Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
9055 vulnerabilities reference this CWE, most recent first.
CVE-2026-91825 (GCVE-0-2026-91825)
Vulnerability from cvelistv5 – Published: 2026-09-15 08:06 – Updated: 2026-09-15 14:19
VLAI
EPSS
VEX
Title
MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
Summary
Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.
The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.
The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.
Version affected: ≤2.5.45
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 13:59 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
CIRCL
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/cf3ee4026 | patch |
GCVE extensions
AI-generated
Confidence: high
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-09-15 07:50 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/cf3ee4026.patch
5229e7ba08a4… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
cf3ee40265ee
|
fix: [security] Authorise the event sharing group when | 5229e7ba08a4… |
Fix summary
The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user's access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model's _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.
Patch summary
Two files are modified with 25 lines of insertions. In EventsController.php (edit method), a new else-if branch is added after the existing distribution-handling logic: when distribution is not set, sharing_group_id is non-empty, and it differs from the stored value, the code calls SharingGroup->checkIfCanBeUsed() and throws MethodNotAllowedException on failure. In Event.php (_edit method), a new elseif branch is added for the case where distribution is not set in the submitted data but sharing_group_id is present; it calls SharingGroup->checkIfAuthorised() and returns an error array if the user lacks access. Both additions are narrowly scoped to the omitted-distribution path and do not alter behavior for explicitly stated non-4 distribution values.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: The attack requires only omitting a field from a standard edit request; no race condition or complex manipulation is needed. AT:N: No prior user interaction or attack preparation is required. PR:L: The attacker must be an authenticated user with edit access to at least one event. UI:N: No victim interaction is needed. VC:L: Event data may be exposed to members of the unauthorized sharing group. VI:H: The event's sharing group assignment is modified without authorization, directly compromising data integrity. VA:N: No availability impact. SC/SI/SA: No secondary system impact is evidenced; the impact is confined to the MISP instance's data integrity and the confidentiality of the affected event record.
Weakness rationale
- CWE-862 The authorization check for the sharing_group_id was conditionally executed only when the distribution field was explicitly set to 4. By omitting the distribution field, an attacker bypassed the authorization gate entirely, allowing an unauthorized sharing group assignment to be persisted. The check existed but was not applied to all code paths that could result in the sharing group being saved.
Assumptions to verify
- The affected version range is inferred from the tag_version_boundary (v2.5.46 with 216 commits after fix); no explicit fixed version tag is provided in the metadata, so the boundary is approximate.
- The attacker must already possess authenticated edit access to at least one event in MISP; the vulnerability does not grant access to users without any event edit permission.
- The impact assessment assumes the unauthorized sharing group contains other users who would gain visibility into the event data; if the target group is empty, the confidentiality impact is reduced.
- The patch was found during internal review per the commit message; no external reporter or finder is identified in the metadata.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 9 | high | 4 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91825",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T13:59:42.790533Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T14:19:38.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"EventsController (edit action)",
"Event model (_edit method)"
],
"product": "MISP",
"programFiles": [
"app/Controller/EventsController.php",
"app/Model/Event.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.46",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cp\u003eAffected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\u003c/p\u003e\n\u003cp\u003eThe vulnerable logic checked whether the acting user could use a \u003ccode\u003esharing_group_id\u003c/code\u003e only when the request explicitly supplied \u003ccode\u003edistribution = 4\u003c/code\u003e. If the attacker instead omitted \u003ccode\u003edistribution\u003c/code\u003e but supplied a different \u003ccode\u003esharing_group_id\u003c/code\u003e, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\u003c/p\u003e\n\u003cp\u003eThe fix adds authorization checks in both the controller and \u003ccode\u003eEvent::_edit()\u003c/code\u003e whenever a non-empty \u003ccode\u003esharing_group_id\u003c/code\u003e is supplied without \u003ccode\u003edistribution\u003c/code\u003e. The model now calls \u003ccode\u003eSharingGroup::checkIfAuthorised()\u003c/code\u003e before persisting the change.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eVersion affected: \u22642.5.45\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path.\n\n\nThe vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP\u2019s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved.\n\n\nThe fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change.\n\n\n\nVersion affected: \u22642.5.45"
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T08:06:32.511Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/cf3ee4026"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.\u003c/p\u003e"
}
],
"value": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate."
