CVE-2026-114356

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe transaction 153, shutdown 105...

EUVD-2026-108988

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe transaction 153, shutdown 105...

EUVD-2026-108978

A missing authorization vulnerability in Zimbra Collaboration Suite ZCS allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the pro...

CVE-2026-93639 Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation

A missing authorization vulnerability in Zimbra Collaboration Suite ZCS allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through ConfigureZimletRequest. The uploaded configuration can also add an attacker-controlled domain to the pro...

CVE-2026-93639

A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.20 allows a delegated administrator to overwrite global Zimlet configurations via ConfigureZimletRequest without explicit administrative grants. An attacker can leverage this to add a controlled do...

CVE-2026-25716

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...

CVE-2026-112825

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3...

CVE-2026-112821

Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0...

CVE-2026-112359

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86...

EUVD-2026-108651

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...

CVE-2026-25716 BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users

Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice Extension:BlueSpiceUserManager allows any authenticated user without special privileges to block or unblock arbitrary user accounts, including administrators. The REST endpoints /bs-usermanager/v1/block/create and...

CVE-2026-25716

Hallo Welt! GmbH BlueSpice is vulnerable to a Missing Authorization (CWE-862) flaw within the BlueSpiceUserManager extension. The REST endpoints /bs-usermanager/v1/block/create and /bs-usermanager/v1/block/delete fail to verify the permissions of the acting user when calling UserManager::blockUse...

EUVD-2026-108626

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86...

EUVD-2026-108623

Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through 1.5.3...

EUVD-2026-108624

Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0...

Chromium CVE-2026-113128: Missing authorization

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CLEANSTART-2026-VN72569 Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122)

Security vulnerability affects the sonarqube package. Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122...

PT-2026-122098

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe transaction 153, shutdown 105...

PT-2026-121789

Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knit Pay: from n/a through 9.6.3.0...

PT-2026-121788

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMobile.App: from n/a through 11.86...