251 matches found
PT-2026-28116
IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control...
Cross-Organization Public Dashboard Deletion via Missing Org Isolation
The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers...
Information Disclosure
Glances is vulnerable to Information Disclosure. The vulnerability is due to missing access control and filtering in the /api/4/config endpoint, which returns the full configuration including sensitive data such as passwords, API tokens, and cryptographic keys...
CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...
CVE-2026-27457 Weblate: Missing access control for the AddonViewSet API exposes all addon configurations
Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's AddonViewSet weblate/api/views.py, line 2831 uses queryset = Addon.objects.all without overriding getqueryset to scope results by user permissions. This allows any authenticated user or anonymous users if REQUIRELOG...
CVE-2026-27457
Weblate CVE-2026-27457 records a missing access control in the AddonViewSet: before 5.16.1, the REST API uses Addon.objects.all() without proper get_queryset scoping, allowing any authenticated user (or anonymous if REQUIRE_LOGIN is not set) to list or retrieve all addons across projects via GET ...
SUSE CVE-2026-26104
A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitiv...
CVE-2023-4102
QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...
CVE-2023-25068 WordPress Magazine Edge theme <= 1.13 - Authenticated Arbitrary Plugin Activation
Missing Authorization vulnerability in Mapro Collins Magazine Edge magazine-edge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Edge: from n/a through = 1.13...
PT-2025-47794
Name of the Vulnerable Software and Affected Versions Wazuh versions 4.3.0 through 4.12.9 Description Wazuh, a free and open source threat prevention, detection, and response platform, has an issue where a missing Access Control List ACL on the file "C:Program Files x86ossec-agentauthd.pass" coul...
CVE-2023-7317
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of...
CVE-2023-7317
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of...
CVE-2023-7317
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of...
CVE-2023-7317 Nagios XI < 2024R1 Web SSH Terminal Missing Access Control
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of...
CVE-2023-7317
CVE-2023-7317 affects Nagios XI prior to 2024R1 due to a missing access control in the Web SSH Terminal. A remote, low-privilege attacker could access/interact with the terminal without sufficient authorization, potentially leading to unauthorized command execution or disclosure of sensitive info...
PT-2025-44491
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1 Description Nagios XI versions prior to 2024R1 have a missing access control issue through the Web SSH Terminal. A remote attacker with low privileges could access or interact with the terminal interface...
CVE-2023-7317: Missing Authorization
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of...
Restaurant Brands International assistant platform 安全漏洞
Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in the Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from an unimplemented access control ...
PT-2025-42664
Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The software does not implement access control for the bathroom rating interface. Recommendations Implement access control for the bathroom rating...