Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
9048 vulnerabilities reference this CWE, most recent first.
CVE-2026-112239 (GCVE-0-2026-112239)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 15:45
VLAI
EPSS
VEX
Title
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
Summary
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:45 UTC
CWE
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "TYPO3 AI Integration Extension" |
Affected:
0 , < 14.0.2
(semver)
|
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:45:40.097139Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:45:50.344Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "nitsan/ns-t3ai",
"product": "Extension \"TYPO3 AI Integration Extension\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "14.0.2",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sven Wappler"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Nitsan"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user\u0027s permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them."
}
],
"value": "The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user\u0027s permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:30:46.019Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-035"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"TYPO3 AI Integration Extension\" (ns_t3ai)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112239",
"datePublished": "2026-10-20T09:30:46.019Z",
"dateReserved": "2026-10-19T11:29:07.528Z",
"dateUpdated": "2026-10-20T15:45:50.344Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112222 (GCVE-0-2026-112222)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:28 – Updated: 2026-10-19 14:59 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:58 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Date Public
2026-10-19 13:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:58:55.457366Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:59:04.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "surferseo",
"product": "Surfer",
"vendor": "Surfer",
"versions": [
{
"changes": [
{
"at": "1.8.1.759",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.8.0.744",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mor Golan | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-19T13:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Surfer: from n/a through 1.8.0.744.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:29:19.976Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/surferseo/vulnerability/wordpress-surfer-plugin-1-8-0-744-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Surfer plugin to the latest available version (at least 1.8.1.759)."
}
],
"value": "Update the WordPress Surfer plugin to the latest available version (at least 1.8.1.759)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Surfer plugin \u003c= 1.8.0.744 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-112222",
"datePublished": "2026-10-19T13:28:19.208Z",
"dateReserved": "2026-10-19T11:03:54.088Z",
"dateUpdated": "2026-10-19T14:59:04.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112218 (GCVE-0-2026-112218)
Vulnerability from cvelistv5 – Published: 2026-10-22 08:47 – Updated: 2026-10-22 10:56 X_Open Source
VLAI
EPSS
VEX
Title
WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability
Summary
Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 10:45 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
Patchstack
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ahmad | Majestic Support |
Affected:
0 , ≤ 1.2.1
(custom)
|
Date Public
2026-10-22 08:46
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T10:45:30.759738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:56:13.526Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "majestic-support",
"product": "Majestic Support",
"vendor": "Ahmad",
"versions": [
{
"changes": [
{
"at": "1.2.2",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HAIMIN | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-10-22T08:46:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Majestic Support: from n/a through 1.2.1.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.1."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T08:47:02.835Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/majestic-support/vulnerability/wordpress-majestic-support-plugin-1-2-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Majestic Support plugin to the latest available version (at least 1.2.2)."
}
],
"value": "Update the WordPress Majestic Support plugin to the latest available version (at least 1.2.2)."
}
],
"tags": [
"x_open-source"
],
"title": "WordPress Majestic Support plugin \u003c= 1.2.1 - Broken Access Control vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-112218",
"datePublished": "2026-10-22T08:47:02.409Z",
"dateReserved": "2026-10-19T10:48:11.893Z",
"dateUpdated": "2026-10-22T10:56:13.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112192 (GCVE-0-2026-112192)
Vulnerability from cvelistv5 – Published: 2026-10-19 09:28 – Updated: 2026-10-30 10:06
VLAI
EPSS
VEX
Title
MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings
Summary
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.
As a result:
- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.
- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.
An authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.
Affected: <2.5.48
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-19 09:23 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:13 UTC
CWE
Assigner
CIRCL
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/6c02f0f5c | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
2 events
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-19 09:23 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/6c02f0f5c.patch
e7e99bab776b… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
6c02f0f5c33a
|
fix: [settings] Module settings keep the flags the module | e7e99bab776b… |
Fix summary
The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.
Patch summary
In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings 'redacted' and 'cli_only'. For each flag, if the module's own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.
CVSS rationale
AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component's data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component's configuration. SC/SI/SA:N: No evidence of impact on other components or systems.
Weakness rationale
- CWE-200 The redacted flag, which instructs the server to mask a setting's value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure.
