CWE-862 Missing Authorization

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

Vikunja: Cross-project task disclosure through subtask expansion

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

Contao: Improper access control in the preview links module

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

Indico: Missing access check in legacy session export API

Hazelcast has an authorization bypass in IMap Predicates API

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

Duplicate Advisory: PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Duplicate Advisory: PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Payload has a tenant authorization bypass in Multi-Tenant Plugin

Payload: Unauthorized update to collection documents

Ghost: Authorization Issue Allowed Author Role to Delete any Post

Backstage: Improper entity validation in deprecated Kubernetes services endpoint

Backstage: Improper authorization enforcement for TechDocs static content