22157 matches found
PT-2026-36968
Name of the Vulnerable Software and Affected Versions Geeky Bot versions prior to 1.2.3 Description The Geeky Bot plugin for WordPress contains a missing authorization flaw. A nopriv AJAX route allows an attacker to control model/function dispatch, reaching a plugin installer helper that download...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the PlayAction process. An attacker can access and download unauthorized media files by sending authenticated requests to the /api/station/stationid/file/id/play endpoint without proper station-level permission...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the /api/internal/stationid/liquidsoap/action endpoint due to missing internal connection requirements and improper validation of the X-Liquidsoap-Api-Key header. An attacker can inject arbitrary metadata, disru...
GHSA-XCHC-CQWG-G76Q Argo has Missing Authorization in its Sync ConfigMap Provider
Summary The Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read, update, delete. Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps...
Argo has Missing Authorization in its Sync ConfigMap Provider
Summary The Sync Service's ConfigMap-backed provider server/sync/synccm.go performs zero authorization checks on all CRUD operations create, read, update, delete. Any authenticated user — including those using fake Bearer tokens — can create, read, update, and delete Kubernetes ConfigMaps...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the configMapSyncProvider process. An attacker can create, read, update, or delete Kubernetes ConfigMaps containing synchronization limits by sending crafted requests with any Bearer token, including fake tokens...
GHSA-X68M-C7JF-2572 Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the /api/system endpoint. An attacker can obtain sensitive internal system information, such as installed version and license data, by sending authenticated requests to this endpoint without the required...
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can...
GHSA-39CP-6679-8XV2 Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions
TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to update user information user.update or users.update permission is disabled. This can be due to configuration in the blueprints of the acting users, via options in the blueprints of the target...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the process for managing user avatars due to insufficient authorization checks. An attacker can gain unauthorized access to create, replace, or delete user avatars by leveraging file permissions without the...
GHSA-2H7V-4372-F6X2 Kirby CMS's read access to site, user and role information is not gated by permissions
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. This vulnerability is of high severity for affected sites. Sites using Kirby are not affected if they intend all users of the site to be able to list and access the site...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the authorization process. An attacker can gain unauthorized access to sensitive site, user, and role information by sending authenticated requests as a Panel user. This is only exploitable if the site is...
Missing Authorization
Overview org.apache.polaris:polaris-runtime-service is an a catalog for data lakes. It provides new levels of choice, flexibility and control over data, with full enterprise security and Apache Iceberg interoperability across a multitude of engines and infrastructure Affected versions of this...
VulnCheck KEV: CVE-2023-47783
Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0...
PT-2026-37195
Name of the Vulnerable Software and Affected Versions Argo Workflows versions 4.0.0 through 4.0.4 Description The Sync Service's ConfigMap-backed provider in server/sync/sync cm.go lacks authorization checks for all create, read, update, and delete CRUD operations. This allows any authenticated...
PT-2026-37168
Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0 Description Missing authorization in the content management system allows authenticated users to create, replace, or delete user avatars even when they lack the necessary permissions ...
CVE-2026-4024
Technical details about CVE-2026-4024 are not provided in the connected documents. Public specifics (affected versions, impact, fixes) require additional sources; monitor for updates.
CVE-2026-4024 Royal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification
The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wprupdateformactionmeta AJAX action in all versions up to, and including, 1.7.1056. The handler is registered on both wpajax and wpajaxnopriv hooks, maki...