16520 matches found
PT-2026-95501
Name of the Vulnerable Software and Affected Versions Convoy versions prior to 26.6.8 Description An issue exists in the GET /api/v1/projects/projectID/sources/sourceID endpoint where the system authorizes access to the project specified in the URL but fails to verify if the requested source...
WordPress Core <= 7.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Jesse McNeil in WordPress core versions = 7.1...
PT-2026-95305
Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description A Broken Access Control issue exists that allows a low-privileged user to obtain unauthorized access to administrative screens and functions intended for users with...
CVE-2026-67102: Improper Authorization
HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles...
grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API
A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...
grafana: Grafana: Unauthorized snapshot deletion via Broken Access Control in Snapshot API
A flaw was found in Grafana. An authenticated user with editor privileges could exploit a Broken Access Control BAC vulnerability in the Snapshot API. This flaw allows an editor to delete any dashboard snapshot, even those they do not have explicit read or write access to, leading to unauthorized...
NPM: Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
NPM: Tina: Broken Access Control letting any TinaCloud user authorize against any self-hosted site vulnerability discovered by ? in WordPress Npm next-tinacms-azure versions = 15.0.0...
Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...
GHSA-G74Q-6G2F-874X Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
Summary @tinacms/auth's isAuthorizedreq decides authorization by validating the caller's bearer token against https://identity.tinajs.io/v2/apps/$req.query.clientID/currentUser, where the clientID comes from the request and is never compared to the site's own configured TinaCloud app id. The...
CVE-2026-78528
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-74002
Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...
CVE-2026-74017
Unauthenticated Broken Access Control in User Registration = 5.2.7 versions...
CVE-2026-74000
Contributor Broken Access Control in Simple Membership = 4.8.2 versions...
CVE-2026-66676
Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...
EUVD-2026-81520
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-78528
CVE-2026-78528 affects the WordPress plugin BerqWP in versions 4.1.15 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, discovered by z3r0s , meaning any remote user can exploit it without prior authentication. The CVSS 3.1 score is 5.3 (MEDIUM) , with a vector of ...
CVE-2026-78528 WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...
CVE-2026-78528 WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BerqWP = 4.1.15 versions...