All CosmicBytez Labs articles tagged #Authorization Bypass, across news, security advisories, how-to guides, and projects.
CVSS 9.9: Nezha Monitoring fails to bind WebSocket terminal stream IDs to their creator, letting any authenticated user hijack another user's terminal session.
CVSS 9.8 flaw in WordPress Pods plugin lets unauthenticated users escalate privileges via a flawed AJAX authorization router in versions up to 3.3.9.
A second critical flaw in the TrueBooker Appointment Booking WordPress plugin allows unauthenticated attackers to change the password of any user, including administrators, due to missing authorization checks. CVSS 9.8.
A critical flaw in Apache CXF's OAuth2 Dynamic Client Registration endpoint stores attacker-supplied scope values verbatim, allowing malicious clients to self-assign privileged or administrative permissions. CVSS 9.1.
A critical CVSS 9.8 authorization bypass vulnerability in the Menulux Software Inc. Mobile App allows unauthenticated remote attackers to bypass access controls via a user-controlled key, enabling software integrity attacks.
Eclipse BaSyx Go Components up to v1.0.0 contains a CVSS 9.8 authorization bypass caused by inconsistent trailing-slash handling between the ABAC...
A critical authorization bypass in nebula-mesh, the self-hosted control plane for Slack's Nebula VPN, allows any holder of a non-admin operator API key to...
A CVSS 9.3 critical incorrect authorization vulnerability in Ninja Forms 3.14.8 and prior for WordPress Multisite allows a subsite administrator to...
A CVSS 8.3 authorization bypass vulnerability in VMware Avi Load Balancer allows low-privileged authenticated users to access restricted Control Plane...
An authentication bypass vulnerability in OpenCTI prior to 7.260326.0 allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass...
A critical CVSS 9.8 authorization bypass in the WP Learn Manager WordPress plugin allows unauthenticated attackers to install and activate arbitrary...
A critical authorization bypass in Coolify's terminal WebSocket bootstrap routes allows authenticated users to access server terminals for resources...
A missing authorization flaw (CVSS 9.6) in Red Hat's Event-Driven Ansible allows any authenticated user to forge WebSocket messages and access plaintext...
A CVSS 7.3 authorization bypass vulnerability in ShopXO up to 6.7.1 allows unauthenticated access to scheduled task endpoints in the Crontab controller,...
A critical CVSS 9.9 argument injection vulnerability in WordPress Toolkit before 6.11.0 allows remote authenticated users to bypass cross-tenant...
A high-severity authorization bypass in Open WebUI prior to 0.9.5 allows authenticated users to attach arbitrary files to resources they do not own via...
CVE-2026-2347 is a CVSS 9.8 authorization bypass in Akilli's e-commerce platform, allowing attackers to hijack authenticated sessions by manipulating...
A CVSS 9.1 authorization bypass in InfusedWoo Pro for WordPress lets unauthenticated attackers permanently delete arbitrary data across all installations...
A critical CVSS 9.1 authorization bypass in the WordPress Create DB Tables plugin (all versions up to 1.2.1) allows unauthenticated users to create or...
A high-severity authorization bypass in SiYuan versions 3.6.3 and below allows attackers with RoleReader publish-service tokens to call a privileged...
An authorization flaw in Juju's Controller facade allows any authenticated low-privilege user to call the CloudSpec API and extract the cloud provider...
A high-severity authorization flaw in the ProfilePress WordPress plugin (up to v4.16.11) lets unauthenticated or low-privilege users bypass membership...
A critical CVSS 9.8 authorization bypass in OpenClaw's Zalouser allowlist mode matches mutable group display names instead of stable identifiers, letting...
A critical CVSS 9.8 authorization bypass in OpenClaw allows attackers to circumvent groupAllowFrom and requireMention protections in group chats by...
A critical CVSS 9.9 authorization bypass in OpenClaw allows authenticated users to self-declare elevated scopes over WebSocket connections without...
A critical (CVSS 9.6) authorization bypass vulnerability in the moodle-mod_customcert plugin allows any teacher with manage capability in a single course...