CWE-285

1,461 vulnerabilities with CWE-285

CVE-2026-33162 MEDIUM

Craft CMS 5.3.0-5.9.13 - Entry Section Move Authorization Bypass

CVSS 6.5

CVE-2026-33680 HIGH

Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

CVSS 7.5

CVE-2026-33668 HIGH

Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

CVSS 8.1

CVE-2026-4617 HIGH

SourceCodester Patients Waiting Area Queue Management System Patient Check-In api_patient_checkin.php ValidateToken improper authorization

CVSS 7.3

CVE-2026-32300 HIGH

Connect-CMS 1.x-1.41.0/2.x-2.41.0 - Privilege Escalation

CVSS 8.1

CVE-2026-4563 MEDIUM

MacCMS Member Order Detail User.php order_info authorization

CVSS 4.3

CVE-2026-4549 LOW

mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization

CVSS 3.1

CVE-2026-4548 MEDIUM

mickasmt next-saas-stripe-starter update-user-role.ts updateUserrole improper authorization

CVSS 6.3

CVE-2026-2294 MEDIUM

UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

CVSS 4.3

CVE-2026-33186 CRITICAL

gRPC-Go <1.79.3 HTTP/2 :path - Authorization Bypass

CVSS 9.1

CVE-2026-31836 HIGH

Mass Assignment Privilege Escalation in Checkmate

CVSS 8.1

CVE-2026-33125 HIGH

Frigate Broken Access Control: Users assigned the viewer role can delete admin and other low-privileged accounts

CVSS 7.1

CVE-2026-31869 MEDIUM

Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check

CVSS 4.3

CVE-2026-30702 CRITICAL

WiFi Extender WDR201A HW V2.1 FW LFMZX28040922V1.02 - Auth Bypass

CVSS 9.8

CVE-2026-32692 HIGH

Unauthorized update of out-of-scope Vault secrets

CVSS 7.6

CVE-2026-21886 MEDIUM

OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities

CVSS 6.5

CVE-2026-3237 MEDIUM

Octopus Server <2025.3.14731 - Privilege Escalation

CVSS 4.3

CVE-2026-4171 MEDIUM

CodeGenieApp serverless-express API Endpoint TodoList.ts authorization

CVSS 6.3

CVE-2026-32704 MEDIUM

SiYuan renderSprig: missing admin check allows any user to read full workspace DB

CVSS 6.5

CVE-2026-4013 MEDIUM

SourceCodester Pharmacy System 1.0 - Auth Bypass

CVSS 6.3

CVE-2026-28806 HIGH

nerves-hub nerves_hub_web - Privilege Escalation

CVSS 8.8

CVE-2026-30959 MEDIUM

OneUptime < 10.0.21 - Authenticated Authorization Bypass via Resend-Verification-Code Endpoint

CVSS 5.0

CVE-2026-30956 CRITICAL

OneUptime < 10.0.21 - Missing Authorization via Forged is-multi-tenant-query Header

CVSS 9.9

CVE-2026-30870 MEDIUM

PowerSync Service 1.20.0 - Auth Bypass

CVSS 6.5

CVE-2026-28431 HIGH

Misskey 8.45.0-2026.3.0 - Info Disclosure

CVSS 7.5