CWE-807

High likelihood

Reliance on Untrusted Inputs in a Security Decision

Parent: CWE-693 - Protection Mechanism Failure

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

72 vulnerabilities with CWE-807
CVE-2026-39807 MEDIUM
Client-supplied URI scheme trusted without transport verification in bandit
CVE-2026-41403 LOW
OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification
CVSS 2.9
CVE-2026-41390 HIGH
OpenClaw < 2026.3.28 - Exec Allowlist Bypass via Unregistered /usr/bin/script Wrapper
CVSS 7.3
CVE-2026-41380 HIGH
OpenClaw < 2026.3.28 - Arbitrary Execution Allowlist via Wrapper Carrier Executables
CVSS 7.3
CVE-2026-1789 MEDIUM
Canon imagePRESS Series - Info Disclosure
CVSS 4.9
CVE-2026-41299 HIGH
OpenClaw < 2026.3.28 - Client Identity Spoofing in chat.send Gateway Provenance Guard
CVSS 7.1
CVE-2026-0390 MEDIUM
UEFI Secure Boot Security Feature Bypass Vulnerability
CVSS 6.7
CVE-2026-35670 MEDIUM
OpenClaw < 2026.3.22 - Webhook Reply Rebinding via Username Resolution in Synology Chat
CVSS 5.9
CVE-2026-35655 MEDIUM
OpenClaw < 2026.3.22 - Identity Spoofing via rawInput Tool in ACP Permission Resolution
CVSS 5.7
CVE-2026-35624 MEDIUM
OpenClaw < 2026.3.22 - Policy Confusion via Room Name Collision in Nextcloud Talk
CVSS 4.2
CVE-2026-35617 MEDIUM
OpenClaw < 2026.3.25 - Authorization Bypass via Group Policy Rebinding with Mutable Space displayName
CVSS 4.2
CVE-2026-29134 HIGH
GINA Domain Switch
CVSS 7.5
CVE-2026-32975 CRITICAL
OpenClaw < 2026.3.12 - Weak Authorization via Mutable Group Names in Zalouser Allowlist
CVSS 9.8
CVE-2026-32898 MEDIUM
OpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata
CVSS 5.4
CVE-2026-32057 HIGH
OpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter
CVSS 7.1
CVE-2026-29794 MEDIUM
Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers
CVSS 5.3
CVE-2026-33068 HIGH
Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File
CVSS 8.8
CVE-2026-27707 HIGH
Seerr 2.0.0-3.1.0 - Auth Bypass
CVSS 7.3
CVE-2026-21514 HIGH KEV
Microsoft Office Word - Info Disclosure
CVSS 7.8
CVE-2026-25958 HIGH
Cubejs-backend Server-core < 1.0.14 - Privilege Escalation
CVSS 7.7
CVE-2026-25931 HIGH
vscode-spell-checker <4.5.4 - Info Disclosure
CVSS 7.8
CVE-2026-21509 HIGH KEV
Microsoft Office - Info Disclosure
CVSS 7.8
CVE-2026-23848 MEDIUM
MyTube <1.7.71 - DoS
CVSS 6.5
CVE-2026-20849 HIGH
Windows Kerberos - Privilege Escalation
CVSS 7.5
CVE-2025-13926 CRITICAL
Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security Decision
CVSS 9.8
Details
Vulnerabilities 72
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits