GHSA-985R-Q3QP-299H phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Advisory / Disclosure phpMyFAQ 4.1.3 — incomplete fix for the admin-API IDOR/privilege-escalation class Target: thorsten/phpMyFAQ composer: thorsten/phpmyfaq, phpmyfaq/phpmyfaq Affected: "Only SuperAdmins may change other users' attributes. Self-service is always allowed." and "a non-SuperAdmin...

VulnCheck KEV: CVE-2024-50967

The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information...

PT-2025-2896 · Unknown · Becn Datagerry

Name of the Vulnerable Software and Affected Versions: Becon DATAGerry versions prior to 2.3 Description: The /rest/rights/ REST API endpoint contains an Incorrect Access Control issue, allowing an attacker to remotely access this endpoint without authentication. This leads to the unauthorized...