CONTRIB-2026-188

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

The vulnerabilities of Cisco Secure Email and Web Manager, as well as Cisco Secure Email Gateway, are related to deficiencies in access control. This allows attackers to bypass existing security mechanisms.

The vulnerabilities of Cisco Secure Email and Web Manager, as well as Cisco Secure Email Gateway, are related to deficiencies in access control. Exploiting these vulnerabilities could allow a malicious actor to bypass existing security mechanisms remotely...

CVE-2026-84791: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-90904: Improper Access Control

Joomla Extension - joomshaper.com - Broken Access Control ACL Bypass in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated...

PT-2026-97296

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can bypass access controls to create alert notifications for...

PT-2026-97577

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Improper access control allows unauthorized modification of application files. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2026-97674

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...

CVE-2026-93620: Missing Authorization

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

PT-2026-97454

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

PT-2026-97477

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

PT-2026-97480

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

PT-2026-97455

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

PT-2026-97473

Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a...

PT-2026-97446

Name of the Vulnerable Software and Affected Versions WSP MCP – AI Agents Connector versions prior to 2.7.1 Description Broken access control allows contributors to perform unauthorized actions within the system. Recommendations Update WSP MCP – AI Agents Connector to version 2.7.1 or later...

PT-2026-97448

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway versions prior to 8.2.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.2.5...

CVE-2026-6718: Incorrect Default Permissions

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-94080: Missing Authorization

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

CVE-2026-84789: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...