OpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions
CVE-2026-62206
OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affect
#cwe-862
共收录 4228 条相关情报。
← 返回所有主题OpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions
CVE-2026-62205
OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting us...
CVE-2026-45334
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature ret
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page draft rendering. Permissions are def...
CVE-2026-44176
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` per
Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
CVE-2026-45334
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature ret
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to...
CVE-2026-47089
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin acces
Kirby: `pages.access` permission is not checked during rendering of page drafts
CVE-2026-44176
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` per
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list include...
CVE-2026-61718
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb w
ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)
CVE-2026-54076
### Impact The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an `UPDATE_SCHEMA` authorization check to a single sc
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
CVE-2026-52870
### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.expe
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS again...
CVE-2026-47089
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin acces
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_ge...
CVE-2026-46515
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call
bunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes
CVE-2026-61718
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb w
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
CVE-2026-53718
### Impact Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another
Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution
CVE-2026-46515
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to ...
CVE-2026-55548
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/sr
Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivil...
CVE-2026-44595
Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGrou
Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges...
CVE-2026-63082
Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that a
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in...
CVE-2026-57206
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated GET /api/user/inf...
CVE-2026-57205
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions