CWE-862

Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to dow

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress

The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability chec

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 1

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /ap

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin

ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYP

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowin

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending me

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoi

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP

The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handler

The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJA

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legac

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vul

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission t

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or p

A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overal

Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permissio

Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission

Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user

The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, no

Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated us

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Cont

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, a

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_temp

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7

SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain applicati

SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on cer

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of

CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that

The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX ac

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

An authenticated user may view private Puppet module metadata without repository read access.

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditi

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API

An authenticated user without repository read permission may access package metadata under specific conditions.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/s

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2