}
],
"title": "MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "review",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version range is inferred from the tag_version_boundary (v2.5.46 with 216 commits after fix); no explicit fixed version tag is provided in the metadata, so the boundary is approximate.",
"The attacker must already possess authenticated edit access to at least one event in MISP; the vulnerability does not grant access to users without any event edit permission.",
"The impact assessment assumes the unauthorized sharing group contains other users who would gain visibility into the event data; if the target group is empty, the confidentiality impact is reduced.",
"The patch was found during internal review per the commit message; no external reporter or finder is identified in the metadata."
],
"commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5 (1M context)"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The attack requires only omitting a field from a standard edit request; no race condition or complex manipulation is needed. AT:N: No prior user interaction or attack preparation is required. PR:L: The attacker must be an authenticated user with edit access to at least one event. UI:N: No victim interaction is needed. VC:L: Event data may be exposed to members of the unauthorized sharing group. VI:H: The event\u0027s sharing group assignment is modified without authorization, directly compromising data integrity. VA:N: No availability impact. SC/SI/SA: No secondary system impact is evidenced; the impact is confined to the MISP instance\u0027s data integrity and the confidentiality of the affected event record.",
"draft": false,
"fixSummary": "The fix adds an explicit authorization check for the sharing_group_id in the code path where the distribution field is omitted from the edit request. In the controller, if no distribution is submitted but a sharing_group_id is present and differs from the stored value, the user\u0027s access to that sharing group is verified via checkIfCanBeUsed before the edit proceeds. In the model\u0027s _edit method, a parallel check via checkIfAuthorised is added for the same condition, returning an error if the user is not authorized for the submitted sharing group. This closes the gap where omitting the distribution field bypassed the existing authorization gate.",
"generatedAt": "2026-09-15T07:50:41.743787Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 4,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e",
"patchSummary": "Two files are modified with 25 lines of insertions. In EventsController.php (edit method), a new else-if branch is added after the existing distribution-handling logic: when distribution is not set, sharing_group_id is non-empty, and it differs from the stored value, the code calls SharingGroup-\u003echeckIfCanBeUsed() and throws MethodNotAllowedException on failure. In Event.php (_edit method), a new elseif branch is added for the case where distribution is not set in the submitted data but sharing_group_id is present; it calls SharingGroup-\u003echeckIfAuthorised() and returns an error array if the user lacks access. Both additions are narrowly scoped to the omitted-distribution path and do not alter behavior for explicitly stated non-4 distribution values.",
"patchTruncated": false,
"patches": [
{
"commit": "cf3ee40265ee102f28dae9ec313abe4162aff8e3",
"patchSha256": "5229e7ba08a4a77a41d8205ce51428ae17242c7dc7873bc4c087fb828631869e",
"source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
"subject": "fix: [security] Authorise the event sharing group when"
}
],
"source": "https://github.com/MISP/MISP/commit/cf3ee4026.patch",
"subject": "fix: [security] Authorise the event sharing group when",
"tagVersionBoundary": {
"commits_after_fix": 216,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.46",
"version": "2.5.46",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-862",
"rationale": "The authorization check for the sharing_group_id was conditionally executed only when the distribution field was explicitly set to 4. By omitting the distribution field, an attacker bypassed the authorization gate entirely, allowing an unauthorized sharing group assignment to be persisted. The check existed but was not applied to all code paths that could result in the sharing group being saved."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20122"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-91825",
"datePublished": "2026-09-15T08:06:32.511Z",
"dateReserved": "2026-09-15T08:06:29.530Z",
"dateUpdated": "2026-09-15T14:19:38.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91774 (GCVE-0-2026-91774)
Vulnerability from cvelistv5 – Published: 2026-09-15 01:20 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint
Summary
Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 19:16 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/YaoApp/yao/issues/1553 | issue-tracking |
| https://github.com/YaoApp/yao/blob/v1.0.0-rc22/op… | technical-description |
| https://github.com/YaoApp/yao/blob/v1.0.0-rc22/op… | technical-description |
| https://github.com/YaoApp/yao | product |
| https://www.vulncheck.com/advisories/yao-through-… | third-party-advisory |
Date Public
2026-06-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91774",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T19:16:16.787473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:29:28.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/yaoapp/yao",
"product": "yao",
"vendor": "YaoApp",
"versions": [
{
"lessThanOrEqual": "1.0.0-rc22",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without membership verification."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:26.964Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/YaoApp/yao/issues/1553"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/YaoApp/yao/blob/v1.0.0-rc22/openapi/user/team.go#L80-L149"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/YaoApp/yao/blob/v1.0.0-rc22/openapi/oauth/providers/user/team.go#L37-L55"
},
{
"tags": [
"product"
],
"url": "https://github.com/YaoApp/yao"
},
{
"name": "VulnCheck Advisory: Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/yao-through-1.0.0-rc22-missing-authorization-via-openapi-team-endpoint"
}
],
"title": "Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91774",
"datePublished": "2026-09-15T01:20:35.168Z",
"dateReserved": "2026-09-15T00:45:13.460Z",
"dateUpdated": "2026-09-24T14:22:26.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91707 (GCVE-0-2026-91707)
Vulnerability from cvelistv5 – Published: 2026-09-18 06:38 – Updated: 2026-09-18 14:31
VLAI
EPSS
VEX
Title
Divi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint
Summary
The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the 'Force Enable D4 Shortcode Framework' option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:17 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
Wordfence
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Elegant Themes | Divi |
Affected:
0 , ≤ 5.11.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91707",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:17:48.158908Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:31:43.410Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Divi",
"vendor": "Elegant Themes",
"versions": [
{
"lessThanOrEqual": "5.11.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Osvaldo Noe Gonzalez Del Rio (Os)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. When the \u0027Force Enable D4 Shortcode Framework\u0027 option is enabled, this includes invoking the et_pb_contact_form shortcode to send email to an attacker-selected recipient with attacker-controlled content."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T06:38:53.658Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/79a2fa3b-f9eb-49d8-97be-3a81d1b69c2e?source=cve"
},
{
"url": "https://www.divichangelog.com/"
},
{
"url": "https://www.divichangelog.com/divi-update/divi-5/version-5-12-0"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T22:43:21.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-17T18:29:03.000Z",
"value": "Disclosed"
}
],
"title": "Divi \u003c= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via \u0027content\u0027 Parameter via Shortcode Module REST Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91707",
"datePublished": "2026-09-18T06:38:53.658Z",
"dateReserved": "2026-09-14T22:28:28.481Z",
"dateUpdated": "2026-09-18T14:31:43.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91167 (GCVE-0-2026-91167)
Vulnerability from cvelistv5 – Published: 2026-09-21 18:54 – Updated: 2026-09-22 15:40
VLAI
EPSS
VEX
Title
Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary
Summary
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 14:12 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/warp-tech/warpgate/security/ad… | x_refsource_CONFIRM |
| https://github.com/warp-tech/warpgate/commit/c020… | x_refsource_MISC |
| https://github.com/warp-tech/warpgate/releases/ta… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T14:12:28.626585Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:40:23.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "warpgate",
"vendor": "warp-tech",
"versions": [
{
"status": "affected",
"version": "\u003c 0.28.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:54:38.214Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-fjgc-484v-j6mf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/warp-tech/warpgate/security/advisories/GHSA-fjgc-484v-j6mf"
},
{
"name": "https://github.com/warp-tech/warpgate/commit/c020900a9d85989e4280bd03184976bc33e2e61d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/warp-tech/warpgate/commit/c020900a9d85989e4280bd03184976bc33e2e61d"
},
{
"name": "https://github.com/warp-tech/warpgate/releases/tag/v0.28.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/warp-tech/warpgate/releases/tag/v0.28.4"
}
],
"source": {
"advisory": "GHSA-fjgc-484v-j6mf",
"discovery": "UNKNOWN"
},
"title": "Warpgate: Missing authorization check on `PUT /users/:id/roles/:role_id` allows any admin to bypass the `AccessRolesAssign` permission boundary"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91167",
"datePublished": "2026-09-21T18:54:38.214Z",
"dateReserved": "2026-09-14T21:20:41.196Z",
