Skip to main content
COSMICBYTEZLABS
NewsSecurityHOWTOsToolsTraining
StudyProjectsNewsletterHire MeAbout
Subscribe

Press Enter to search or Esc to close

News
Security
HOWTOs
Tools
Training
Study
Projects
Newsletter
Hire Me
About
RSS Feed
Reading List
Subscribe

Stay in the Loop

Get the latest security alerts, tutorials, and tech insights delivered to your inbox.

Subscribe NowFree forever. No spam.
COSMICBYTEZLABS

Your trusted source for IT intelligence, cybersecurity insights, and hands-on technical guides.

2614+ Articles
162+ Guides

CONTENT

  • Latest News
  • Security Alerts
  • HOWTOs
  • Checklists
  • Projects
  • Exam Prep

RESOURCES

  • Search
  • Browse Tags
  • Newsletter Archive
  • Reading List
  • RSS Feed

COMPANY

  • About Us
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CosmicBytez Labs. All rights reserved.

System Status: Operational
All tags
17 articles

#Access Control

All CosmicBytez Labs articles tagged #Access Control, across news, security advisories, how-to guides, and projects.

  • SecurityAug 29, 2026

    Uix UserCenter WordPress Plugin: Hardcoded Signing Key Enables Unauthenticated Account Takeover

    CVE-2026-16259 (CVSS 9.8) lets attackers hijack any account on sites running Uix UserCenter — no login needed, and no fix exists yet.

  • SecurityAug 17, 2026

    Scriban .NET Template Engine Access-Modifier Bypass — CVE-2026-73061

    Scriban's TypedObjectAccessor fails to enforce setter visibility, letting template code write private and init-only .NET properties (CVSS 9.8 Critical).

  • SecurityAug 15, 2026

    CVE-2026-72824: Grav API Plugin Twig Toggle Bypass Escalates Least-Privilege Keys

    Grav API plugin before 1.0.13 lets low-privilege API keys enable Twig processing on pages via a broken scope gate in PagesController.

  • SecurityAug 10, 2026

    CVE-2026-14206: HT Contact Form WordPress Plugin Exposes Visitor PII to Unauthenticated Attackers

    The HT Contact Form plugin before 2.9.3 allows any unauthenticated user to read saved form drafts containing visitor names, emails, and physical addresses via a completely unprotected API endpoint.

  • SecurityAug 5, 2026

    CVE-2026-67979: NASA cFS Incorrect Access Control Allows Arbitrary Code Execution

    Incorrect access control in the Executive Services component of NASA cFS v7.0.1 allows attackers to execute arbitrary code by placing a malicious shared object on target storage. CVSS score 9.1.

  • SecurityJul 29, 2026

    CVE-2026-14446: IBM WebSphere Admin Console Privilege Escalation

    A critical broken access control flaw (CVSS 9.8) in IBM WebSphere Application Server 8.5 and 9.0 allows attackers to escalate privileges via the administrative console.

  • SecurityJul 14, 2026

    OpENer EtherNet/IP Session Access Control Bypass — CVE-2026-51538

    A critical access control vulnerability in OpENer 2.3.0 allows unauthenticated attackers to send privileged encapsulation commands using arbitrary session...

  • SecurityJul 5, 2026

    Privilege Escalation via Role Manipulation in Online Exam LMS (CVE-2026-14719)

    A high-severity improper privilege management flaw in SourceCodester's Online Examination and Learning Management System 1.0 allows remote attackers to...

  • NewsJun 19, 2026

    Forget Data Leakage: Shadow AI's Real Threat Is Access Control

    The original shadow AI concern — employees pasting sensitive data into public tools — has been overtaken by a more dangerous problem: unsanctioned AI apps...

  • NewsJun 18, 2026

    FIFA Bug Exposes World Cup Streams to Remote Takeover

    A security researcher discovered that FIFA's unenforced Microsoft Entra access controls could have allowed an attacker to hijack live World Cup broadcast...

  • SecurityMay 30, 2026

    CVE-2018-25391: HaPe PKH 1.1 Unauthenticated Record Deletion via Missing Authorization

    HaPe PKH 1.1, a PHP-based web application, fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to...

  • SecurityMay 30, 2026

    CVE-2026-4290: WP Travel Pro Arbitrary User Deletion via Broken REST API Access Control

    A critical CVSS 9.1 access control flaw in the WP Travel Pro WordPress plugin allows unauthenticated attackers to delete any user account — including...

  • SecurityMay 22, 2026

    UniFi OS Improper Access Control — Unauthorized System

    A CVSS 10.0 improper access control flaw in UniFi OS allows any network-accessible attacker to make unauthorized changes to the underlying system with no...

  • SecurityMay 8, 2026

    CVE-2026-33109: Azure Managed Instance for Apache Cassandra

    A critical improper access control flaw in Azure Managed Instance for Apache Cassandra allows an authorized network attacker to execute arbitrary code,...

  • SecurityApr 24, 2026

    CVE-2026-24303: Microsoft Partner Center Privilege

    A critical privilege escalation vulnerability in Microsoft Partner Center allows an authorized attacker to elevate their privileges over a network,...

  • SecurityApr 23, 2026

    CVE-2026-33656: EspoCRM Formula Engine Attachment sourceId

    A critical improper access control vulnerability in EspoCRM's built-in formula scripting engine allows authenticated administrators to overwrite the...

  • SecurityApr 4, 2026

    CVE-2026-25197: IDOR Flaw Lets Authenticated Users Access

    A critical insecure direct object reference vulnerability allows authenticated users to pivot to any other user's profile by modifying an id parameter in...