Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Ash.Actions.Update.UpdateMany executes atomic updates directly without evaluating authorization policies or applying policy filters to the changesets.
Missing VIEW permission authorization check in PreviewLinkManager::generate() or revoke(). Authenticated users can generate public preview links or revoke links for resources they are not authorized to view.
Matching a dynamic request to resolve its controller without verifying access against Symfony's AccessMapInterface or AuthorizationCheckerInterface can bypass path-based access_control security rules.
Global options are modified after an access control check that permits low-privilege capabilities such as 'edit_posts' alongside 'manage_options'. Non-administrator users can modify site-wide configuration. Ensure sensitive option updates require 'manage_options'.
Post object data is accessed or processed without checking whether the current user has permission to edit the target post object (e.g., via `current_user_can('edit_post', $post_id)` or an authorization helper).
The D-Bus Properties.Set method is defined without specifying `sender_keyword` in `@dbus.service.method`. Without the caller's sender identifier, the service cannot perform caller authentication or authorization (such as polkit checks), allowing unauthorized users on the bus to mutate sensitive service properties.
Subscription batch notifications resolved via Absinthe.Pipeline.run are not filtered using authorization/suppression checks before publication, potentially disclosing unauthorized records.
Subscription notification batching in AshGraphql does not filter out notifications belonging to other tenants before grouping and processing events. In-memory authorization does not enforce multitenancy, leading to cross-tenant notification leaks.
Group-level authorization check uses `.some()` against permitted resources instead of requiring full containment with `.every()`. This may grant access to all resources in a group if any single resource matches.
Built-in resource or prompt mutation handler performs modifications without verifying administrator privileges, which may allow unauthorized non-admin users to alter global configuration.
Extracting and parsing JWT tokens from query parameters to manually construct user context bypasses route authentication and token scope authorization middleware.
Authorization check fails open when permissions list is empty ($permissions is empty -> permitted). This allows unauthenticated or unauthorized access to routes or actions that lack explicit permission definitions.
Search results from hierarchical query are mapped and returned without verifying per-note credential access or branch visibility, allowing unauthorized information disclosure.
MCP stdio process spawned after validation without binding command and arguments to staged manifest hashes.
Access control decisions or path checks should not use `HttpServletRequest.getRequestURI()` with substring or prefix matching methods like `contains()`, `startsWith()`, or `endsWith()`. Raw request URIs may include matrix parameters, path traversal tokens, or unnormalized prefixes that allow authentication and authorization bypass. Use container-normalized m
Validating repository OAuth scopes using only string prefix matching (`String.starts_with?/2`) allows unauthorized access to arbitrary repositories. The principal's permissions must be verified against the specific repository.
REST controller verifies access permissions on the parent container rather than the specific topic item, potentially bypassing item-level access controls.
Authorization check using current_user_can is guarded by a negative check on anonymous content. Anonymous posts/content will bypass capability checks.
Rewriting an open-ended range sentinel slice (`len(...) == 1 && ...[0] == 0`) to an empty slice (`[]byte{}`) prior to authorization checks can cause range permission validation to mistake a range query for a single-key query, bypassing RBAC enforcement.
ManagedCluster deletion is performed based on target namespace without validating ClusterDeployment ownership via ClusterPoolRef against the ClusterClaim.
Hardcoding the 'sub' (subject) claim in JWT tokens to a static string literal causes all issued tokens to share the same subject identity. The 'sub' claim must uniquely identify the user or principal.
Access token or session verification does not confirm that the token belongs to the target resource. An attacker with a valid token for one resource may gain unauthorized access to another resource.
User API endpoint iterates over request data and performs mass assignment using a denylist that lacks permission checks for sensitive salary/compensation fields.
The payment deletion API endpoint checks for invoice deletion permissions ('facture', 'supprimer') instead of payment management permissions ('facture', 'paiement'). This allows unauthorized users with invoice delete rights to permanently delete payment records.
