cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).

cPanel before 68.0.27 does not validate database and dbuser names during renames (SEC-321).

cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430).

cPanel before 64.0.21 allows demo accounts to redirect web traffic (SEC-245).

cPanel before 64.0.21 does not preserve supplemental groups across account renames (SEC-260).

cPanel before 64.0.21 does not enforce demo restrictions for SSL API calls (SEC-249).

cPanel before 68.0.15 allows user accounts to be partially created with invalid username formats (SEC-334).

cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432).

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).

cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439).

cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396).

cPanel before 78.0.2 allows certain file-write operations as shared users during connection resets (SEC-476).

cPanel before 62.0.17 allows does not preserve security policy questions across an account rename (SEC-223).

cPanel before 62.0.17 does not properly recognize domain ownership during addition of parked domains to a mail configuration (SEC-228).

cPanel before 78.0.2 allows a demo account to link with an OpenID provider (SEC-460).

cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).

cPanel before 62.0.17 allows arbitrary file-read operations via WHM /styled/ URLs (SEC-218).

cPanel before 68.0.15 allows jailed accounts to restore files that are outside of the jail (SEC-310).

cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).

cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).

cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).

cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).

cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).

cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).

cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-1221).

cPanel before 66.0.2 allows demo accounts to create databases and users (SEC-271).

cPanel before 68.0.15 allows unprivileged users to access restricted directories during account restores (SEC-311).

cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).

cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.

JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit and delete Repository Layouts while Repository Layouts configuration should only be available for Platform Administrators.

An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect access control vulnerability that permits a user with insufficient privileges to promote a project milestone to a group milestone.

A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.

Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.

The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229.

A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low‑privileged user could link their zones to banners or campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that banners and campaigns can only be linked to zones managed by the same account.

A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.

Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors.

CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.

IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to upload non-executable files via a crafted HTTP request.

Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.

The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.