Improper Enforcement of Behavioral Workflow
CWE-841
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence or timeframe.
We track 34 vulnerabilities of this type. 97% are rated high or critical, and the average CVSS score is 8.2. 1 has been exploited in real attacks.
Latest Improper Enforcement of Behavioral Workflow vulnerabilities
- 7.3 High severity
A security flaw has been discovered in BeikeShop up to 2.0.0.31.
A security flaw has been discovered in BeikeShop up to 2.0.0.31. Impacted is the function OrderRepo::getOrderByNumber of the file beike/Repositories/OrderRepo.php of the component Guest Order Lookup. Performing a manipulation of the argument order_number resul
- 8.8 High severity
Chrome: Improper Enforcement of Behavioral Workflow
Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
- 8.8 High severity
Chrome: Improper Enforcement of Behavioral Workflow
Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted H
- 8.8 High severity
Chrome: Improper Enforcement of Behavioral Workflow
Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 8.1 High severity
FileRise: Improper Restriction of Excessive Authentication Attempts
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credenti
- 8.8 High severity
Gitea: Improper Enforcement of Behavioral Workflow
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked
- 8.8 High severity
Chrome: Improper Enforcement of Behavioral Workflow
Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 7.1 High severity
klever-go: Improper Enforcement of Behavioral Workflow
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a r
- 8.8 High severity
Infrastructure Controller: Improper Enforcement of Behavioral Workflow
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclos
- 7.3 High severity
strongSwan: Improper Enforcement of Behavioral Workflow
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.
- 6.5 Medium severity
Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Exploited
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the
- 8.7 High severity
klever-go: Improper Enforcement of Behavioral Workflow
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay <= 0 early return. computeSplitRo
- 7.5 High severity
Chrome: Improper Enforcement of Behavioral Workflow
Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit
- 7.4 High severity
filament: Concurrent Execution using Shared Resource with Improper Synchronization
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurre
- 7.5 High severity
gun: Improper Enforcement of Behavioral Workflow
Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited 101 Switching Protocols response. In gun_http:handle_inform/8, when a 101 Switc
- 8.8 High severity
YAFNET: Improper Neutralization of Special Elements used in an SQL Command
YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery
- 7.4 High severity
net-imap: Missing Report of Error Condition
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS. This issue
- 7.5 High severity
mastodon: Improper Enforcement of Behavioral Workflow
Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up based on e-mail domain names, and performs basic validation on e-mail addresses, but fails to restri
- 9.1 Critical severity
botan: Improper Enforcement of Behavioral Workflow
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to enforce client authentication via certificate
- 7.5 High severity
Web-based Pharmacy Product Management System: Improper Enforcement of Behavioral Workflow
A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if the requested sales quantity (txtqty) exceeds the available stock level. An attacker can manipulate the
- 9.8 Critical severity
RustDesk Client: Client-Side Enforcement of Server-Side Security
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program files src/re
- 9.8 Critical severity
Server: Improper Enforcement of Behavioral Workflow
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out acc
- 7.1 High severity
chamilo-lms: Improper Enforcement of Behavioral Workflow
Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint.
- 7.5 High severity
A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce…
A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_
- 9.8 Critical severity
freescout: Improper Enforcement of Behavioral Workflow
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted,
- 8.1 High severity
freescout: Improper Enforcement of Behavioral Workflow
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence of actions to implement a functional capability, but the application allows access to the functional
- 8.8 High severity
freescout: Improper Enforcement of Behavioral Workflow
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is no check for the absence of the password field in the data coming from the user, which leads to a mas
- 8.1 High severity
Sunshine: Authentication Bypass by Primary Weakness
Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a c
- 7.7 High severity
GitLab: Improper Enforcement of Behavioral Workflow
An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.
- 7.1 High severity
Geodi: Improper Enforcement of Behavioral Workflow
Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass. This issue affects Geodi: before 8.0.0.27396.
- 9.8 Critical severity
Free Hospital Management System for Small…: Improper Enforcement of Behavioral Workflow
A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the component Redi
- 9.1 Critical severity
SEPCOS Control and Protection Relay firmware…: Improper Enforcement of Behavioral Workflow
Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.
- 7.5 High severity
SEPCOS Control and Protection Relay firmware…: Unrestricted Upload of File with Dangerous Type
Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the s
- 7.5 High severity
SEPCOS Control and Protection Relay firmware…: Improper Enforcement of Behavioral Workflow
Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponding, browser accessible PHP script