Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Schedule status is updated based on stream key lookup without verifying that the stream key belongs to the schedule or playlist owner. This can allow unauthorized users to modify or cancel scheduled broadcasts.
Route-bound model is updated directly from generic Request input without explicit authorization or FormRequest validation, potentially allowing IDOR or unauthorized modifications.
Potential missing object-level authorization check. Sensitive operations on resources identified by user-controlled IDs should verify that the current subject has appropriate read/manage permissions.
Organization-scoped route is protected by JwtAuthGuard but lacks OrganizationValidateGuard, allowing authenticated cross-tenant access to organization resources.
Ash.Actions.Update.UpdateMany executes atomic updates directly without evaluating authorization policies or applying policy filters to the changesets.
Publish access check queries disabled publish access without also verifying invisible publish access, allowing unlisted/invisible content to be enumerated.
Whitelisted endpoint passes a parameter to `frappe.render_template` without restricting access via `frappe.only_for`.
Envelope permission checks validate rejected and completed states but omit validation for the cancelled status, potentially allowing modification of cancelled envelopes.
Media entity collection reassignment performed without verifying permissions on the source and destination collections using SecurityChecker. An authenticated user could move items out of restricted collections to access unauthorized media.
Missing VIEW permission authorization check in PreviewLinkManager::generate() or revoke(). Authenticated users can generate public preview links or revoke links for resources they are not authorized to view.
Route handler parameter `$AUTH` is obtained via `Depends(...)` but is never referenced in the handler body when accessing conversation management services. This indicates a broken object-level authorization (BOLA/IDOR) vulnerability where conversation operations are performed without user ownership validation.
The Resource endpoint fetches user-specific data using a 'user_id' parameter with only basic API authentication ('api_required') and no administrator or role-based access control decorator, potentially exposing sensitive data to IDOR/broken access control.
Global options are modified after an access control check that permits low-privilege capabilities such as 'edit_posts' alongside 'manage_options'. Non-administrator users can modify site-wide configuration. Ensure sensitive option updates require 'manage_options'.
Missing authorization (current_user_can) or nonce check prior to dispatching external API requests based on request parameters.
Post object data is accessed or processed without checking whether the current user has permission to edit the target post object (e.g., via `current_user_can('edit_post', $post_id)` or an authorization helper).
The D-Bus Properties.Set method is defined without specifying `sender_keyword` in `@dbus.service.method`. Without the caller's sender identifier, the service cannot perform caller authentication or authorization (such as polkit checks), allowing unauthorized users on the bus to mutate sensitive service properties.
REST endpoint performs entity removal or retrieval without verifying that the target entity's realm is accessible to the authenticated context.
Subscription batch notifications resolved via Absinthe.Pipeline.run are not filtered using authorization/suppression checks before publication, potentially disclosing unauthorized records.
The AJAX handler verifies a nonce with `check_ajax_referer()` but does not check user capabilities using `current_user_can()`. Nonce checks alone do not enforce authorization, allowing any authenticated user to execute this action.
MCP server configuration containing stdio/command execution parameters is processed without verifying administrative privileges.
Built-in resource or prompt mutation handler performs modifications without verifying administrator privileges, which may allow unauthorized non-admin users to alter global configuration.
Extracting and parsing JWT tokens from query parameters to manually construct user context bypasses route authentication and token scope authorization middleware.
Broad HAProxy access rule permits requests to `/containers` without restricting sensitive sub-endpoints like `/archive`, `/export`, and `/logs`, exposing container filesystems and logs.
Object-scoped change feed accesses `change_set` directly without permission filtering for the requesting user, potentially leaking change metadata from restricted projects.
