#Broken Access Control
All CosmicBytez Labs articles tagged #Broken Access Control, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-105039: EnergizeLab Station-Middleware Missing Admin Role Checks
EnergizeLab station-middleware admin APIs skip role checks — any low-privilege user can steal AI provider keys and alter config (CVSS 9.6).
- Security
Ad Inserter Plugin Broken Access Control Enables Code Injection (CVE-2026-81655)
Ad Inserter for WordPress lets logged-in users as low as subscriber reach an unrestricted settings page and inject unfiltered code.
- Security
CVE-2026-81648: Unauthenticated Authorization Bypass in CryptoPayment Gateway WordPress Plugin
CVSS 10 flaw in CryptoPayment Gateway (≤ 1.2.2) lets anyone delete files, overwrite config, and steal cleartext wallet keys via an open AJAX endpoint.
- Security
CVE-2026-53546: Termix WebSocket Host Bypass Grants Cross-User SSH Access
Termix terminal WebSocket accepts attacker-controlled host IDs without ownership checks, enabling cross-user SSH access to any managed server. CVSS 9.6.
- Security
CVE-2026-53548: Termix IDOR Exposes All Stored SSH Passwords to Any User
Termix's password endpoint returns decrypted SSH credentials for any host ID without ownership verification, exposing all stored passwords. CVSS 9.6.
- Security
CVE-2026-65007: Grav API Plugin Broken Authorization Allows API Key Takeover
The Grav CMS API plugin before version 1.0.8 fails to properly authorize API key generation and revocation, allowing low-privilege users to generate admin...