Filtered by CWE-285
Filtered by vendor Subscriptions
Total 1331 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-31869 1 Discourse 1 Discourse 2026-03-25 4.3 Medium
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user_reasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.
CVE-2026-32692 1 Canonical 1 Juju 2026-03-24 7.6 High
An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end.
CVE-2026-30702 1 Shenzhen Yuner Yipu 1 Wdr201a 2026-03-24 9.8 Critical
The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web management interface. The login page does not properly enforce session validation, allowing attackers to bypass authentication by directly accessing restricted web application endpoints through forced browsing
CVE-2026-21886 2 Citeum, Opencti-platform 2 Opencti, Opencti 2026-03-24 6.5 Medium
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue.
CVE-2026-32704 2 B3log, Siyuan 2 Siyuan, Siyuan 2026-03-23 6.5 Medium
SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This vulnerability is fixed in 3.6.1.
CVE-2025-68481 2 Fastapi-users, Fastapi-users Project 2 Fastapi-users, Fastapi Users 2026-03-05 5.9 Medium
FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=<attacker_code>&state=<attacker_state>`. Because the state JWT is valid for any client for \~1 hour, the victim’s browser will complete the flow. This leads to login CSRF. Depending on the app’s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker's account. Version 15.0.2 contains a patch for the issue.
CVE-2025-71242 1 Spip 1 Spip 2026-03-05 6.5 Medium
SPIP before 4.3.6, 4.2.17, and 4.1.20 allows unauthorized content disclosure in the private area. The application does not properly check authorization when displaying content of articles and sections (rubriques) in AJAX-loaded fragments, allowing an authenticated attacker to access restricted content. This vulnerability is not mitigated by the SPIP security screen.
CVE-2024-22021 1 Veeam 3 Availability Orchestrator, Disaster Recovery Orchestrator, Recovery Orchestrator 2026-03-02 4.3 Medium
Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.
CVE-2025-21348 1 Microsoft 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 2026-02-26 7.2 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-24418 1 Adobe 1 Adobe Commerce 2026-02-26 8.1 High
Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue does not require user interaction.
CVE-2025-26683 1 Microsoft 1 Azure Playwright 2026-02-26 8.1 High
Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-30389 1 Microsoft 1 Azure Ai Bot Service 2026-02-26 8.7 High
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-30390 1 Microsoft 1 Azure Machine Learning 2026-02-26 9.9 Critical
Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
CVE-2025-30392 1 Microsoft 1 Azure Ai Bot Service 2026-02-26 9.8 Critical
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-46840 1 Adobe 1 Experience Manager 2026-02-26 8.7 High
Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue requires user interaction. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high.
CVE-2025-49746 1 Microsoft 1 Azure Machine Learning 2026-02-26 9.9 Critical
Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
CVE-2025-53792 1 Microsoft 2 Azure, Azure Portal 2026-02-26 9.1 Critical
Azure Portal Elevation of Privilege Vulnerability
CVE-2025-26430 1 Google 1 Android 2026-02-26 7.8 High
In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-53795 1 Microsoft 1 Pc Manager 2026-02-26 9.1 Critical
Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-59271 1 Microsoft 3 Azure Cache For Redis, Azure Cache For Redis Enterprise, Azure Managed Redis 2026-02-26 8.7 High
Redis Enterprise Elevation of Privilege Vulnerability