#cwe-863

共收录 2248 条相关情报。

← 返回所有主题

安全公告2026-07-13 发布INFO

Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target

CVE-2026-52819

## Summary `GET /api/timesheets?user=` (and `users[]=`) returns the targeted user's timesheet records to any caller tha

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-863 #severity:medium

漏洞预警2026-07-13 发布MEDIUM

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allows lower-trust callers to perform actions requiring stron...

CVE-2026-62198

OpenClaw 版本 2026.5.28 至 2026.6.6（不含）存在一个授权绕过漏洞，位于原生 Web 搜索功能中。该漏洞允许低信任级别的调用者执行需要更强策略检查的操作。攻击者可以利用配置错误的输入路径绕过预期的授权控制，执行受限

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布HIGH

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-t...

CVE-2026-62196

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can s

来源摘录 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布MEDIUM

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the install policy (authorization) check. When the affected fea...

CVE-2026-62193

CVE-2026-62193 是 OpenClaw 2026.6.5 至 2026.6.8 版本中存在的一个授权绕过漏洞。漏洞位于插件安装封装器（plugin install wrappers）中，当受影响功能被启用且可访问时，攻击者可能绕

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布HIGH

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring st...

CVE-2026-62192

CVE-2026-62192 是 OpenClaw（一个 Discord 管理机器人）中的授权绕过漏洞，影响版本 2026.6.6 至 2026.6.9（不含 2026.6.9）。漏洞存在于 Discord 公会操作中，由于输入路径配置错误

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布HIGH

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requirin...

CVE-2026-62191

OpenClaw 版本 2026.6.6 至 2026.6.9 之前（不含 2026.6.9）存在一个授权绕过漏洞。该漏洞位于消息变更处理（message mutation handling）逻辑中，由于缺乏充分的授权检查，低信任度的调用者

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863 #authorization-bypass #cve-2026-62191 #openclaw

漏洞预警2026-07-13 发布INFO

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their i...

CVE-2026-62190

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-t

历史摘要 · 未重新核验 · NVD

#cve #cwe-706 #cwe-863

漏洞预警2026-07-13 发布INFO

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablemen...

CVE-2026-62188

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Fe

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布INFO

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform ...

CVE-2026-62187

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A low

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-07-13 发布INFO

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requ...

CVE-2026-62186

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model override

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw 2026.5.28 < 2026.6.6 Authorization Bypass via Web Search

CVE-2026-62198

OpenClaw versions 2026.5.28 before 2026.6.6 contain an authorization bypass vulnerability in native web search that allo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw 2026.3.22 < 2026.6.6 Authorization Bypass via WhatsApp Group IDs

CVE-2026-62196

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can s

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw 2026.6.5 < 2026.6.9 Authentication Bypass via Plugin Install

CVE-2026-62193

OpenClaw versions 2026.6.5 before 2026.6.9 contain a vulnerability in the plugin install wrappers that could skip the in

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass

CVE-2026-62192

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that a

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations

CVE-2026-62191

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling th

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862 #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper

CVE-2026-62190

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-t

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-706 #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw < 2026.6.9 Feishu Authorization Bypass

CVE-2026-62188

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Fe

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw < 2026.6.9 Feishu tools Authorization Bypass

CVE-2026-62187

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A low

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-863

安全公告2026-07-13 发布INFO

OpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override

CVE-2026-62186

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model override

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-862 #cwe-863

漏洞预警2026-07-13 发布INFO

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. T...

CVE-2026-58408

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admi

历史摘要 · 未重新核验 · NVD

#cve #cwe-862 #cwe-863