#cwe-862

共收录 4122 条相关情报。

← 返回所有主题

安全公告2026-09-03 发布INFO

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

CVE-2026-72808

**CVE:** This vulnerability corresponds to [CVE-2026-72808](https://nvd.nist.gov/vuln/detail/CVE-2026-72808). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:medium

安全公告2026-09-03 发布INFO

SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

CVE-2026-72810

**CVE:** This vulnerability corresponds to [CVE-2026-72810](https://nvd.nist.gov/vuln/detail/CVE-2026-72810). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:high

安全公告2026-09-03 发布INFO

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)

CVE-2026-72812

**CVE:** This vulnerability corresponds to [CVE-2026-72812](https://nvd.nist.gov/vuln/detail/CVE-2026-72812). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:medium

安全公告2026-09-03 发布INFO

SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered

CVE-2026-68585

**CVE:** This vulnerability corresponds to [CVE-2026-68585](https://nvd.nist.gov/vuln/detail/CVE-2026-68585). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:medium

安全公告2026-09-03 发布INFO

SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints ar...

CVE-2026-68586

**CVE:** This vulnerability corresponds to [CVE-2026-68586](https://nvd.nist.gov/vuln/detail/CVE-2026-68586). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:high

安全公告2026-09-03 发布INFO

SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check

CVE-2026-68587

**CVE:** This vulnerability corresponds to [CVE-2026-68587](https://nvd.nist.gov/vuln/detail/CVE-2026-68587). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-862 #severity:high

安全公告2026-09-03 发布INFO

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

CVE-2026-63669

## Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare `editRole` / `publishRole` (a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-639 #cwe-862 #severity:medium

漏洞预警2026-09-03 发布INFO

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with min...

CVE-2026-85395

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any a

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administra...

CVE-2026-85390

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deleti

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privil...

CVE-2026-78596

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege ...

CVE-2026-78595

Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

安全公告2026-09-03 发布INFO

UnoPim before 2.1.3 Missing Authorization on Integration Management Routes

CVE-2026-85395

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

安全公告2026-09-03 发布INFO

Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

CVE-2026-85390

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deleti

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862

漏洞预警2026-09-03 发布INFO

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload ...

CVE-2026-63219

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the A

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate...

CVE-2026-85309

Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Acc

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. Th...

CVE-2026-85306

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting I

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Cont...

CVE-2026-85304

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templa

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

CVE-2026-84847

Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.

CVE-2026-84779

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862

漏洞预警2026-09-03 发布INFO

Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

CVE-2026-84758

Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

历史摘要 · 未重新核验 · NVD

#cve #cwe-862