"dateUpdated": "2026-09-22T15:40:23.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91160 (GCVE-0-2026-91160)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:42 – Updated: 2026-10-05 15:33
VLAI
EPSS
VEX
Title
OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream
Summary
OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 14:53 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rmyndharis/OpenWA/security/adv… | x_refsource_CONFIRM |
| https://github.com/rmyndharis/OpenWA/pull/1602 | x_refsource_MISC |
| https://github.com/rmyndharis/OpenWA/commit/acc23… | x_refsource_MISC |
| https://github.com/rmyndharis/OpenWA/commit/b9d9e… | x_refsource_MISC |
| https://github.com/rmyndharis/OpenWA/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rmyndharis | OpenWA |
Affected:
< 0.23.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T14:53:06.862079Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T15:33:28.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenWA",
"vendor": "rmyndharis",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:42:02.788Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj"
},
{
"name": "https://github.com/rmyndharis/OpenWA/pull/1602",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rmyndharis/OpenWA/pull/1602"
},
{
"name": "https://github.com/rmyndharis/OpenWA/commit/acc23c3803c07f43791a92e8e48456572fd69bdc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rmyndharis/OpenWA/commit/acc23c3803c07f43791a92e8e48456572fd69bdc"
},
{
"name": "https://github.com/rmyndharis/OpenWA/commit/b9d9ea1c57bde98b7833a5d6e482998703667ef0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rmyndharis/OpenWA/commit/b9d9ea1c57bde98b7833a5d6e482998703667ef0"
},
{
"name": "https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5"
}
],
"source": {
"advisory": "GHSA-m427-j4h4-9qwj",
"discovery": "UNKNOWN"
},
"title": "OpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91160",
"datePublished": "2026-09-24T16:42:02.788Z",
"dateReserved": "2026-09-14T21:20:41.196Z",
"dateUpdated": "2026-10-05T15:33:28.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91156 (GCVE-0-2026-91156)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:33 – Updated: 2026-10-14 17:42
VLAI
EPSS
VEX
Title
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Summary
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:41 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
GitHub_M
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/046… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/87b… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ba7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/cac… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:41:47.693023Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:42:03.003Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.9"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.3"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.1"
},
{
"status": "affected",
"version": "\u003e= 2026.9.0-latest, \u003c 2026.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site\u0027s group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel\u0027s full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:33:33.121Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q"
},
{
"name": "https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e"
},
{
"name": "https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb"
},
{
"name": "https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1"
},
{
"name": "https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8"
}
],
"source": {
"advisory": "GHSA-gh4f-qr62-vx8q",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91156",
"datePublished": "2026-10-14T15:33:33.121Z",
"dateReserved": "2026-09-14T21:20:41.195Z",
"dateUpdated": "2026-10-14T17:42:03.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91108 (GCVE-0-2026-91108)
Vulnerability from cvelistv5 – Published: 2026-10-03 05:29 – Updated: 2026-10-03 15:42
VLAI
EPSS
VEX
Title
Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action
Summary
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner's paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-03 15:33 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
Wordfence
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| alttextai | Alt Text AI – Automatically generate image alt text for SEO and accessibility |
Affected:
0 , ≤ 1.10.41
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-03T15:33:11.401945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T15:42:45.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility",
"vendor": "alttextai",
"versions": [
{
"lessThanOrEqual": "1.10.41",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Webbernaut"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Alt Text AI \u2013 Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site \u2014 including content they do not own \u2014 with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO manipulation and unauthorized consumption of the site owner\u0027s paid AltText.ai API credits. The nonce required to invoke the action is emitted on every admin page including /wp-admin/profile.php, which is accessible to Subscribers, making the nonce trivially obtainable by any authenticated user."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-03T05:29:13.391Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/216e3087-52f1-4b2e-a31c-0c2ddf41aefb?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/alttext-ai/tags/1.10.38/includes/class-atai-post.php#L275"
