CVE-2023-26510

MEDIUM Year: 2023
CVSS v3 Score
5.7
Medium
Weakness Type
CWE-862
View all →

Vulnerability Description

Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this behavior has no security impact.

Related Vulnerabilities

CVE-2020-4926

MEDIUM
CVSS:5.7(Medium)

A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. I...

CWE-8622020

CVE-2021-21255

MEDIUM
CVSS:5.7(Medium)

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI version 9.5.3, it was possible to switch enti...

CWE-8622021

CVE-2021-24968

MEDIUM
CVSS:5.7(Medium)

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated u...

CWE-8622021

CVE-2021-25011

MEDIUM
CVSS:5.7(Medium)

The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscrib...

CWE-8622021

CVE-2022-34212

MEDIUM
CVSS:5.7(Medium)

A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.

CWE-8622022

CVE-2025-25244

MEDIUM
CVSS:5.7(Medium)

SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object c...

CWE-8622025