- CWE-862 The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified.
Attack pattern rationale
- CAPEC-126 The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.
- PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.
- The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.
- VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.
- The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | medium | 5 |
- 2026-09-28 10:14 UTC Fix developed Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module https://github.com/MISP/MISP/commit/6c02f0f5c.patch
- 2026-09-29 08:11 UTC Fix available Fix released in MISP v2.5.48. https://github.com/MISP/MISP/releases/tag/v2.5.48
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112192",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:13:11.731385Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:13:51.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"app/Model/Server.php (readModuleSettings)"
],
"product": "MISP",
"programFiles": [
"app/Model/Server.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\u003c/p\u003e\u003cp\u003eAs a result:\u003c/p\u003e\u003cp\u003e- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\u003c/p\u003e\u003cp\u003e- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\u003c/p\u003e\u003cp\u003eAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metadata.\n\nAs a result:\n\n- A module that marks a setting (such as an API key) as redacted still has its value returned in full by the servers/getSetting and servers/serverSettingsEdit endpoints, exposing sensitive credentials to any authenticated user who can read server settings.\n\n- A module that marks a setting as cli_only (intended to be editable only via the command-line interface) can still be modified through the web API, bypassing the intended access restriction.\n\nAn authenticated user with access to server settings can therefore read sensitive module credentials and modify settings that the module author intended to restrict to CLI-only access.\n\nAffected: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Sensitive Data Discovery"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T09:23:47Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T10:06:28.714Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/6c02f0f5c"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.\u003c/p\u003e"
}
],
"value": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (fix is 10 commits after v2.5.48); the exact fixed release version is not stated in the patch metadata.",
"PR:L assumes that reading server settings requires an authenticated MISP user with appropriate role permissions; the patch does not specify the exact permission level required.",
"The CAPEC-126 mapping is the closest available pattern for the information-disclosure aspect; the authorization-bypass aspect (cli_only) does not have a precise CAPEC match and is subsumed under the same mapping.",
"VC:L assumes the exposed data is limited to module-specific API keys rather than system-wide credentials; the actual sensitivity depends on which modules are installed.",
"The commit message references a separate issue (branch read) reported by Jeroen Pinoy; this vulnerability was discovered as a side effect of fixing that issue, so Jeroen Pinoy is not credited as a finder of this specific vulnerability."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The primary impact is that sensitive data (module API keys marked as redacted) is discoverable via standard API endpoints because the redaction flag was not enforced. An authenticated user querying server settings can obtain credentials that the module author intended to keep hidden. This is the closest CAPEC to the information-disclosure aspect of the vulnerability. The secondary aspect (CLI-only settings editable via API) is an authorization bypass that does not map cleanly to a single CAPEC; CAPEC-126 is selected as the best available match for the overall pattern of accessing data that should be restricted."
}
],
"commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5"
}
],
"cvssRationale": "AV:N: MISP is a web application accessible over the network. AC:L: No special race conditions or complex setup are needed; a standard API call to the settings endpoint triggers the issue. AT:N: No manipulation of the attack target is required. PR:L: The attacker needs an authenticated MISP account with permission to view server settings. UI:N: No user interaction is required. VC:L: Sensitive module API keys are exposed, but the scope is limited to settings of modules that declare the redacted flag. VI:N: No direct integrity impact on the vulnerable component\u0027s data beyond the VA impact. VA:L: CLI-only settings can be modified via the API, representing a limited integrity impact on the vulnerable component\u0027s configuration. SC/SI/SA:N: No evidence of impact on other components or systems.",
"fixSummary": "The fix ensures that the redacted and cli_only flags declared by a module in its own setting definition are preserved when the server rebuilds the setting for API exposure. By carrying these flags through to the final setting object, the existing enforcement logic (which checks these flags before serving values or accepting edits) now correctly applies to module-supplied settings, preventing disclosure of redacted values and blocking API-based modification of CLI-only settings.",
"generatedAt": "2026-10-19T09:23:47.526920Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
"patchSummary": "In app/Model/Server.php, within the readModuleSettings() method, a loop was added after the setting fields are populated that iterates over the strings \u0027redacted\u0027 and \u0027cli_only\u0027. For each flag, if the module\u0027s own result array contains a truthy value for that key, the flag is set to true on the rebuilt $setting object before it is stored in $serverSettings. This is a 6-line addition that preserves the module-declared guard flags that were previously discarded during the setting reconstruction.",
"patchTruncated": false,
"patches": [
{
"commit": "6c02f0f5c33aab96e90df8791c3873303d7e99ce",
"date": "Mon, 28 Sep 2026 12:14:28 +0200",
"patchSha256": "e7e99bab776b221dd41bf562693fc308d8a2ee619806b1bfef26bb008212205a",
"source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"subject": "fix: [settings] Module settings keep the flags the module"
}
],
"source": "https://github.com/MISP/MISP/commit/6c02f0f5c.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T09:23:47Z",
"version": "2.0.3"
},
"subject": "fix: [settings] Module settings keep the flags the module",
"tagVersionBoundary": {
"commits_after_fix": 10,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-200",
"rationale": "The redacted flag, which instructs the server to mask a setting\u0027s value (e.g., an API key), was dropped during setting reconstruction. This caused the sensitive value to be served in plaintext via API endpoints to any authenticated user, constituting an information exposure."
},
{
"cweId": "CWE-862",
"rationale": "The cli_only flag, which restricts a setting to command-line modification only, was dropped during setting reconstruction. This allowed the setting to be modified via the web API without the intended authorization restriction, effectively bypassing the access control the module author specified."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (6c02f0f5c33aab96e90df8791c3873303d7e99ce): fix: [settings] Module settings keep the flags the module",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/6c02f0f5c.patch"
],
"timestamp": "2026-09-28T10:14:28Z",
"type": "fix-developed"
},
{
"description": "Fix released in MISP v2.5.48.",
"id": "evt-fix-available-1",
"referencedEvents": [
"evt-fix-developed-1"
],
"references": [
"https://github.com/MISP/MISP/releases/tag/v2.5.48"
],
"timestamp": "2026-09-29T08:11:29Z",
"type": "fix-available"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20310"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-112192",
"datePublished": "2026-10-19T09:28:08.054Z",
"dateReserved": "2026-10-19T09:28:06.573Z",
"dateUpdated": "2026-10-30T10:06:28.714Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112178 (GCVE-0-2026-112178)
Vulnerability from cvelistv5 – Published: 2026-10-19 08:50 – Updated: 2026-10-19 17:20
VLAI
EPSS
VEX
Title
MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control
Summary
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.
- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute's distribution level (levels 1-3 should restrict visibility)
- The owning organisation could not view proposals on its own org-only attributes
Security impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.
Affected: <2.5.48
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
Supplier · CIRCL (v2.0.3)
Decision recorded 2026-10-19 08:49 UTC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:20 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
CIRCL
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/9c5af321f | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: medium
Model
qwen3.8:27b
1 event
advisory
bcp-05-x-01bcp-05-x-02bcp-05-x-03
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
- Generator
-
patch2vuln.pyon 2026-10-19 08:49 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/9c5af321f.patch
c50a0b040ef7… - Confidence
- medium
| Commit | Subject | Patch SHA-256 |
|---|---|---|
9c5af321fe8f
|
fix: [proposals] Apply the attribute ACL rules to proposals | c50a0b040ef7… |
Fix summary
The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.
Patch summary
In the shadow attribute model's condition builder, the sharing group check for both objects and attributes now includes an AND condition requiring distribution = 4 alongside the sharing_group_id IN check. The attribute distribution condition was changed from a simple sharing_group_id IN clause to a compound AND condition with distribution = 4. A new OR condition (Event.org_id matching the user's org_id) was added to grant the owning organisation access to proposals on its own attributes.
CVSS rationale
AV:N: MISP is a network-accessible web application. AC:L: The user only needs to be a member of a sharing group; no special conditions or race conditions are required. AT:N: No active attack requirements beyond normal API usage. PR:L: The attacker must be an authenticated user with membership in a relevant sharing group. UI:N: No user interaction is required; the check is server-side. VC:H: The user can view proposals (proposed attribute changes) that should be restricted by distribution level, disclosing sensitive information about proposed changes. VI:N: No integrity impact; the user cannot modify proposals. VA:N: No availability impact. SC/SI/SA:N: No impact on subsequent components.
