Common Weakness Enumeration

CWE-862

Allowed-with-Review

Missing Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

9048 vulnerabilities reference this CWE, most recent first.

CVE-2026-125398 (GCVE-0-2026-125398)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:28 – Updated: 2026-11-09 23:28
VLAI
Title
Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint
Summary
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
CoreBunch Instatic Affected: 0 , < 0.0.21 (semver)
Create a notification for this product.
Date Public
2026-11-03 00:00
Credits
Sriman Aluvala
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Instatic",
          "repo": "https://github.com/CoreBunch/Instatic",
          "vendor": "CoreBunch",
          "versions": [
            {
              "lessThan": "0.0.21",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sriman Aluvala"
        }
      ],
      "datePublic": "2026-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access checks by loading rows with getDataRow() instead of loadRowForAccess(). Attackers holding content.edit.any but lacking data.system.tables.read can send PATCH requests to /admin/api/cms/data/rows/:id/author to read system-table rows and reassign their authors."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:28:01.464Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m425-wmrc-4v4v)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/CoreBunch/Instatic/security/advisories/GHSA-m425-wmrc-4v4v"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CoreBunch/Instatic/commit/ff1e51eb59c860864fa24e8c3e2716b56314f3ad"
        },
        {
          "name": "Instatic v0.0.21 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CoreBunch/Instatic/releases/tag/v0.0.21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CoreBunch/Instatic/blob/v0.0.20/server/handlers/cms/data/rows.ts#L378-L398"
        },
        {
          "name": "VulnCheck Advisory: Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/instatic-before-0.0.21-authorization-bypass-via-row-author-reassignment-endpoint"
        }
      ],
      "title": "Instatic before 0.0.21 Authorization Bypass via Row Author Reassignment Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125398",
    "datePublished": "2026-11-09T23:28:01.464Z",
    "dateReserved": "2026-11-09T22:03:14.422Z",
    "dateUpdated": "2026-11-09T23:28:01.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125388 (GCVE-0-2026-125388)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
Summary
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
Intermesh Group-Office Affected: 0 , < 6.8.181 (semver)
Affected: 25.0.0 , < 25.0.116 (semver)
Affected: 26.0.0 , < 26.0.58 (semver)
    cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*
    cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*
    cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-11-09 00:00
Credits
leediay153 from Viettel Post
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Intermesh/groupoffice",
          "product": "Group-Office",
          "repo": "https://github.com/Intermesh/groupoffice",
          "vendor": "Intermesh",
          "versions": [
            {
              "lessThan": "6.8.181",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "25.0.116",
              "status": "affected",
              "version": "25.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "26.0.58",
              "status": "affected",
              "version": "26.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.181",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.0.116",
                  "versionStartIncluding": "25.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:intermesh:group-office:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.0.58",
                  "versionStartIncluding": "26.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "leediay153 from Viettel Post"
        }
      ],
      "datePublic": "2026-11-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:54.517Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-42qf-m3j9-837r)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/Intermesh/groupoffice/security/advisories/GHSA-42qf-m3j9-837r"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Intermesh/groupoffice/blob/v26.0.57/www/api/download.php#L89-L129"
        },
        {
          "name": "VulnCheck Advisory: Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/group-office-before-6.8.181-25.0.116-and-26.0.58-missing-authorization-in-forms-report-download"
        }
      ],
      "title": "Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125388",
    "datePublished": "2026-11-09T23:27:54.517Z",
    "dateReserved": "2026-11-09T22:03:10.643Z",
    "dateUpdated": "2026-11-09T23:27:54.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125378 (GCVE-0-2026-125378)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint
Summary
PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
PowerDNS-Admin PowerDNS-Admin Affected: 0 , < 2026.11.0 (custom)
Create a notification for this product.
Date Public
2026-10-22 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerDNS-Admin",
          "vendor": "PowerDNS-Admin",
          "versions": [
            {
              "lessThan": "2026.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/\u003ctemplate\u003e/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template\u0027s record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:47.499Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1941",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/issues/1941"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/blob/v2026.08.1/powerdnsadmin/routes/admin.py#L1683-L1687"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/commit/baa0a19730798dfac3dd6c2bdfad8616a80bc17a"
        },
        {
          "name": "PowerDNS-Admin v2026.11.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/PowerDNS-Admin/PowerDNS-Admin/releases/tag/v2026.11.0"
        },
        {
          "name": "VulnCheck Advisory: PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/powerdns-admin-before-2026.11.0-missing-authorization-via-template-apply-endpoint"
        }
      ],
      "title": "PowerDNS-Admin before 2026.11.0 Missing Authorization via Template Apply Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125378",
    "datePublished": "2026-11-09T23:27:47.499Z",
    "dateReserved": "2026-11-09T22:03:06.874Z",
    "dateUpdated": "2026-11-09T23:27:47.499Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125377 (GCVE-0-2026-125377)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:27 – Updated: 2026-11-09 23:27
VLAI
Title
Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client
Summary
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients' configured grant types.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
pig-mesh pig Affected: 0 , < 4.1.2 (semver)
Create a notification for this product.
Date Public
2026-10-22 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.pig4cloud/pig",
          "product": "pig",
          "vendor": "pig-mesh",
          "versions": [
            {
              "lessThan": "4.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/{clientId} and GET /client/export. Attackers can fetch clientSecret values for seed clients like pig, app, and daemon or export the client table, then obtain tokens using those clients\u0027 configured grant types."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:27:46.791Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1298",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/pig-mesh/pig/issues/1298"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/pig-mesh/pig"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/pig-mesh/pig/blob/a0d273afd3adc6678b065c0f2d25433541343ad7/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/controller/SysClientController.java#L69-L82"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pig-mesh/pig/commit/0fffbf14d393f30a0272a3cdf0a54efd45e0d9e3"
        },
        {
          "name": "pig v4.1.2 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/pig-mesh/pig/releases/tag/v4.1.2"
        },
        {
          "name": "VulnCheck Advisory: Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pig-before-4.1.2-missing-authorization-exposes-oauth2-client-secrets-via-client"
        }
      ],
      "title": "Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-125377",
    "datePublished": "2026-11-09T23:27:46.791Z",
    "dateReserved": "2026-11-09T22:03:06.495Z",
    "dateUpdated": "2026-11-09T23:27:46.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-125077 (GCVE-0-2026-125077)

Vulnerability from cvelistv5 – Published: 2026-11-09 23:45 – Updated: 2026-11-09 23:45 X_Freeware
VLAI
Title
SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgery
Summary
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
CWE
  • CWE-352 - Cross-Site Request Forgery
  • CWE-862 - Missing Authorization
Assigner
VulDB CNA
References
Impacted products
Vendor Product Version
SourceCodester Smart Attendance System with QR Code Scanner Affected: 1.0
    cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
yuechuya (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"
          ],
          "product": "Smart Attendance System with QR Code Scanner",
          "vendor": "SourceCodester",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yuechuya (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-Site Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T23:45:23.342Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-433181 | SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgery",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/433181"
        },
        {
          "name": "VDB-433181 | CTI Indicators (IOB, IOC)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/433181/cti"
        },
        {
          "name": "CVE-2026-125077 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-125077"
        },
        {
          "name": "Submit #1041016 | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Cross Site Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1041016"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-05-CSRF-Student-Deletion.md"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.sourcecodester.com/"
        }
      ],
      "tags": [
        "x_freeware"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-09T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-09T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-09T18:02:46.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgery",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-125077",
    "datePublished": "2026-11-09T23:45:23.342Z",
    "dateReserved": "2026-11-09T16:56:38.745Z",
    "dateUpdated": "2026-11-09T23:45:23.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124502 (GCVE-0-2026-124502)

