CWE-863 Incorrect Authorization

Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

SFTPGo source-side file-pattern filter bypass during copy operations

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Contao: Improper access control in the table access voter

Vikunja: Link-share token can enumerate users through the v2 API

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass

PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins

PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

Duplicate Advisory: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments

@payloadcms/plugin-multi-tenant has a cross-tenant create issue