Tag
Pimcore WebDAV Asset MOVE Missing Authorization Vulnerability
2 rules 2 TTPsPimcore's WebDAV asset endpoint exposes a `MOVE` operation without authentication, allowing unauthenticated remote attackers to delete assets if they know two existing asset paths in the same directory; Authenticated low-privileged users may also be able to perform unauthorized asset move or overwrite operations because the move path does not enforce `rename`, `delete`, `create`, or `publish` permissions, leading to data loss, content integrity loss, and service disruption.
Funnel Builder for WooCommerce Checkout Missing Authorization Vulnerability (CVE-2026-47100)
2 rules 1 CVEFunnel Builder for WooCommerce Checkout versions prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and inject malicious JavaScript, impacting checkout page visitors.
Bitwarden Server Missing Authorization Vulnerability Leading to Organization Takeover (CVE-2026-43639)
2 rules 1 TTP 1 CVEBitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability (CVE-2026-43639) that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization in cloud-hosted deployments.
WeKan Missing Authorization Vulnerability in Integration REST API
2 rules 1 TTP 1 CVEWeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints, allowing authenticated board members to perform administrative actions without proper privilege verification, potentially leading to unauthorized data access and modification.
Gravity SMTP Plugin Missing Authorization Vulnerability (CVE-2026-4162)
2 rules 1 TTP 1 CVEThe Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization, allowing authenticated attackers with subscriber-level access or higher to uninstall/deactivate the plugin and delete plugin options, and is also exploitable via Cross-Site Request Forgery.
SimpleHelp Missing Authorization Vulnerability Leads to Privilege Escalation
2 rules 1 TTP 1 CVEA missing authorization vulnerability in SimpleHelp (CVE-2024-57726) allows low-privileged technicians to create API keys with excessive permissions, potentially escalating privileges to the server admin role.
Geeky Bot WordPress Plugin Missing Authorization Vulnerability Leads to Remote Code Execution
2 rules 3 TTPs 1 CVEThe Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to 1.2.2, allowing unauthenticated attackers to perform arbitrary plugin installation and achieve remote code execution by exploiting a nopriv AJAX route and uploading malicious ZIP files.