Client-Side Enforcement of Server-Side Security
CWE-602
The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.
We track 70 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5.
How this weakness is prevented
- Architecture and Design: If some degree of trust is required between the two entities, then use integrity checking and strong authentication to ensure that the inputs are coming from a trusted source. Design the product so that this trust is managed in a centralized fashion, especially if there are complex or numerous communication channels, in order to reduce the risks that the implementer will mistakenly omit a check in a single code path.
Latest Client-Side Enforcement of Server-Side Security vulnerabilities
- 8.2 High severity
MeetingBoard Pro: Client-Side Enforcement of Server-Side Security
In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related int
- 8.8 High severity
Eclipse Mnestix: Client-Side Enforcement of Server-Side Security
In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix user, like changing the Infrastructure settings or calling t
- 8.6 High severity
Biletiva Ticketing Platform: Client-Side Enforcement of Server-Side Security
Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23.
- 8.7 High severity
J2Store extension for Joomla: External Control of Assumed-Immutable Web Parameter
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual repro
- 9.2 Critical severity
server: Improper Authentication
Laci Synchroni is a decentralized mod and appearance sync server and plugin for Dalamud. Versions of the backend prior to 1.2.3 have an improper authentication vulnerability in the application's OAuth2 login flow. The application relies on client-side state by
- 8.7 High severity
J2Store extension for Joomla: External Control of Assumed-Immutable Web Parameter
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - The PayPal IPN listener's signature check (`_validateIPN()`) accepted `UNVERIFIED` and any non-
- 7.3 High severity
tsi-dpdp-cms: Client-Side Enforcement of Server-Side Security
A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released t
- 7.7 High severity
multicluster engine for Kubernetes 2.10: Client-Side Enforcement of Server-Side Security
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to speci
- 7.7 High severity
Balbooa Forms extension for Joomla: External Control of Assumed-Immutable Web Parameter
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomp
- 9.1 Critical severity
Portal Generator addon to Priority ERP…: Client-Side Enforcement of Server-Side Security
: Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priw
- 7.1 High severity
Db2: Client-Side Enforcement of Server-Side Security
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data.
- 9.9 Critical severity
Dokploy is a free, self-hostable Platform as a Service (PaaS).
Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update reque
- 7.0 High severity
Quick.CMS: Client-Side Enforcement of Server-Side Security
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization
- 8.2 High severity
dashy: External Control of System or Configuration Setting
Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite configured permi
- 9.6 Critical severity
Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a…
Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
- 9.6 Critical severity
Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a…
Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
- 7.5 High severity
Campus Recruiting: Client-Side Enforcement of Server-Side Security
Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers.
- 7.1 High severity
Capgo: Client-Side Enforcement of Server-Side Security
Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated
- 8.8 High severity
Electronic Protest Docketing System (EPDS): Client-Side Enforcement of Server-Side Security
The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) trusts client-provided values for the 'epds_role_id' parameter without verification, allo
- 8.3 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)
- 8.8 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)
- 8.1 High severity
Chrome: Client-Side Enforcement of Server-Side Security
Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- 7.3 High severity
open-webui: Client-Side Enforcement of Server-Side Security
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the API does not properly validate that the user has an authorized user role of user. By default, when Open WebUI is configured with new sign-u
- 8.8 High severity
jupyterlab: Improper Neutralization of Argument Delimiters in a Command
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not
- 10.0 Critical severity
dataspace-portal: Client-Side Enforcement of Server-Side Security
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered "PE
- 7.5 High severity
filebrowser: Missing Authentication for Critical Functionality
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerab
- 9.0 Critical severity
budibase: Improper Neutralization of Input During Web Page Generation
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists even though file extension restrictions are configured. The restriction is enforced only at the UI le
- 7.1 High severity
frappe: Improper Access Control
Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versi
- 9.8 Critical severity
RustDesk Client: Client-Side Enforcement of Server-Side Security
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program files src/re
- 9.8 Critical severity
cal.com: Client-Side Enforcement of Server-Side Security
Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.upd
- 7.5 High severity
1Panel: Authentication Bypass by Spoofing
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this valu
- 9.8 Critical severity
Mjobtime: Client-Side Enforcement of Server-Side Security
mJobtime 15.7.2 handles authorization on the client side, which allows an attacker to modify the client-side code and gain access to administrative features. Additionally, they can craft requests based on the client-side code to call these administrative funct
- 7.5 High severity
SKT PayPal for WooCommerce: Client-Side Enforcement of Server-Side Security
The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only enforcing client side controls instead of server-side controls when processing payments. This makes it
- 7.3 High severity
Perfektive: Improper Restriction of Excessive Authentication Attempts
Improper Restriction of Excessive Authentication Attempts, Client-Side Enforcement of Server-Side Security, Reliance on Untrusted Inputs in a Security Decision vulnerability in Turkguven Software Technologies Inc. Perfektive allows Brute Force, Authentication
- 7.4 High severity
Cloud Pak For Business Automation: Client-Side Enforcement of Server-Side Security
IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.
- 7.5 High severity
WPC Name Your Price for WooCommerce: Client-Side Enforcement of Server-Side Security
The WPC Name Your Price for WooCommerce plugin for WordPress is vulnerable to unauthorized price alteration in all versions up to, and including, 2.1.9. This is due to the plugin not disabling the ability to name a custom price when it has been specifically di