},
{
"url": "https://plugins.trac.wordpress.org/browser/alttext-ai/tags/1.10.38/includes/class-atai.php#L271"
},
{
"url": "https://plugins.trac.wordpress.org/browser/alttext-ai/tags/1.10.38/admin/class-atai-admin.php#L75"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3723468%40alttext-ai\u0026new=3723468%40alttext-ai"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-02T16:34:58.000Z",
"value": "Disclosed"
}
],
"title": "Alt Text AI \u003c= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91108",
"datePublished": "2026-10-03T05:29:13.391Z",
"dateReserved": "2026-09-14T19:34:00.791Z",
"dateUpdated": "2026-10-03T15:42:45.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91092 (GCVE-0-2026-91092)
Vulnerability from cvelistv5 – Published: 2026-09-22 07:41 – Updated: 2026-09-23 18:46
VLAI
EPSS
VEX
Title
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
Summary
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author's forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author's email address.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:37 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
Wordfence
CNA
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| tomdever | wpForo Forum |
Affected:
0 , ≤ 3.1.5
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91092",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:37:44.048003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:46:53.727Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "wpForo Forum",
"vendor": "tomdever",
"versions": [
{
"lessThanOrEqual": "3.1.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jonah Burgess (CryptoCat)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to take over another guest author\u0027s forum post and modify its title, body, author name, and stored owner email address. This requires that guest posting and editing are enabled on the forum, and that the attacker knows the target guest author\u0027s email address."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T07:41:13.210Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97084759-a8fb-4b26-a6fa-93d005b1110e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Posts.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/includes/functions.php#L2820"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Members.php#L3704"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/classes/Actions.php#L806"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wpforo/tags/3.1.5/includes/hooks.php#L1004"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3702319%40wpforo\u0026new=3702319%40wpforo"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-14T18:24:03.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-21T19:01:21.000Z",
"value": "Disclosed"
}
],
"title": "wpForo Forum \u003c= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-91092",
"datePublished": "2026-09-22T07:41:13.210Z",
"dateReserved": "2026-09-14T18:11:51.829Z",
"dateUpdated": "2026-09-23T18:46:53.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91085 (GCVE-0-2026-91085)
Vulnerability from cvelistv5 – Published: 2026-09-29 08:39 – Updated: 2026-10-01 14:18
VLAI
EPSS
VEX
Title
Apache Karaf: config:install missing ACL entry allows privilege escalation to admin
Summary
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true. The safety valve for this, karaf.secured.command.compulsory.roles, ships commented out in etc/system.properties, so an unmatched command is allowed for any authenticated user.
The shipped org.apache.karaf.command.acl.config ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no install entry. It restricts delete to admin, restricts edit/property-*/update on the jmx.acl.*, org.apache.karaf.command.acl.* and org.apache.karaf.service.acl.* PIDs to admin, and allows manager for everything else, but config:install was simply unmatched, and therefore allowed for any authenticated user, including one holding only the viewer role.
config:install <url> <finalname> fetches url and writes it into ${karaf.etc} as finalname. It calls PathUtils.checkWithin() to block .. traversal outside karaf.etc, but that folder holds every security-relevant file Karaf ships: users.properties, keys.properties, host.key, and all org.apache.karaf.*.acl.* files, including the very ACL file that (mis)governs this command. With -o/--override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL.
Because felix.fileinstall.dir = ${karaf.etc} (etc/config.properties), Felix FileInstall also watches and reloads any .cfg file dropped there, closing the loop without requiring a restart.
By contrast, bundle:install, feature:install and kar:install are all admin-only in their own ACLs, and config:delete is admin in this same ACL, config:install was the outlier.
