9489 matches found
Improper Authorization
Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks on the asset request cancellation endpoint, where user-controlled URL parameters can specify another user's pending request, allowing authenticated attackers to cancel asset requests...
Improper Authorization
Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks when deleting pending checkout acceptance records, where the endpoint validates only report viewing permissions and does not verify access to the associated asset, allowing users to delete...
Improper Authorization
Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks when adding licenses to predefined kits, where the API validates kit edit permissions but not access to the referenced license, allowing low-privilege users to associate licenses they are no...
PT-2026-60815
Name of the Vulnerable Software and Affected Versions HCL DevOps Loop affected versions not specified Description Improper authorization checks allow unauthorized users to access restricted administrative functionality through forced browsing, which involves directly accessing protected applicati...
CVE-2026-62208: Insufficiently Protected Credentials
OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization. Impact depends on the operator's...
CVE-2026-49977: Improper Authorization
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by...
Improper Authorization
tarteaucitron is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation of HTML data attributes used for cookie deletion, which allows an attacker to craft malicious elements that trick users into unintentionally deleting cookies when clicked...
CVE-2026-61718: Improper Authorization
bunkerweb is an Open-source and next-generation Web Application Firewall WAF. From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @loginrequired, including POST...
Improper Authorization
n8n-mcp is vulnerable to Improper Authorization. The vulnerability is due to insufficient tenant isolation in multi-tenant HTTP mode, which allows an authenticated tenant to access locally stored workflow version backups outside of its assigned tenant scope...
Improper Authorization
n8n-mcp is vulnerable to Improper Authorization. The vulnerability is due to insufficient tenant isolation of locally stored workflow version history, which allows an authenticated tenant to read or delete workflow backups belonging to other tenants, exposing sensitive configuration data and...
Improper Authorization
FlaskBB is vulnerable to Improper Authorization. The vulnerability is due to a type mismatch in the bulk group deletion protection check, where integer group IDs are incorrectly compared against string values, allowing authenticated administrators to delete built-in authorization groups and...
CVE-2026-49997: Improper Authorization
SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purgeedges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone.withpermsfalse when a connected node was...
CVE-2026-45337: Improper Authorization
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny...
EUVD-2026-44364
Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review...
CVE-2026-48321
Technical details are not publicly available in the provided documents; no affected products, versions, or remediation are specified. Monitor for updates.
EUVD-2026-43775
Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally...
CVE-2026-58540
Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally...
CVE-2026-58277
Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...