WordPress Core <= 7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jesse McNeil in WordPress core versions = 7.1...

PT-2026-95305

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description A Broken Access Control issue exists that allows a low-privileged user to obtain unauthorized access to administrative screens and functions intended for users with...

grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API

A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...

grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API

A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...

NPM: Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

NPM: Tina: Broken Access Control letting any TinaCloud user authorize against any self-hosted site vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions = 15.0.0...

GHSA-G74Q-6G2F-874X Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...

Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site

Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...

CVE-2026-78528

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

CVE-2026-74002

Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...

CVE-2026-74017

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-74000

Contributor Broken Access Control in Simple Membership = 4.8.2 versions...

CVE-2026-66676

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

EUVD-2026-81520

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

CVE-2026-78528

CVE-2026-78528 affects the WordPress plugin BerqWP in versions 4.1.15 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, discovered by z3r0s , meaning any remote user can exploit it without prior authentication. The CVSS 3.1 score is 5.3 (MEDIUM) , with a vector of ...

CVE-2026-78528 WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

CVE-2026-78528 WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...

CVE-2026-74017 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-74017 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

EUVD-2026-81517

Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...

CVE-2026-74017

WordPress User Registration plugin versions ≤ 5.2.7 contain an unauthenticated Broken Access Control vulnerability. The flaw allows a remote attacker with no prior privileges to access data they should not, resulting in a low confidentiality impact with no impact on integrity or availability. The...