Vulnerability from cvelistv5 – Published: 2026-11-09 00:00 – Updated: 2026-11-09 00:00 X_Open Source
VLAI
Title
yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization
Summary
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
CWE
Assigner
VulDB CNA
References
Impacted products
Vendor Product Version
yungifez Skuul School Management System Affected: 2.6.0
Affected: 2.6.1
Affected: 2.6.2
Affected: 2.6.3
Unaffected: 3.0.0
    cpe:2.3:a:yungifez:skuul_school_management_system:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Hussain Ahmed Hussain Ahmed (VulDB User) Hussain Ahmed (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:yungifez:skuul_school_management_system:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Delete Handler"
          ],
          "product": "Skuul School Management System",
          "vendor": "yungifez",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.0"
            },
            {
              "status": "affected",
              "version": "2.6.1"
            },
            {
              "status": "affected",
              "version": "2.6.2"
            },
            {
              "status": "affected",
              "version": "2.6.3"
            },
            {
              "status": "unaffected",
              "version": "3.0.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Hussain Ahmed"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Hussain Ahmed (VulDB User)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Hussain Ahmed (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T00:00:33.544Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-432807 | yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/432807"
        },
        {
          "name": "VDB-432807 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/432807/cti"
        },
        {
          "name": "CVE-2026-124502 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-124502"
        },
        {
          "name": "Submit #1034853 | yungifez Skuul School Management System 2.6.5 Improper Access Controls (Missing Authorization) in GraduationCo",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1034853"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/mrvirus2006/94d6e1ed1d6cd9ddf6412c734a76243d"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/yungifez/skuul/pull/433"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/yungifez/skuul/commit/b42f2c80a8e5e01ca6e607bbd97f137ede368ac9"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/yungifez/skuul/releases/tag/v3.0.0"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-08T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-11-08T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-11-08T15:12:17.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization",
      "x_generator": [
        "VulDB PVTS v202611"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-124502",
    "datePublished": "2026-11-09T00:00:33.544Z",
    "dateReserved": "2026-11-08T08:07:23.521Z",
    "dateUpdated": "2026-11-09T00:00:33.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124488 (GCVE-0-2026-124488)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16
VLAI
Title
OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters
Summary
OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.
Severity
8.6 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
openemr openemr Affected: 0 , < 8.3.0 (semver)
Unaffected: 8.3.0 (semver)
    cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-18 00:00
Credits
f3nrir77
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "openemr",
          "vendor": "openemr",
          "versions": [
            {
              "lessThan": "8.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "f3nrir77"
        }
      ],
      "datePublic": "2026-08-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:05.757Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-v58f-jcq4-pc4w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openemr/openemr/security/advisories/GHSA-v58f-jcq4-pc4w"
        },
        {
          "name": "VulnCheck Advisory: OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openemr-before-8.3.0-authorization-bypass-via-load-form-php-high-sensitivity-encounters"
        }
      ],
      "title": "OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124488",
    "datePublished": "2026-11-08T13:16:05.757Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-08T13:16:05.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124486 (GCVE-0-2026-124486)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16
VLAI
Title
OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller
Summary
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
openemr openemr Affected: 0 , < 8.3.0 (semver)
Unaffected: 8.3.0 (semver)
    cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-08-18 00:00
Credits
christos-cantina-security
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "openemr",
          "vendor": "openemr",
          "versions": [
            {
              "lessThan": "8.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "christos-cantina-security"
        }
      ],
      "datePublic": "2026-08-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients\u0027 documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patient_id to exfiltrate PHI and tamper with charts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:04.371Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-89j2-7cg2-mm93)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openemr/openemr/security/advisories/GHSA-89j2-7cg2-mm93"
        },
        {
          "name": "VulnCheck Advisory: OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openemr-before-8.3.0-missing-authorization-in-classic-document-controller"
        }
      ],
      "title": "OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124486",
    "datePublished": "2026-11-08T13:16:04.371Z",
    "dateReserved": "2026-11-08T02:21:16.290Z",
    "dateUpdated": "2026-11-08T13:16:04.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124484 (GCVE-0-2026-124484)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16
VLAI
Title
OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs
Summary
OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
openemr openemr Affected: 0 , < 8.4.0 (semver)
Unaffected: 8.4.0 (semver)
    cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-09-13 00:00
Credits
christos-cantina-security L0stHeart
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "openemr",
          "vendor": "openemr",
          "versions": [
            {
              "lessThan": "8.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "christos-cantina-security"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "L0stHeart"
        }
      ],
      "datePublic": "2026-09-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients\u0027 portal documents, signatures, and template data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:02.837Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-4r76-rq83-hgpg)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openemr/openemr/security/advisories/GHSA-4r76-rq83-hgpg"
        },
        {
          "name": "VulnCheck Advisory: OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openemr-before-8.4.0-missing-authorization-in-portal-onsite-document-apis"
        }
      ],
      "title": "OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124484",
    "datePublished": "2026-11-08T13:16:02.837Z",
    "dateReserved": "2026-11-08T02:17:31.141Z",
    "dateUpdated": "2026-11-08T13:16:02.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-124480 (GCVE-0-2026-124480)

Vulnerability from cvelistv5 – Published: 2026-11-08 13:16 – Updated: 2026-11-08 13:16
VLAI
Title
OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN
Summary
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
VulnCheck CNA
References
Impacted products
Vendor Product Version
openemr openemr Affected: 0 , < 8.4.0 (semver)
Unaffected: 8.4.0 (semver)
    cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-09-13 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "openemr",
          "vendor": "openemr",
          "versions": [
            {
              "lessThan": "8.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-09-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T13:16:00.035Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-5xf2-3h9x-f4m6)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/openemr/openemr/security/advisories/GHSA-5xf2-3h9x-f4m6"
        },
        {
          "name": "VulnCheck Advisory: OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openemr-before-8.4.0-authorization-bypass-via-fhir-questionnaireresponse-apicsrftoken"
        }
      ],
      "title": "OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124480",
    "datePublished": "2026-11-08T13:16:00.035Z",
    "dateReserved": "2026-11-08T02:17:31.141Z",
    "dateUpdated": "2026-11-08T13:16:00.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CAPEC-665: Exploitation of Thunderbolt Protection Flaws

An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

← Back to the CWE list