MitigationAdd install = admin in etc/org.apache.karaf.command.acl.config.cfg (create the file is absent), and/or set karaf.secured.command.compulsory.roles=admin in etc/system.properties (and restart) to make unmatched commands fail closed by default.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 14:17 UTC
CWE
Assigner
apache
CNA
References
2 references
| URL | Tags |
|---|---|
| https://karaf.apache.org/security/cve-2026-91085.txt | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Karaf |
Affected:
0 , < 4.4.12
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-29T09:15:47.789Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/28/10"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91085",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T14:17:41.304608Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:18:12.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Karaf",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Rin Ray \u003crindilray@gmail.com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache Karaf\u0027s shell/SSH command security is enforced by per-scope ACL configuration files (\u003ccode\u003eetc/org.apache.karaf.command.acl.\u0026lt;scope\u0026gt;.cfg\u003c/code\u003e).\u0026nbsp;\u003ccode\u003eSecuredSessionFactoryImpl.checkSecurity()\u003c/code\u003e\u0026nbsp;resolves the roles required for an invocation and, when no ACL rule matches the command, \u003cb\u003efails open\u003c/b\u003e:\u0026nbsp;\u003ccode\u003eACLConfigurationParser.Specificity.NO_MATCH\u003c/code\u003e\u0026nbsp;sets\u0026nbsp;\u003ccode\u003epassCheck = true\u003c/code\u003e. The safety valve for this,\u0026nbsp;\u003ccode\u003ekaraf.secured.command.compulsory.roles\u003c/code\u003e, ships commented out in\u0026nbsp;\u003ccode\u003eetc/system.properties\u003c/code\u003e, so an unmatched command is allowed for any authenticated user.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe shipped\u0026nbsp;\u003ccode\u003eorg.apache.karaf.command.acl.config\u003c/code\u003e\u0026nbsp;ACL (\u003ccode\u003eassemblies/features/standard/src/main/feature/feature.xml\u003c/code\u003e, mirrored into\u0026nbsp;\u003ccode\u003einstance/.../etc/org.apache.karaf.command.acl.config.cfg\u003c/code\u003e) has no\u0026nbsp;\u003ccode\u003einstall\u003c/code\u003e\u0026nbsp;entry. It restricts\u0026nbsp;\u003ccode\u003edelete\u003c/code\u003e\u0026nbsp;to\u0026nbsp;\u003ccode\u003eadmin\u003c/code\u003e, restricts\u0026nbsp;\u003ccode\u003eedit\u003c/code\u003e/\u003ccode\u003eproperty-*\u003c/code\u003e/\u003ccode\u003eupdate\u003c/code\u003e\u0026nbsp;on the\u0026nbsp;\u003ccode\u003ejmx.acl.*\u003c/code\u003e,\u0026nbsp;\u003ccode\u003eorg.apache.karaf.command.acl.*\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003eorg.apache.karaf.service.acl.*\u003c/code\u003e\u0026nbsp;PIDs to\u0026nbsp;\u003ccode\u003eadmin\u003c/code\u003e, and allows\u0026nbsp;\u003ccode\u003emanager\u003c/code\u003e\u0026nbsp;for everything else, but\u0026nbsp;\u003ccode\u003econfig:install\u003c/code\u003e\u0026nbsp;was simply unmatched, and therefore allowed for any authenticated user, including one holding only the\u0026nbsp;\u003ccode\u003eviewer\u003c/code\u003e\u0026nbsp;role.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003econfig:install \u0026lt;url\u0026gt; \u0026lt;finalname\u0026gt;\u003c/span\u003e\u0026nbsp;fetches\u0026nbsp;\u003ccode\u003eurl\u003c/code\u003e\u0026nbsp;and writes it into\u0026nbsp;\u003ccode\u003e${karaf.etc}\u003c/code\u003e\u0026nbsp;as\u0026nbsp;\u003ccode\u003efinalname\u003c/code\u003e. It calls\u0026nbsp;\u003ccode\u003ePathUtils.checkWithin()\u003c/code\u003e\u0026nbsp;to block\u0026nbsp;\u003ccode\u003e..\u003c/code\u003e\u0026nbsp;traversal outside\u0026nbsp;\u003ccode\u003ekaraf.etc\u003c/code\u003e, but that folder holds every security-relevant file Karaf ships:\u0026nbsp;\u003ccode\u003eusers.properties\u003c/code\u003e,\u0026nbsp;\u003ccode\u003ekeys.properties\u003c/code\u003e,\u0026nbsp;\u003ccode\u003ehost.key\u003c/code\u003e, and all\u0026nbsp;\u003ccode\u003eorg.apache.karaf.*.acl.*\u003c/code\u003e\u0026nbsp;files, including the very ACL file that (mis)governs this command. With\u0026nbsp;\u003ccode\u003e-o\u003c/code\u003e/\u003ccode\u003e--override\u003c/code\u003e, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eBecause\u0026nbsp;\u003ccode\u003efelix.fileinstall.dir = ${karaf.etc}\u003c/code\u003e\u0026nbsp;(\u003ccode\u003eetc/config.properties\u003c/code\u003e), Felix FileInstall also watches and reloads any\u0026nbsp;\u003ccode\u003e.cfg\u003c/code\u003e\u0026nbsp;file dropped there, closing the loop without requiring a restart.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eBy contrast,\u0026nbsp;\u003ccode\u003ebundle:install\u003c/code\u003e,\u0026nbsp;\u003ccode\u003efeature:install\u003c/code\u003e\u0026nbsp;and\u0026nbsp;\u003ccode\u003ekar:install\u003c/code\u003e\u0026nbsp;are all\u0026nbsp;\u003ccode\u003eadmin\u003c/code\u003e-only in their own ACLs, and\u0026nbsp;\u003ccode\u003econfig:delete\u003c/code\u003e\u0026nbsp;is\u0026nbsp;\u003ccode\u003eadmin\u003c/code\u003e\u0026nbsp;in this same ACL,\u0026nbsp;\u003ccode\u003econfig:install\u003c/code\u003e\u0026nbsp;was the outlier.\u003c/div\u003e\u003ch3\u003eMitigation\u003c/h3\u003e\u003cdiv\u003eAdd\u0026nbsp;\u003ccode\u003einstall = admin\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003eetc/org.apache.karaf.command.acl.config.cfg\u003c/code\u003e\u0026nbsp;(create the file is absent), and/or set\u0026nbsp;\u003ccode\u003ekaraf.secured.command.compulsory.roles=admin\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003eetc/system.properties\u003c/code\u003e\u0026nbsp;(and restart) to make unmatched commands fail closed by default.\u003c/div\u003e"
}
],
"value": "Apache Karaf\u0027s shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.\u003cscope\u003e.cfg).\u00a0SecuredSessionFactoryImpl.checkSecurity()\u00a0resolves the roles required for an invocation and, when no ACL rule matches the command, fails open:\u00a0ACLConfigurationParser.Specificity.NO_MATCH\u00a0sets\u00a0passCheck = true. The safety valve for this,\u00a0karaf.secured.command.compulsory.roles, ships commented out in\u00a0etc/system.properties, so an unmatched command is allowed for any authenticated user.\n\n\nThe shipped\u00a0org.apache.karaf.command.acl.config\u00a0ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into\u00a0instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no\u00a0install\u00a0entry. It restricts\u00a0delete\u00a0to\u00a0admin, restricts\u00a0edit/property-*/update\u00a0on the\u00a0jmx.acl.*,\u00a0org.apache.karaf.command.acl.*\u00a0and\u00a0org.apache.karaf.service.acl.*\u00a0PIDs to\u00a0admin, and allows\u00a0manager\u00a0for everything else, but\u00a0config:install\u00a0was simply unmatched, and therefore allowed for any authenticated user, including one holding only the\u00a0viewer\u00a0role.\n\n\n\n\nconfig:install \u003curl\u003e \u003cfinalname\u003e\u00a0fetches\u00a0url\u00a0and writes it into\u00a0${karaf.etc}\u00a0as\u00a0finalname. It calls\u00a0PathUtils.checkWithin()\u00a0to block\u00a0..\u00a0traversal outside\u00a0karaf.etc, but that folder holds every security-relevant file Karaf ships:\u00a0users.properties,\u00a0keys.properties,\u00a0host.key, and all\u00a0org.apache.karaf.*.acl.*\u00a0files, including the very ACL file that (mis)governs this command. With\u00a0-o/--override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL.\n\n\n\n\nBecause\u00a0felix.fileinstall.dir = ${karaf.etc}\u00a0(etc/config.properties), Felix FileInstall also watches and reloads any\u00a0.cfg\u00a0file dropped there, closing the loop without requiring a restart.\n\n\n\n\nBy contrast,\u00a0bundle:install,\u00a0feature:install\u00a0and\u00a0kar:install\u00a0are all\u00a0admin-only in their own ACLs, and\u00a0config:delete\u00a0is\u00a0admin\u00a0in this same ACL,\u00a0config:install\u00a0was the outlier.\n\nMitigationAdd\u00a0install = admin\u00a0in\u00a0etc/org.apache.karaf.command.acl.config.cfg\u00a0(create the file is absent), and/or set\u00a0karaf.secured.command.compulsory.roles=admin\u00a0in\u00a0etc/system.properties\u00a0(and restart) to make unmatched commands fail closed by default."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T08:39:33.209Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://karaf.apache.org/security/cve-2026-91085.txt"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Karaf: config:install missing ACL entry allows privilege escalation to admin",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91085",
"datePublished": "2026-09-29T08:39:33.209Z",
"dateReserved": "2026-09-14T17:55:38.562Z",
"dateUpdated": "2026-10-01T14:18:12.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91048 (GCVE-0-2026-91048)
Vulnerability from cvelistv5 – Published: 2026-09-29 08:34 – Updated: 2026-10-01 14:13
VLAI
EPSS
VEX
Title
Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
Summary
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration".
The same applies to jms:* shell commands.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 14:13 UTC
CWE
Assigner
apache
CNA
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Karaf |
Affected:
0 , < 4.4.12
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-09-29T09:15:44.666Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/28/9"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-91048",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T14:13:10.417139Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:13:30.717Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Karaf",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.4.12",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "MopMonk-AI \u003cmopmonk-ai@tophant.com\u003e"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The\u0026nbsp;\u003ccode\u003ejdbc\u003c/code\u003e\u0026nbsp;shell command scope shipped no\u0026nbsp;\u003ccode\u003eorg.apache.karaf.command.acl.jdbc.cfg\u003c/code\u003e. Karaf\u0027s command guard (\u003ccode\u003eSecuredSessionFactoryImpl\u003c/code\u003e) treats a command with no matching ACL rule as \u003cb\u003eallowed\u003c/b\u003e, so any authenticated shell session (including one holding only the\u0026nbsp;\u003ccode\u003eviewer\u003c/code\u003e\u0026nbsp;role) could run every\u0026nbsp;\u003ccode\u003ejdbc:*\u003c/code\u003e\u0026nbsp;command.\u0026nbsp;\u003ccode\u003ejdbc:ds-create\u003c/code\u003e\u0026nbsp;stores a fully attacker-controlled JDBC URL into a\u0026nbsp;\u003ccode\u003epax-jdbc-config\u003c/code\u003e\u0026nbsp;factory\u0026nbsp;\u003ccode\u003eConfiguration\u003c/code\u003e\u0026nbsp;with no validation.\u0026nbsp;\u003ccode\u003epax-jdbc-config\u003c/code\u003e\u0026nbsp;reactively turns that into a live\u0026nbsp;\u003ccode\u003eDataSource\u003c/code\u003e. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2\u0026nbsp;\u003ccode\u003eINIT=RUNSCRIPT\u003c/code\u003e), so a\u0026nbsp;\u003ccode\u003eviewer\u003c/code\u003e-level shell user could reach arbitrary code execution, bypassing the\u0026nbsp;\u003ccode\u003eadmin\u003c/code\u003e-role gate that already protects\u0026nbsp;\u003ccode\u003eshell:exec\u003c/code\u003e. This is a privilege-escalation-to-RCE chain, not merely an \"admin misconfiguration\".\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe same applies to\u0026nbsp;\u003ccode\u003ejms:*\u003c/code\u003e\u0026nbsp;shell commands.\u003c/div\u003e"
}
],
"value": "The\u00a0jdbc\u00a0shell command scope shipped no\u00a0org.apache.karaf.command.acl.jdbc.cfg. Karaf\u0027s command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the\u00a0viewer\u00a0role) could run every\u00a0jdbc:*\u00a0command.\u00a0jdbc:ds-create\u00a0stores a fully attacker-controlled JDBC URL into a\u00a0pax-jdbc-config\u00a0factory\u00a0Configuration\u00a0with no validation.\u00a0pax-jdbc-config\u00a0reactively turns that into a live\u00a0DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2\u00a0INIT=RUNSCRIPT), so a\u00a0viewer-level shell user could reach arbitrary code execution, bypassing the\u00a0admin-role gate that already protects\u00a0shell:exec. This is a privilege-escalation-to-RCE chain, not merely an \"admin misconfiguration\".\n\n\nThe same applies to\u00a0jms:*\u00a0shell commands."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T08:34:47.193Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-91048",
"datePublished": "2026-09-29T08:34:47.193Z",
"dateReserved": "2026-09-14T17:14:08.734Z",
"dateUpdated": "2026-10-01T14:13:30.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.