Weakness rationale
- CWE-862 The authorization check for proposal visibility was missing the distribution level constraint. The system evaluated sharing group membership as sufficient for access without also requiring the distribution level to be 4 (All communities), resulting in an incomplete authorization check that allowed access to proposals on more restrictively distributed attributes.
Attack pattern rationale
- CAPEC-2 The user's sharing group membership (a parameter of their identity/session) was leveraged by the flawed authorization logic to grant access to proposals without the required distribution level check. This is the closest available CAPEC pattern; the user is not actively tampering with parameters, but the system improperly treats group membership as a sufficient access parameter without enforcing the additional distribution constraint. The mapping is uncertain because the vulnerability is more accurately a missing authorization check than active parameter manipulation.
Assumptions to verify
- The CAPEC mapping (CAPEC-2, Parameter Tampering) is the closest available match but is uncertain; the vulnerability is more accurately a missing authorization check (incomplete ACL evaluation) rather than active parameter manipulation by the attacker.
- The affected version boundary is inferred from the tag v2.5.48 and the commit position (35 commits after the fix); exact version boundaries are not explicitly stated in the patch metadata.
- The second aspect of the vulnerability (owner organisation denied access to its own proposals) is primarily a functional/availability defect rather than a security vulnerability, but is included as part of the same fix and the same root cause (incomplete ACL logic).
- CVSS PR:L assumes the attacker must be an authenticated MISP user with membership in a relevant sharing group; no evidence supports unauthenticated access.
- The Co-Authored-By line credits an AI assistant (Claude Opus 5.5) as a remediation developer; this is recorded as-is from the commit metadata.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
7 | 11 | medium | 5 |
- 2026-09-24 14:23 UTC Fix developed Corrective change authored (9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e): fix: [proposals] Apply the attribute ACL rules to proposals https://github.com/MISP/MISP/commit/9c5af321f.patch
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:20:26.843308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:20:40.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"ShadowAttribute (proposal/shadow attribute handling)"
],
"product": "MISP",
"programFiles": [
"app/Model/ShadowAttribute.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
},
{
"lang": "en",
"type": "reporter",
"value": "elhoim"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\u003c/p\u003e\u003cp\u003e- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\u003c/p\u003e\u003cp\u003e- The owning organisation could not view proposals on its own org-only attributes\u003c/p\u003e\u003cp\u003eSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\u003c/p\u003e\u003cp\u003eAffected: \u0026lt;2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user\u0027s sharing groups without verifying the distribution level, and denied the owning organisation access to proposals on its own organisation-only attributes.\n\n- A user belonging to a sharing group could view proposals on attributes or objects with that sharing group, regardless of the attribute\u0027s distribution level (levels 1-3 should restrict visibility)\n\n- The owning organisation could not view proposals on its own org-only attributes\n\nSecurity impact: Unauthorized disclosure of proposed attribute changes to users who should not have access based on distribution level restrictions.\n\nAffected: \u003c2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-2",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-2 Parameter Tampering"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"format": "SSVC",
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:49:14Z",
"version": "2.0.3"
},
"type": "SSVC"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T08:50:52.402Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/9c5af321f"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.\u003c/p\u003e"
}
],
"value": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior."
}
],
"title": "MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The CAPEC mapping (CAPEC-2, Parameter Tampering) is the closest available match but is uncertain; the vulnerability is more accurately a missing authorization check (incomplete ACL evaluation) rather than active parameter manipulation by the attacker.",
"The affected version boundary is inferred from the tag v2.5.48 and the commit position (35 commits after the fix); exact version boundaries are not explicitly stated in the patch metadata.",
"The second aspect of the vulnerability (owner organisation denied access to its own proposals) is primarily a functional/availability defect rather than a security vulnerability, but is included as part of the same fix and the same root cause (incomplete ACL logic).",
"CVSS PR:L assumes the attacker must be an authenticated MISP user with membership in a relevant sharing group; no evidence supports unauthenticated access.",
"The Co-Authored-By line credits an AI assistant (Claude Opus 5.5) as a remediation developer; this is recorded as-is from the commit metadata."
