CVE-2026-67102

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CVE-2026-67102 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CVE-2026-67102

HCL BigFix Service Management is affected by a Broken Access Control vulnerability that allows a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles. The CVSS v3.1 score is 8.1 (HIGH) , with a vector of AV:N/AC:L/PR:L/UI:N/S...

CVE-2026-67102 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

EUVD-2026-82768

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

CVE-2026-12384

CVE-2026-12384 is an authorization bypass through a user-controlled key in the TECHIN2B Application , enabling privilege abuse . The affected version range is V1.0.7676.13 through 18092026 . The vulnerability is categorized as Broken Access Control and carries a CVSS 3.1 base score of 8.8 (HIGH) ...

CVE-2026-12384 Broken Access Control in TECHIN2B Application

Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects TECHIN2B Application: from V1.0.7676.13 through 18092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-12384 Broken Access Control in TECHIN2B Application

Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects TECHIN2B Application: from V1.0.7676.13 through 18092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

EUVD-2026-82681

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

CVE-2026-77170

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...

CVE-2026-77170

CVE-2026-77170 affects the Deck config API , where an insufficient authorization check allows any authenticated user to set board-scoped configuration keys for arbitrary board IDs without verifying ownership or management permission over the referenced board. The impact is rated MEDIUM (CVSS 3.0:...

CVE-2026-77170

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...

PT-2026-95501

Name of the Vulnerable Software and Affected Versions Convoy versions prior to 26.6.8 Description An issue exists in the GET /api/v1/projects/projectID/sources/sourceID endpoint where the system authorizes access to the project specified in the URL but fails to verify if the requested source...

CVE-2026-67102: Improper Authorization

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...

WordPress Core <= 7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jesse McNeil in WordPress core versions = 7.1...

PT-2026-95305

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description A Broken Access Control issue exists that allows a low-privileged user to obtain unauthorized access to administrative screens and functions intended for users with...

grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API

A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...

grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API

A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...

NPM: Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

NPM: Tina: Broken Access Control letting any TinaCloud user authorize against any self-hosted site vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions = 15.0.0...

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...