#Access Control
All CosmicBytez Labs articles tagged #Access Control, across news, security advisories, how-to guides, and projects.
- News
How to Keep AI Agents Within Their Permissions
AI agents can reuse valid credentials to exceed their assigned scope. Token Security maps seven enforcement points that stop overreach without killing autonomy.
- Project
Cloudflare Zero Trust Tunnel: Secure Remote Access Without Open Ports
Expose self-hosted homelab services to the internet with zero inbound firewall rules, using cloudflared tunnels and Cloudflare Access policies for...
- Security
CVE-2026-77203: WordPress Groups Plugin Privilege Escalation
A flaw in groups_join() lets Subscriber-level WordPress users self-enroll into admin groups, escalating to full Administrator privileges.
- Security
Uix UserCenter WordPress Plugin: Hardcoded Signing Key Enables Unauthenticated Account Takeover
CVE-2026-16259 (CVSS 9.8) lets attackers hijack any account on sites running Uix UserCenter — no login needed, and no fix exists yet.
- Security
Scriban .NET Template Engine Access-Modifier Bypass — CVE-2026-73061
Scriban's TypedObjectAccessor fails to enforce setter visibility, letting template code write private and init-only .NET properties (CVSS 9.8 Critical).
- Security
CVE-2026-72824: Grav API Plugin Twig Toggle Bypass Escalates Least-Privilege Keys
Grav API plugin before 1.0.13 lets low-privilege API keys enable Twig processing on pages via a broken scope gate in PagesController.
- Security
CVE-2026-14206: HT Contact Form WordPress Plugin Exposes Visitor PII to Unauthenticated Attackers
The HT Contact Form plugin before 2.9.3 allows any unauthenticated user to read saved form drafts containing visitor names, emails, and physical addresses...
- Security
CVE-2026-67979: NASA cFS Incorrect Access Control Allows Arbitrary Code Execution
Incorrect access control in the Executive Services component of NASA cFS v7.0.1 allows attackers to execute arbitrary code by placing a malicious shared...
- Security
CVE-2026-14446: IBM WebSphere Admin Console Privilege Escalation
A critical broken access control flaw (CVSS 9.8) in IBM WebSphere Application Server 8.5 and 9.0 allows attackers to escalate privileges via the...
- Security
OpENer EtherNet/IP Session Access Control Bypass — CVE-2026-51538
A critical access control vulnerability in OpENer 2.3.0 allows unauthenticated attackers to send privileged encapsulation commands using arbitrary session...
- Security
Privilege Escalation via Role Manipulation in Online Exam LMS (CVE-2026-14719)
A high-severity improper privilege management flaw in SourceCodester's Online Examination and Learning Management System 1.0 allows remote attackers to...
- News
Forget Data Leakage: Shadow AI's Real Threat Is Access Control
The original shadow AI concern — employees pasting sensitive data into public tools — has been overtaken by a more dangerous problem: unsanctioned AI apps...
- News
FIFA Bug Exposes World Cup Streams to Remote Takeover
A security researcher discovered that FIFA's unenforced Microsoft Entra access controls could have allowed an attacker to hijack live World Cup broadcast...
- Security
CVE-2018-25391: HaPe PKH 1.1 Unauthenticated Record Deletion via Missing Authorization
HaPe PKH 1.1, a PHP-based web application, fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to...
- Security
CVE-2026-4290: WP Travel Pro Arbitrary User Deletion via Broken REST API Access Control
A critical CVSS 9.1 access control flaw in the WP Travel Pro WordPress plugin allows unauthenticated attackers to delete any user account — including...
- Security
UniFi OS Improper Access Control — Unauthorized System
A CVSS 10.0 improper access control flaw in UniFi OS allows any network-accessible attacker to make unauthorized changes to the underlying system with no...
- Security
CVE-2026-33109: Azure Managed Instance for Apache Cassandra
A critical improper access control flaw in Azure Managed Instance for Apache Cassandra allows an authorized network attacker to execute arbitrary code,...
- Security
CVE-2026-24303: Microsoft Partner Center Privilege
A critical privilege escalation vulnerability in Microsoft Partner Center allows an authorized attacker to elevate their privileges over a network,...
- Security
CVE-2026-33656: EspoCRM Formula Engine Attachment sourceId
A critical improper access control vulnerability in EspoCRM's built-in formula scripting engine allows authenticated administrators to overwrite the...
- Security
CVE-2026-25197: IDOR Flaw Lets Authenticated Users Access
A critical insecure direct object reference vulnerability allows authenticated users to pivot to any other user's profile by modifying an id parameter in...