],
"capecRationale": [
{
"capecId": "CAPEC-2",
"rationale": "The user\u0027s sharing group membership (a parameter of their identity/session) was leveraged by the flawed authorization logic to grant access to proposals without the required distribution level check. This is the closest available CAPEC pattern; the user is not actively tampering with parameters, but the system improperly treats group membership as a sufficient access parameter without enforcing the additional distribution constraint. The mapping is uncertain because the vulnerability is more accurately a missing authorization check than active parameter manipulation."
}
],
"commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
"confidence": "medium",
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 5.5 (1M context)"
},
{
"lang": "en",
"type": "reporter",
"value": "elhoim"
}
],
"cvssRationale": "AV:N: MISP is a network-accessible web application. AC:L: The user only needs to be a member of a sharing group; no special conditions or race conditions are required. AT:N: No active attack requirements beyond normal API usage. PR:L: The attacker must be an authenticated user with membership in a relevant sharing group. UI:N: No user interaction is required; the check is server-side. VC:H: The user can view proposals (proposed attribute changes) that should be restricted by distribution level, disclosing sensitive information about proposed changes. VI:N: No integrity impact; the user cannot modify proposals. VA:N: No availability impact. SC/SI/SA:N: No impact on subsequent components.",
"fixSummary": "The fix enforces the distribution level constraint in the sharing group access check, requiring distribution level 4 (All communities) for the sharing group test to apply. Additionally, the owning organisation is now explicitly granted access to proposals on its own attributes regardless of distribution level, correcting the over-restrictive behavior.",
"generatedAt": "2026-10-19T08:49:14.568262Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 11,
"assumptionCount": 5,
"confidence": "medium",
"model": "qwen3.8:27b",
"score": 7
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
"patchSummary": "In the shadow attribute model\u0027s condition builder, the sharing group check for both objects and attributes now includes an AND condition requiring distribution = 4 alongside the sharing_group_id IN check. The attribute distribution condition was changed from a simple sharing_group_id IN clause to a compound AND condition with distribution = 4. A new OR condition (Event.org_id matching the user\u0027s org_id) was added to grant the owning organisation access to proposals on its own attributes.",
"patchTruncated": false,
"patches": [
{
"commit": "9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e",
"date": "Thu, 24 Sep 2026 16:23:08 +0200",
"patchSha256": "c50a0b040ef7da05d8dffbdc10599991ce441f3fe965e1025620e2e0581b7166",
"source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
"subject": "fix: [proposals] Apply the attribute ACL rules to proposals"
}
],
"source": "https://github.com/MISP/MISP/commit/9c5af321f.patch",
"ssvc": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "Supplier",
"timestamp": "2026-10-19T08:49:14Z",
"version": "2.0.3"
},
"subject": "fix: [proposals] Apply the attribute ACL rules to proposals",
"tagVersionBoundary": {
"commits_after_fix": 35,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-862",
"rationale": "The authorization check for proposal visibility was missing the distribution level constraint. The system evaluated sharing group membership as sufficient for access without also requiring the distribution level to be 4 (All communities), resulting in an incomplete authorization check that allowed access to proposals on more restrictively distributed attributes."
}
]
}
},
"bcp-05-x-03": {
"x_timeline": {
"events": [
{
"description": "Corrective change authored (9c5af321fe8f1d2209c8b3c35f4d570d47e9af9e): fix: [proposals] Apply the attribute ACL rules to proposals",
"id": "evt-fix-developed-1",
"references": [
"https://github.com/MISP/MISP/commit/9c5af321f.patch"
],
"timestamp": "2026-09-24T14:23:08Z",
"type": "fix-developed"
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20337"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-112178",
"datePublished": "2026-10-19T08:50:52.402Z",
"dateReserved": "2026-10-19T08:50:50.711Z",
"dateUpdated": "2026-10-19T17:20:40.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112071 (GCVE-0-2026-112071)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 15:44
VLAI
EPSS
VEX
Title
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
Summary
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:44 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "TYPO3 Shop by coding.ms" |
Affected:
6.0.0 , < 6.3.0
(semver)
Affected: 5.0.0 , < 5.21.1 (semver) Affected: 0 , < 4.9.4 (semver) |
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112071",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:44:46.954849Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:44:57.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "codingms/shop",
"product": "Extension \"TYPO3 Shop by coding.ms\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "6.3.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThan": "5.21.1",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "4.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Nguyen Le Thanh Nam"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Thomas Deuling"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to \"canceled\". This requires a page that contains the shop\u0027s order plugin. Orders that are already paid are not affected."
}
],
"value": "The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to \"canceled\". This requires a page that contains the shop\u0027s order plugin. Orders that are already paid are not affected."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:30:47.669Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-036"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"TYPO3 Shop by coding.ms\" (shop)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112071",
"datePublished": "2026-10-20T09:30:47.669Z",
"dateReserved": "2026-10-18T12:40:53.465Z",
"dateUpdated": "2026-10-20T15:44:57.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112070 (GCVE-0-2026-112070)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 15:49
VLAI
EPSS
VEX
Title
Broken Access Control in extension "Analytics" (analytics)
Summary
The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Analytics" |
Affected:
0 , < 1.1.1
(semver)
|
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112070",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:49:12.069558Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:49:23.108Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "t3g/analytics",
"product": "Extension \"Analytics\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "1.1.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Simon Schmidt"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Andreas Kienast"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to."
}
],
"value": "The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:30:43.759Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-031"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"Analytics\" (analytics)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112070",
"datePublished": "2026-10-20T09:30:43.759Z",
"dateReserved": "2026-10-18T12:40:51.930Z",
"dateUpdated": "2026-10-20T15:49:23.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112069 (GCVE-0-2026-112069)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 15:42
VLAI
EPSS
VEX
Title
Broken Access Control in extension "FAL Protect" (fal_protect)
Summary
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:41 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "FAL Protect" |
Affected:
1.7.1 , < 1.8.2
(semver)
|
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:41:54.270553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:42:06.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "causal/fal-protect",
"product": "Extension \"FAL Protect\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "1.8.2",
"status": "affected",
"version": "1.7.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Sascha L\u00f6ffler"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Xavier Perseguers"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3."
}
],
"value": "The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:30:57.192Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-028"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in extension \"FAL Protect\" (fal_protect)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112069",
"datePublished": "2026-10-20T09:30:57.192Z",
"dateReserved": "2026-10-18T12:40:50.236Z",
"dateUpdated": "2026-10-20T15:42:06.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112066 (GCVE-0-2026-112066)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 15:43
VLAI
EPSS
VEX
Title
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
Summary
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:43 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "sgalinski Cookie Consent" |
Affected:
8.0.0 , < 8.1.12
(semver)
Affected: 0 , < 7.4.6 (semver) |
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112066",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:43:22.459748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:43:32.519Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "sgalinski/sg-cookie-optin",
"product": "Extension \"sgalinski Cookie Consent\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "8.1.12",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "7.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Stefan Galinski"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The JSON import of the cookie consent configuration did not respect the backend user\u0027s permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website."
}
],
"value": "The JSON import of the cookie consent configuration did not respect the backend user\u0027s permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:39:21.582Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-029"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authorization in extension \"sgalinski Cookie Consent\" (sg_cookie_optin)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112066",
"datePublished": "2026-10-20T09:30:55.117Z",
"dateReserved": "2026-10-18T12:08:05.799Z",
"dateUpdated": "2026-10-20T15:43:32.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112065 (GCVE-0-2026-112065)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 15:42
VLAI
EPSS
VEX
Title
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
Summary
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:42 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "sgalinski Cookie Consent" |
Affected:
8.0.0 , < 8.1.12
(semver)
Affected: 0 , < 7.4.6 (semver) |
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112065",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:42:19.673925Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:42:28.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "sgalinski/sg-cookie-optin",
"product": "Extension \"sgalinski Cookie Consent\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "8.1.12",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThan": "7.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Stefan Galinski"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation."
}
],
"value": "The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:39:03.387Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-029"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Missing Authorization in extension \"sgalinski Cookie Consent\" (sg_cookie_optin)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112065",
"datePublished": "2026-10-20T09:30:56.537Z",
"dateReserved": "2026-10-18T12:08:05.799Z",
"dateUpdated": "2026-10-20T15:42:28.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.