PT-2026-86669

Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...

PT-2026-86768

Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint returned fields including: organisation ID; UUID; name. Whe...

PT-2026-86738

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

CVE-2026-86283

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-86283

MISP 's UiBeta theme collection view template (app/View/Themed/UiBeta/Collections/view.ctp) contained an authorization bypass : while the controller correctly enforced per-user event ACL via Event::fetchSimpleEvents(), the view independently re-queried the same event UUIDs using only an Event.uui...

EUVD-2026-72137

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-86283 MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view app/View/Themed/UiBeta/Collections/view.ctp performed a secondary query of member events by UUID without applying the caller's access control list ACL. The CollectionsController::view action correctly resolved collection element UUIDs through...

CVE-2026-52766

YesWiki (PHP-based wiki system) is vulnerable to unauthenticated arbitrary page deletion prior to version 4.6.6 . The {{erasespamedcomments}} action (actions/EraseSpamedCommentsAction.php) processes a suppr[] array from POST and deletes pages whose tags match, with no authorization check in the a...

CVE-2026-19081

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19081 Missing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu System

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

EUVD-2026-71104

Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31...

CVE-2026-19043

Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-19043

CVE-2026-19043 is a Missing Authorization (ACL bypass) vulnerability in Menulux Portal by Menulux Software Inc. , affecting the critical POS management functions where access is not properly constrained by access control lists. This allows an authenticated low-privilege user to access functionali...

CVE-2026-19043 Authorization Bypass Critical POS Management Functions in Menulux Software's Menulux Portal

Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Menulux Portal: before 20260903211448...

BIT-JOOMLA-2026-73372 Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2

Joomla! Core - 20260809 - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets...

BIT-JOOMLA-2026-73371 Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260808 - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items...

BIT-JOOMLA-2026-72532 Joomla! Core - [20260805] - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260806 - Improper ACL checks for category webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create categories via webservices endpoints...

BIT-JOOMLA-2026-72531 Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260804 - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components...

BIT-JOOMLA-2026-71574 Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260803 - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI...