CWE-285

1,461 vulnerabilities with CWE-285

CVE-2026-42609 HIGH

Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

CVSS 8.1

CVE-2026-8241 MEDIUM

Industrial Application Software IAS Canias ERP RMI iasGetServerInfoEvent improper authorization

CVSS 5.3

CVE-2026-8196 LOW

JeecgBoot mLogin Endpoint LoginController.java authorization

CVSS 3.7

CVE-2026-42202 MEDIUM

nova-toggle-5: Improper authorization on toggle endpoint allowed non-Nova users to modify boolean fields

CVSS 6.5

CVE-2026-33823 CRITICAL

Microsoft Team Events Portal Information Disclosure Vulnerability

CVSS 9.6

CVE-2026-30496 CRITICAL

Optoma CinemaX P2 TVOS-04.24.010.04.01 - Auth Bypass

CVSS 9.8

CVE-2026-30495 HIGH

Optoma CinemaX P2 TVOS-04.24.010.04.01 - Privilege Escalation

CVSS 8.8

CVE-2026-8027 MEDIUM

FlowiseAI Flowise User Controller authorization

CVSS 4.3

CVE-2026-7782 MEDIUM

CodeCanyon Perfex CRM Tenant Clients.php project authorization

CVSS 6.3

CVE-2026-41572 MEDIUM

Note Mark: Unauthenticated read of notes and assets in soft-deleted public books

CVSS 5.3

CVE-2026-7713 MEDIUM

crocodilestick Calibre-Web-Automated Kobo auth-token Route kobo_auth.py generate_auth_token improper authorization

CVSS 6.3

CVE-2026-7709 MEDIUM

janeczku Calibre-Web Endpoint kobo_auth.py generate_auth_token improper authorization

CVSS 6.3

CVE-2026-7702 MEDIUM

toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization

CVSS 5.3

CVE-2026-7681 MEDIUM

jsbroks COCO Annotator Dataset API datasets.py authorization

CVSS 6.5

CVE-2026-7644 HIGH

ChatGPTNextWeb NextChat actions.ts addMcpServer improper authorization

CVSS 7.3

CVE-2026-7631 MEDIUM

code-projects Online Hospital Management System Registration improper authorization

CVSS 5.4

CVE-2026-6449 MEDIUM

Booking for Appointments and Events Calendar – Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint

CVSS 5.3

CVE-2026-7602 MEDIUM

JeecgBoot FillRuleUtil edit improper authorization

CVSS 6.3

CVE-2026-7510 MEDIUM

OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization

CVSS 6.3

CVE-2026-7505 HIGH

nextlevelbuilder GoClaw/GoClaw Lite RPC improper authorization

CVSS 7.3

CVE-2026-7502 MEDIUM

LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization

CVSS 5.4

CVE-2026-2892 HIGH

Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenticated Purchase Verification Bypass via Forged Cookie

CVSS 7.5

CVE-2026-7292 MEDIUM

o2oa NodeAgent NodeAgent.java syncFile improper authorization

CVSS 5.6

CVE-2026-5781 HIGH

MphRx Minerva 3.6.0 moUser update Endpoint - Privilege Escalation

CVSS 8.8

CVE-2026-7145 MEDIUM

mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization

CVSS 5.4